<!DOCTYPE html>
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<font face="Helvetica, Arial, sans-serif">Hi pdns community<br>
<br>
I've got an odd issue where some clients do not get a response
from either of my 2 recursors. Both are v5.1.4 deployed via docker
with fairly std configs. Generally the logs will indicate if
something is not in the allowed-from list but these clients don't
show there. For all intents and purposes, the recursors work
normally and well for all my other clients.<br>
<br>
Design:<br>
<br>
client ---> firewall --- ipsec vpn --- firewall --->
recursor ---> internet<br>
<br>
Troubleshooting:<br>
<br>
- check for blocks due to allow_from (nothing listed for these
clients)<br>
- check local firewall rules (nothing special or different for
specific clients)<br>
- tcpdump on the recursor hosts show queries hitting those hosts<br>
- pcaps on both firewalls show good traffic<br>
- the start of the logs show the ACL for allow_from is correct<br>
<br>
PDNS-rec Config:<br>
------------------------<br>
<br>
//<br>
<i>######### SECTION incoming #########<br>
incoming:<br>
listen:<br>
- 0.0.0.0<br>
- '::'<br>
allow_from:<br>
- x.x.x.x/y<br>
- etc.<br>
<br>
port: 53<br>
proxy_protocol_from: [a.a.a.a/b]<br>
use_incoming_edns_subnet: true<br>
max_tcp_clients: 128</i><br>
//<br>
<br>
<br>
PDNS-rec docker config:<br>
---------------------------------<br>
<br>
//<br>
<i>---<br>
version: '2.0'<br>
services:<br>
recursor:<br>
image: powerdns/pdns-recursor-51:latest<br>
restart: always<br>
ports:<br>
- "53:53"<br>
- "53:53/udp"<br>
- "8082:8082"<br>
logging:<br>
driver: "syslog"<br>
volumes:<br>
- ./recursor.yml:/etc/powerdns/recursor.yml<br>
- ./named.root.txt:/etc/named.root.txt<br>
- ./proxy-map.lua:/etc/proxy-map.lua</i><br>
//<br>
<br>
PDNS-rec logs:<br>
---------------------<br>
<br>
recursor_1 | Apr 29 13:53:49 PowerDNS Recursor 5.1.4 (C)
PowerDNS.COM BV<br>
recursor_1 | Apr 29 13:53:49 Using 64-bits mode. Built using gcc
10.2.1 20210110 on Apr 8 2025 10:17:24 by root@localhost.<br>
recursor_1 | Apr 29 13:53:49 PowerDNS comes with ABSOLUTELY NO
WARRANTY. This is free software, and you are welcome to
redistribute it according to the terms of the GPL version 2.<br>
recursor_1 | Apr 29 13:53:49 msg="Processing main YAML settings"
subsystem="config" level="0" prio="Notice" tid="0"
ts="1745934829.121" path="/etc/powerdns/recursor.yml"<br>
recursor_1 | Apr 29 13:53:49 msg="YAML config found and
processed" subsystem="config" level="0" prio="Notice" tid="0"
ts="1745934829.121" configname="/etc/powerdns/recursor.yml"<br>
recursor_1 | Apr 29 13:53:49 msg="Enabling IPv4 transport for
outgoing queries" subsystem="config" level="0" prio="Notice"
tid="0" ts="1745934829.123"<br>
recursor_1 | Apr 29 13:53:49 msg="Setting access control"
subsystem="config" level="0" prio="Info" tid="0"
ts="1745934829.125" acl="allow-from" addresses="x.x.x.x/y
a.a.a.a/b etc."<br>
recursor_1 | Apr 29 13:53:49 msg="Will not send queries to"
subsystem="config" level="0" prio="Notice" tid="0"
ts="1745934829.132" addresses="127.0.0.0/8 10.0.0.0/8
100.64.0.0/10 169.254.0.0/16 192.168.0.0/16 172.16.0.0/12 ::1/128
fc00::/7 fe80::/10 0.0.0.0/8 192.0.0.0/24 192.0.2.0/24
198.51.100.0/24 203.0.113.0/24 240.0.0.0/4 ::/96 ::ffff:0:0/96
100::/64 2001:db8::/32 0.0.0.0 ::"<br>
<br>
PDNS-rec host pcap:<br>
------------------------------<br>
<br>
tcpdump -i any -v 'host <client-ip>'<br>
tcpdump: listening on any, link-type LINUX_SLL (Linux cooked),
capture size 262144 bytes<br>
14:01:49.419703 IP (tos 0x0, ttl 124, id 45946, offset 0, flags
[none], proto UDP (17), length 83)<br>
<client-hostname>.65424 >
<recursor-hostname>.domain: 16579+ [1au] A?
canary.officeapps.live.com. (55)<br>
14:01:49.419758 IP (tos 0x0, ttl 123, id 45946, offset 0, flags
[none], proto UDP (17), length 83)<br>
<client-hostname>.65424 > 172.24.0.2.domain: 16579+
[1au] A? canary.officeapps.live.com. (55)<br>
14:01:49.419766 IP (tos 0x0, ttl 123, id 45946, offset 0, flags
[none], proto UDP (17), length 83)<br>
<client-hostname>.65424 > 172.24.0.2.domain: 16579+
[1au] A? canary.officeapps.live.com. (55)<br>
<br>
Any ideas on what could be wrong or what I'm missing here is
appreciated.<br>
<br>
Regards<br>
<br>
Robby<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
</font>
</body>
</html>