[Pdns-users] dnsdist webserver bind v4/v6

[Brian Candler]

In the documentation for the dnsdist webserver at 
<https://www.dnsdist.org/guides/webserver.html> it shows in several places

webserver:listen_address:"127.0.0.1:8083"

but that appears to be wrong; the accepted YAML is

webserver:listen_addresses:["127.0.0.1:8083"]

Now, the main issue I have is around getting v4+v6 to work. With dnsdist 
2.1.2 under Ubuntu 24.04, if I write:

webserver:
   listen_addresses:
     - "[::]:8083"
   acl:
     - 127.0.0.1
     - "::1"
   stats_require_authentication: false

then connections on IPv6 work, but connections on IPv4 are immediately 
dropped:

# telnet 127.0.0.1 8083
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
Connection closed by foreign host.
#

But if I try to listen on both v6 and v4 wildcards:

webserver:
   listen_addresses:
     - "[::]:8083"
     - "0.0.0.0:8083"
   acl:
     - 127.0.0.1
     - "::1"
   stats_require_authentication: false

then connections on v6 are refused:

# telnet ::1 8083
Trying ::1...
telnet: Unable to connect to remote host: Connection refused

It seems to be listening on IPv4 only:

# ss -natp | grep :8083
LISTEN    0      5                 0.0.0.0:8083  0.0.0.0:*    
  users:(("dnsdist",pid=105473,fd=14))
#

If I swap the two listen_addresses around it makes no difference. It's 
also same if I bind explicitly to individual IPv4 addresses:

webserver:
   listen_addresses:
     - "[::]:8083"
     - "10.12.249.4:8083"
     - "127.0.0.1:8083"

# ss -natp | grep :8083
LISTEN    0      5          127.0.0.1:8083       0.0.0.0:* 
  users:(("dnsdist",pid=105601,fd=14))
LISTEN    0      5        10.12.249.4:8083       0.0.0.0:* 
  users:(("dnsdist",pid=105601,fd=15))
#

Again, it's listening only on IPv4.

The only way I can get it to work is to list individually the IPv6 
addresses to bind on:

webserver:
   listen_addresses:
     - "[XXXX:XXX:XX:XXXX::4]:8083"
     - "[::1]:8083"
     - "0.0.0.0:8083"

and now it's OK:

# ss -natp | grep :8083
LISTEN    0      5                    0.0.0.0:8083  0.0.0.0:*    
  users:(("dnsdist",pid=105732,fd=14))
LISTEN    0      5                      [::1]:8083 [::]:*    
  users:(("dnsdist",pid=105732,fd=15))
LISTEN    0      5      [XXXX:XXX:XX:XXXX::4]:8083 [::]:*    
  users:(("dnsdist",pid=105732,fd=16))

Anyway, I just thought it was worth a mention. It's just a bit awkward 
because when there are multiple servers, it means the config files have 
to be slightly different on each one.

I have a vague idea I've seen this behaviour before with pdns auth or 
recursor, but I can't remember what the underlying issue was. I found 
this in docs/upgrading.rst:

ixfrdist IPv6 support
^^^^^^^^^^^^^^^^^^^^^

``ixfrdist`` now binds listening sockets with `IPV6_V6ONLY set`, which 
means that ``[::]`` no longer accepts IPv4 connections.
If you want to listen on both IPv4 and IPv6, you need to add a line with 
``0.0.0.0`` to the ``listen`` section of your ixfrdist configuration.

but the proposed workaround of adding both [::] and 0.0.0.0 doesn't 
appear to work in practice, at least not in dnsdist.

Regards,

Brian.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.powerdns.com/pipermail/pdns-users/attachments/20260908/a42a7e3e/attachment-0001.htm>