[Pdns-users] dnsdist webserver bind v4/v6

[Remi Gacogne]

Hello!

On 9/8/26 13:04, Brian Candler via Pdns-users wrote:
> In the documentation for the dnsdist webserver at <https:// 
> www.dnsdist.org/guides/webserver.html> it shows in several places
> 
> webserver:listen_address:"127.0.0.1:8083"
> 
> but that appears to be wrong; the accepted YAML is
> 
> webserver:listen_addresses:["127.0.0.1:8083"]

Oops, we changed the syntax to allow multiple addresses at some point 
before 2.0 but clearly forgot to update the documentation. I'll fix it.

> Now, the main issue I have is around getting v4+v6 to work. With dnsdist 
> 2.1.2 under Ubuntu 24.04, if I write:
> 
> webserver:
>    listen_addresses:
>      - "[::]:8083"
>    acl:
>      - 127.0.0.1
>      - "::1"
>    stats_require_authentication: false
> 
> then connections on IPv6 work, but connections on IPv4 are immediately 
> dropped:
> 
> # telnet 127.0.0.1 8083
> Trying 127.0.0.1...
> Connected to 127.0.0.1.
> Escape character is '^]'.
> Connection closed by foreign host.
> #

Right, that happens because we then the address mapped as IPv6, ie 
[::ffff:127.0.0.1], which is not permitted by the ACL. You can work 
around that by adding it to the ACL, though.
> But if I try to listen on both v6 and v4 wildcards:
> 
> webserver:
>    listen_addresses:
>      - "[::]:8083"
>      - "0.0.0.0:8083"
>    acl:
>      - 127.0.0.1
>      - "::1"
>    stats_require_authentication: false
> 
> then connections on v6 are refused:
> 
> # telnet ::1 8083
> Trying ::1...
> telnet: Unable to connect to remote host: Connection refused
> 
> It seems to be listening on IPv4 only:
> 
> # ss -natp | grep :8083
> LISTEN    0      5                 0.0.0.0:8083  0.0.0.0:*     users: 
> (("dnsdist",pid=105473,fd=14))
> #

Yeah, if you look at the logs the IPv6 attempt failed:

msg="Unable to bind to web server socket" error="While binding: Address 
already in use" subsystem="setup" level="0" prio="Error" 
network.local.address="[::]:8083"

> ``ixfrdist`` now binds listening sockets with `IPV6_V6ONLY set`, which 
> means that ``[::]`` no longer accepts IPv4 connections.
> If you want to listen on both IPv4 and IPv6, you need to add a line with 
> ``0.0.0.0`` to the ``listen`` section of your ixfrdist configuration.
> 
> but the proposed workaround of adding both [::] and 0.0.0.0 doesn't 
> appear to work in practice, at least not in dnsdist.

I think we should indeed set IPV6_V6ONLY on the web server's socket, 
I'll prepare a pull request. I'm a bit worried about backporting that 
change to stable branches, though, since it might be a breaking change 
for some setups.

Best regards,
-- 
Remi Gacogne
PowerDNS.COM BV - https://www.powerdns.com/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: OpenPGP digital signature
URL: <http://mailman.powerdns.com/pipermail/pdns-users/attachments/20260908/e24856e2/attachment.sig>