Hi all,
I configured VyOS to forward DNS requests. All requests get forwarded to Freenom (80.80.80.80 & 80.80.81.81) except for requests for one specific domain, those go to an internal server. However, I noticed domain fowarding didn’t go well. Apparently when I apply the configuration or reboot the system the configuration gets applied properly, but after a while the forwarding for the specific domain disappears. The generic forwarding stays there though.
I was running a self-built v1.2.3 and got myself the official 1.2.5, but also on the official v1.2.5 image I got the same problem.
When checking the actual PowerDNS configuration in /etc/powerdns/recursor.conf I noticed that the forward-zones-recurse configuration line changed after ~30 minutes. I’m running two VyOS instances and both have this problem. Removing the DNS service configuration and setting it up again also doesn’t seem to help.
I have the feeling that this is a bug, but if anyone has another solution, please let me know.
The configuration I used:
set service dns forwarding allow-from '10.0.0.0/8'
set service dns forwarding domain mydomain.net server '10.0.0.100'
set service dns forwarding listen-address '0.0.0.0'
set service dns forwarding name-server '80.80.80.80'
set service dns forwarding name-server '80.80.81.81'
The PowerDNS recurser configuration that gets generated on boot/config change:
$ cat /etc/powerdns/recursor.conf
### Autogenerated by dns_forwarding.py ###
# Non-configurable defaults
daemon=yes
threads=1
allow-from=10.0.0.0/8
log-common-errors=yes
non-local-bind=yes
query-local-address=0.0.0.0
query-local-address6=::
# cache-size
max-cache-entries=10000
# negative TTL for NXDOMAIN
max-negative-ttl=3600
# ignore-hosts-file
export-etc-hosts=yes
# listen-on
local-address=0.0.0.0
# dnssec
dnssec=process-no-validate
# forward-zones / recursion
#
# statement is only inserted if either one forwarding domain or nameserver is configured
# if nothing is given at all, powerdns will act as a real recursor and resolve all requests by its own
#
forward-zones-recurse=mydomain.net=10.0.0.100, .=80.80.80.80;80.80.81.81
The changed configuration when the system is running for a while (notice the missing mydomain.net=x.x.x.x
$ cat /etc/powerdns/recursor.conf
### Autogenerated by dns_forwarding.py ###
# Non-configurable defaults
daemon=yes
threads=1
allow-from=10.0.0.0/8
log-common-errors=yes
non-local-bind=yes
query-local-address=0.0.0.0
query-local-address6=::
# cache-size
max-cache-entries=10000
# negative TTL for NXDOMAIN
max-negative-ttl=3600
# ignore-hosts-file
export-etc-hosts=yes
# listen-on
local-address=0.0.0.0
# dnssec
dnssec=process-no-validate
# forward-zones / recursion
#
# statement is only inserted if either one forwarding domain or nameserver is configured
# if nothing is given at all, powerdns will act as a real recursor and resolve all requests by its own
#
forward-zones-recurse=.=80.80.80.80;80.80.81.81
Additional command outputs:
$ w
20:13:19 up 45 min, 1 user, load average: 0.47, 0.14, 0.05
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
vyos pts/0 10.0.0.2 19:29 0.00s 0.25s 0.00s w
$ ls -l /etc/powerdns/recursor.conf
-rw-r--r-- 1 root root 685 Jun 21 19:57 /etc/powerdns/recursor.conf