Ok, i can’t figure this out, hopefully a silly mistake somewhere. Upgrade from 1.1.8 to 1.2.1 (built last week) with existing wan-load-balancer on 3 interfaces and dns forwarder.
Changed forwarder from listen-on to listen-address and now it replies SERVFAIL for some subnets including the local router. I can’t figure out why. I’m thinking it might be to do with the load-balance rules. I just want it to forward queries to cloudflare etc (and read specific names from the local hosts file, but i’ve disabled that for now).
When this is ran from the router (ssh):
vyos@gateway-temp# dig google.com
; <<>> DiG 9.9.5-9+deb8u17-Debian <<>> google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 27634
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;google.com. IN A
;; Query time: 4902 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Apr 23 18:05:23 AEST 2019
;; MSG SIZE rcvd: 39
And from a host in the 10.1.0.0/24 subnet:
root@kcbmain:~# dig google.com
; <<>> DiG 9.10.3-P4-Debian <<>> google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 63623
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;google.com. IN A
;; Query time: 4507 msec
;; SERVER: 10.1.0.2#53(10.1.0.2)
;; WHEN: Tue Apr 23 18:07:02 AEST 2019
;; MSG SIZE rcvd: 39
And here is the config. eth0 and eth1 are internal subnets, while eth2, eth3 and eth4 are load-balanced to 3 separate isps (which seems to work better than 1.1.8 btw):
interfaces {
ethernet eth0 {
address 10.0.0.125/24
duplex auto
smp-affinity auto
speed auto
}
ethernet eth1 {
address 10.1.0.2/24
duplex auto
smp-affinity auto
speed auto
}
ethernet eth2 {
address 172.16.2.10/24
duplex auto
smp-affinity auto
speed auto
}
ethernet eth3 {
address 172.16.3.10/24
duplex auto
smp-affinity auto
speed auto
}
ethernet eth4 {
address 172.16.1.10/24
duplex auto
smp-affinity auto
speed auto
}
loopback lo {
}
}
load-balancing {
wan {
flush-connections
interface-health eth2 {
failure-count 3
nexthop 172.16.2.1
success-count 1
test 10 {
resp-time 5
target 1.1.1.1
ttl-limit 1
type ping
}
}
interface-health eth3 {
failure-count 3
nexthop 172.16.3.1
success-count 1
test 10 {
resp-time 5
target 1.0.0.1
ttl-limit 1
type ping
}
}
interface-health eth4 {
failure-count 3
nexthop 172.16.1.1
success-count 1
test 10 {
resp-time 5
target 8.8.8.8
ttl-limit 1
type ping
}
}
rule 4 {
destination {
address 100.64.0.0/19
}
exclude
inbound-interface eth0
protocol all
}
rule 5 {
destination {
address 10.1.0.0/24
}
exclude
inbound-interface eth0
protocol all
}
rule 7 {
destination {
address 192.168.100.0/24
}
exclude
inbound-interface eth0
protocol all
}
rule 10 {
inbound-interface eth1
interface eth2 {
weight 1
}
interface eth3 {
weight 1
}
interface eth4 {
weight 1
}
protocol all
}
rule 20 {
inbound-interface eth0
interface eth2 {
weight 1
}
interface eth3 {
weight 1
}
interface eth4 {
weight 1
}
protocol all
}
sticky-connections {
inbound
}
}
}
protocols {
static {
route 0.0.0.0/0 {
next-hop 172.16.1.1 {
}
next-hop 172.16.2.1 {
}
next-hop 172.16.3.1 {
}
}
route 100.64.0.0/19 {
next-hop 10.0.0.99 {
}
}
route 192.168.100.0/24 {
next-hop 10.0.0.99 {
}
}
}
}
service {
dhcp-server {
shared-network-name LOCAL {
subnet 10.0.0.0/24 {
default-router 10.0.0.125
dns-server 10.0.0.125
lease 86400
range 0 {
start 10.0.0.40
stop 10.0.0.55
}
}
}
}
dns {
forwarding {
cache-size 1000
dnssec process-no-validate
listen-address 10.0.0.125
listen-address 10.1.0.2
listen-address 127.0.0.1
name-server 1.1.1.1
name-server 1.0.0.1
name-server 8.8.8.8
}
}
ssh {
listen-address 10.0.0.125
port 22
}
}
system {
config-management {
commit-revisions 20
}
console {
}
host-name gateway-temp
ipv6 {
disable-forwarding
}
ntp {
server 0.pool.ntp.org {
}
server 1.pool.ntp.org {
}
server 2.pool.ntp.org {
}
}
syslog {
global {
facility all {
level notice
}
facility protocols {
level debug
}
}
}
time-zone Australia/Brisbane
}
Help is greatly appreciated.
Thanks
