Running DNS server in container - source IPs

General questions
1

I’m trying to run AdguardHome in a container (assigned to IP 192.168.100.200 in the network assigned to containers which is 192.168.100.0/24) and advertise it as a name server to the DHCP clients. It works fine so far but all requests received by AGH seem to originate from a single IP (192.168.100.1) therefore it cannot differentiate/track the different clients which bothers me of course.

I reckon that this might be because of the rootlessport component of podman (see details here and here) and this might be solved by changing the port handler to slirp4netns.

I couldn’t find however any support in vyos to specify a different port handler (or at least to specify custom options to podman). I manually edited /run/systemd/system/vyos-container-adguard.service to include the --network slirp4netns:port_handler=slirp4netns option however it did not have any effect at all (not even an error message that slirp4netns is not installed (?)). Would anyone have any clue how to do this? As per the stackoverflow comment, it might be necessary to podman create before podman run, however that doesn’t work like that in vyos at all…

2

I would say your are just NAT-ing the traffic towards your container network, can this be the case?

3

No I don’t think so, this is all the NAT configuration I have, should not be relevant as traffic to the container network does not go either to eth0 nor to tailscale0 (there is a pod-containers interface fwiw).

 nat {
     source {
         rule 100 {
             outbound-interface eth0
             source {
                 address 192.168.0.0/16
             }
             translation {
                 address masquerade
             }
         }
         rule 110 {
             outbound-interface tailscale0
             source {
                 address 192.168.0.0/16
             }
             translation {
                 address masquerade
             }
         }
     }
 }
4

Also see this comment from here:

By default, Podman uses the rootlessport proxy, which replaces the source ip of the connection with an internal ip from the container namespace. You can, however, explicitly request Podman to use slirp4netns as the port handler, which will preserve the source address at the expense of some performance.

5

Odd, I don’t have that issue.What is your container config like?

6 
set container network containers prefix '192.168.100.0/24'
set container name adguard image 'docker.io/adguard/adguardhome:latest'
set container name adguard network containers address '192.168.100.200'
set container name adguard volume config destination '/opt/adguardhome/conf'
set container name adguard volume config mode 'rw'
set container name adguard volume config source '/config/containers/adguard/conf'
set container name adguard volume data destination '/opt/adguardhome/work'
set container name adguard volume data mode 'rw'
set container name adguard volume data source '/config/containers/adguard/work'

All requests appear from the gateway 192.168.100.1.

7

I’m on Vyos 1.3.4 btw.

8

Does set containter name adguard allow-host-networks help at all?

image
image946×148 12 KB

9

I suppose it might but that would be host networking which I don’t want and it would interfere with the DNS forwarding service on the host.

10

Hang on… are your clients maybe talking to the DNS forwarder which then forwards it to you adblock container?

11

Nope, I advertise the DNS server’s direct IP address to DHCP clients, the DNS forwarder is for other purposes.