23 Kvě
2019
23 Kvě
'19
3:10
I'm new to knot resolver (krsed).
Running kresd in runit and logging via svlogd.
I'm trying to run kresd on a lan with internal ip addresses and
internal domains.
I can currently do this with dnsmasq and unbound, but I wanted to see
how kresd would do on the client facing edge.
I have an Active Directory domain which I've inherited (domain.local)
and I've made a building.domain dns infrastructure for the different
buildings. (building-red.domain, building-orange.domain,
building-green.domain, etc..)
There were two AD dns servers doing all the DNS.. There is now a
pihole server and dnsmasq helping to offset the queries.
I'm looking to put up a kresd on the :53 and move the current dnsmasq
installs to :57 and have kresd forward to them.
When I do this my building.domain and domain.local are not resolvable.
What am I missing?
Unbound has a private-address and private-domain which handles this.
Does knot resolver have something similar?
egrep -v "\-\-" /etc/knot-resolver/config
<code>
net.listen('10.20.0.43', 53)
trust_anchors.remove('.')
modules = {
'policy',
'stats',
'predict'
}
cache.size = 100*MB
cache.storage = 'lmdb:///var/cache/knot-resolver/'
user( 'knot-resolver', 'knot-resolver' )
predict.config({ window = 20, period = 72 })
policy.add( policy.all( policy.FORWARD(
{ '10.20.0.43@57', '10.20.0.53@57' }
)))
</code>
Below is an excerpt from the kresd logs captured via svlogd showing
the nxdomain return..
2019-05-22_18:19:53.06750 [00000.00][plan] plan 'squid.tech.pcsd.'
type 'A' uid [35568.00]
2019-05-22_18:19:53.06756 [35568.00][iter] 'squid.tech.pcsd.' type
'A' new uid was assigned .01, parent uid .00
2019-05-22_18:19:53.06758 [35568.01][cach] => trying zone: ., NSEC, hash 0
2019-05-22_18:19:53.06759 [35568.01][cach] => NSEC sname: covered
by: pccw. -> pe., new TTL 83379
2019-05-22_18:19:53.06760 [35568.01][cach] => NSEC wildcard: covered
by: . -> aaa., new TTL 84454
2019-05-22_18:19:53.06761 [35568.01][cach] => writing RRsets: +++
2019-05-22_18:19:53.06762 [35568.01][iter] <= rcode: NXDOMAIN
2019-05-22_18:19:53.06768 [35568.01][resl] AD: request NOT
classified as SECURE
2019-05-22_18:19:53.06773 [35568.01][resl] finished: 0, queries: 1,
mempool: 16400 B
and this is another request that worked successfully
2019-05-22_18:19:53.07382 [00000.00][plan] plan
'r6---sn-8xgp1vo-2iae.googlevideo.com.' type 'A' uid [24882.00]
2019-05-22_18:19:53.07384 [24882.00][iter]
'r6---sn-8xgp1vo-2iae.googlevideo.com.' type 'A' new uid was assigned
.01, parent uid .00
2019-05-22_18:19:53.07388 [24882.01][cach] => skipping unfit CNAME
RR: rank 020, new TTL -144
2019-05-22_18:19:53.07389 [24882.01][cach] => no NSEC* cached for
zone: googlevideo.com.
2019-05-22_18:19:53.07389 [24882.01][cach] => skipping zone:
googlevideo.com., NSEC, hash 0;new TTL -123456789, ret -2
2019-05-22_18:19:53.07389 [24882.01][cach] => skipping zone:
googlevideo.com., NSEC, hash 0;new TTL -123456789, ret -2
2019-05-22_18:19:53.07390 [ ][nsre] score 21 for 10.20.0.43#00057;
cached RTT: 19
2019-05-22_18:19:53.07391 [ ][nsre] score 40001 for
10.20.0.53#00057; cached RTT: 12666
2019-05-22_18:19:53.07391 [24882.01][resl] => id: '07414' querying:
'10.20.0.43#00057' score: 21 zone cut: '.' qname:
'R6---sN-8Xgp1VO-2iae.goOgLeVIDeO.CoM.' qtype: 'A' proto: 'udp'
here is dig showing that the entry does exist..
; <<>> DiG 9.14.2 <<>> @10.20.0.43 -p 53 -t any squid.tech.pcsd
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17967
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;squid.tech.pcsd. IN ANY
;; ANSWER SECTION:
squid.tech.pcsd. 300 IN A 10.20.0.69
;; Query time: 3 msec
;; SERVER: 10.20.0.43#53(10.20.0.43)
;; MSG SIZE rcvd: 60
As I said I'm still new to kresd and it's logging format so please
excuse my ignorance if the answer is obvious.. I've been reading all
that I can, and I couldn't find a use case that was like mine in the
documentation.. (I did find two things that were causing me problems
with upstream providers in unbound because of the docs.. which is why
I'm looking to try it on the lan and see what happens.. )
Thank you for taking the time to read this.
I'm looking to fortify and make things more resilient with the network
so that I can focus on finishing other projects.. and from what I can
see.. knot will totally help me with that.
Again, thanks for this piece of software - greatly appreciated.
After squidguard and pihole this is what I'm sending to the outiside
world (thanks to krsed..
https://imgur.com/a/tlcC6Jx
--
This message may contain confidential information and is intended only for
the individual(s) named. If you are not an intended recipient you are not
authorized to disseminate, distribute or copy this e-mail. Please notify
the sender immediately if you have received this e-mail by mistake and
delete this e-mail from your system.