Hello,
I have at the moment a network with 3 DNS servers. They do
recursive/caching as well as authorative zones (Bind 9). I want to build
a structure with 2 authorative Servers using Knot-DNS and 3 resolvers
using Knot-Resolver.
As our authorative servers are in our network and as I want to get any
changes in their zones as fast as possible to our users I use from the
documentation:
Replacing part of the DNS tree
Interesting is this line:
policy.add(policy.suffix(policy.STUB({'$our ip'}), extraTrees))
Can I put more than one IP at this line to forward the queries? We have
2 authorative servers, so I want ask both of them round robin like.
In my config I have comma separated two servers, kresd is running with
it, but it seems it uses only the first.
Is there a way to get my desired behavior?
Regards
Thomas
P.S.: Versions are Knot-Resolver 3.2.1 and OS is Ubuntu 18.04.02
--
Thomas Belián
Fachhochschule Erfurt
Fak. GTI / FR AI & Hochschulrechenzentrum
Postfach 45 01 55, 99051 Erfurt
Telefon: +49361 6700 - 647
E-Mail: thomas.belian(a)fh-erfurt.de
Dear Knot Resolver users,
Knot Resolver 3.2.1 has been released.
Bugfixes
--------
- trust_anchors: respect validity time range during TA bootstrap (!748)
- fix TLS rehandshake handling (!739)
- make TLS_FORWARD compatible with GnuTLS 3.3 (!741)
- special thanks to Grigorii Demidov for his long-term work on Knot
Resolver!
Improvements
------------
- improve handling of timeouted outgoing TCP connections (!734)
- trust_anchors: check syntax of public keys in DNSKEY RRs (!748)
- validator: clarify message about bogus non-authoritative data (!735)
- dnssec validation failures contain more verbose reasoning (!735)
- new function trust_anchors.summary() describes state of DNSSEC TAs (!737),
and logs new state of trust anchors after start up and automatic changes
- trust anchors: refuse revoked DNSKEY even if specified explicitly,
and downgrade missing the SEP bit to a warning
Full changelog:
https://gitlab.labs.nic.cz/knot/knot-resolver/raw/v3.2.1/NEWS
Sources:
https://secure.nic.cz/files/knot-resolver/knot-resolver-3.2.1.tar.xz
GPG signature:
https://secure.nic.cz/files/knot-resolver/knot-resolver-3.2.1.tar.xz.asc
Documentation:
https://knot-resolver.readthedocs.io/en/v3.2.1/
--
Tomas Krizek
PGP: 4A8B A48C 2AED 933B D495 C509 A1FB A5F7 EF8C 4869
Dear Knot Resolver users,
Knot Resolver 3.2.0 has been released.
New features
------------
- module edns_keepalive to implement server side of RFC 7828 (#408)
- module nsid to implement server side of RFC 5001 (#289)
- module bogus_log provides .frequent() table (!629, credit Ulrich Wisser)
- module stats collects flags from answer messages (!629, credit Ulrich
Wisser)
- module view supports multiple rules with identical address/TSIG
specification
and keeps trying rules until a "non-chain" action is executed (!678)
- module experimental_dot_auth implements an DNS-over-TLS to auth protocol
(!711, credit Manu Bretelle)
- net.bpf bindings allow advanced users to use eBPF socket filters
Bugfixes
--------
- http module: only run prometheus in parent process if using --forks=N,
as the submodule collects metrics from all sub-processes as well.
- TLS fixes for corner cases (!700, !714, !716, !721, !728)
- fix build with -DNOVERBOSELOG (#424)
- policy.{FORWARD,TLS_FORWARD,STUB}: respect net.ipv{4,6} setting (!710)
- avoid SERVFAILs due to certain kind of NS dependency cycles, again
(#374) this time seen as 'circular dependency' in verbose logs
- policy and view modules do not overwrite result finished requests (!678)
Improvements
------------
- Dockerfile: rework, basing on Debian instead of Alpine
- policy.{FORWARD,TLS_FORWARD,STUB}: give advantage to IPv6
when choosing whom to ask, just as for iteration
- use pseudo-randomness from gnutls instead of internal ISAAC (#233)
- tune the way we deal with non-responsive servers (!716, !723)
- documentation clarifies interaction between policy and view modules
(!678, !730)
Module API changes
------------------
- new layer is added: answer_finalize
- kr_request keeps ::qsource.packet beyond the begin layer
- kr_request::qsource.tcp renamed to ::qsource.flags.tcp
- kr_request::has_tls renamed to ::qsource.flags.tls
- kr_zonecut_add(), kr_zonecut_del() and kr_nsrep_sort() changed
parameters slightly
Full changelog:
https://gitlab.labs.nic.cz/knot/knot-resolver/raw/v3.2.0/NEWS
Sources:
https://secure.nic.cz/files/knot-resolver/knot-resolver-3.2.0.tar.xz
GPG signature:
https://secure.nic.cz/files/knot-resolver/knot-resolver-3.2.0.tar.xz.asc
Documentation:
https://knot-resolver.readthedocs.io/en/v3.2.0/
--
Tomas Krizek
PGP: 4A8B A48C 2AED 933B D495 C509 A1FB A5F7 EF8C 4869
Dobrý den,
používám knot-resolver ver. 3.1.0 a zjistil, že nevrací A záznamy pro:
www.cezdistribuce.cz
když vymažu cache:
cache.clear('cezdistribuce.cz')
tak se knot-resolver na nedefinovanou dobu umoudří a A záznamy normálně
vrací. Přitom google DNS 8.8.8.8 záznamy vrací v pořádku. Jinou anomálii
jsem nezjistil. V čem může být problém? Konfigurace?
Nefunkční výpis:
$ dig @192.168.100.100 -t A www.cezdistribuce.cz
; <<>> DiG 9.11.4-P2-3~bpo9+1-Debian <<>> @192.168.100.100 -t A
www.cezdistribuce.cz
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26696
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.cezdistribuce.cz. IN A
;; AUTHORITY SECTION:
cezdistribuce.cz. 41952 IN SOA ns10.cez.cz.
netmaster.cezdata.cz. 2018112701 28800 7200 864000 86400
;; Query time: 1 msec
;; SERVER: 192.168.100.100#53(192.168.100.100)
;; WHEN: Po pro 10 07:58:55 CET 2018
;; MSG SIZE rcvd: 112
Funkční, po vymazaní z cache:
$ dig @192.168.100.100 -t A www.cezdistribuce.cz
; <<>> DiG 9.11.4-P2-3~bpo9+1-Debian <<>> @192.168.100.100 -t A
www.cezdistribuce.cz
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 89
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.cezdistribuce.cz. IN A
;; ANSWER SECTION:
www.cezdistribuce.cz. 24 IN A 89.111.76.140
;; Query time: 0 msec
;; SERVER: 192.168.100.100#53(192.168.100.100)
;; WHEN: Po pro 10 08:09:59 CET 2018
;; MSG SIZE rcvd: 65
Děkuji za pomoc.
--
Zdeněk Janiš
hi
My idea is to use knot resolver as dns forwarder / cache instead using
dnsmasq. I am using old PC with archlinux as router.
I did change dnsmasq config so it listen on port 5353.
following steps here
https://wiki.archlinux.org/index.php/Knot_Resolver
I did change systemd unit so my kresd is listening on both local interfaces. I
am checking that with ss command and it is ok.
here is my config of kresd
cat /etc/knot-resolver/kresd.conf
-- vim:syntax=lua:
-- Refer to manual:
http://knot-resolver.readthedocs.org/en/latest/daemon.html#configuration
-- Load useful modules
modules = {
'policy', -- Block queries to local zones/bad sites
'hints > iterate', -- Load /etc/hosts and allow custom root hints
'stats', -- Track internal statistics
'predict', -- Prefetch expiring/frequent records
}
-- See kresd.systemd(7) about configuring network interfaces when using systemd
-- Listen on localhost (default)
-- net = { '127.0.0.1', '::1'}
-- Enable DNSSEC validation
-- trust_anchors.file = '/etc/knot-resolver/root.keys'
hints.root_file = '/etc/knot-resolver/root.hints'
-- Cache size
cache.size = 100 * MB
After start I can see following errors in journal
Nov 08 22:49:43 skriatok systemd[1]: Starting Knot Resolver daemon...
Nov 08 22:49:43 skriatok systemd[1]: Started Knot Resolver daemon.
Nov 08 22:49:53 skriatok kresd[9012]: [priming] cannot resolve address 'b.root-
servers.net.', type: 1
Nov 08 22:49:53 skriatok kresd[9012]: [priming] cannot resolve address 'b.root-
servers.net.', type: 28
Nov 08 22:49:53 skriatok kresd[9012]: [priming] cannot resolve address 'h.root-
servers.net.', type: 28
Nov 08 22:49:53 skriatok kresd[9012]: [priming] cannot resolve address 'j.root-
servers.net.', type: 1
Nov 08 22:49:53 skriatok kresd[9012]: [priming] cannot resolve address 'm.root-
servers.net.', type: 1
Nov 08 22:49:53 skriatok kresd[9012]: [priming] cannot resolve address 'l.root-
servers.net.', type: 1
Nov 08 22:49:53 skriatok kresd[9012]: [priming] cannot resolve address 'j.root-
servers.net.', type: 28
Nov 08 22:49:53 skriatok kresd[9012]: [priming] cannot resolve address 'i.root-
servers.net.', type: 28
Nov 08 22:49:53 skriatok kresd[9012]: [priming] cannot resolve address 'g.root-
servers.net.', type: 28
Nov 08 22:49:53 skriatok kresd[9012]: [priming] cannot resolve address 'f.root-
servers.net.', type: 28
Nov 08 22:49:53 skriatok kresd[9012]: [priming] cannot resolve address 'e.root-
servers.net.', type: 28
Nov 08 22:49:53 skriatok kresd[9012]: [priming] cannot resolve address 'd.root-
servers.net.', type: 28
Nov 08 22:49:53 skriatok kresd[9012]: [priming] cannot resolve address 'a.root-
servers.net.', type: 28
Nov 08 22:49:53 skriatok kresd[9012]: [priming] cannot resolve address 'h.root-
servers.net.', type: 1
Nov 08 22:49:53 skriatok kresd[9012]: [priming] cannot resolve address 'c.root-
servers.net.', type: 1
Nov 08 22:49:53 skriatok kresd[9012]: [priming] cannot resolve address 'k.root-
servers.net.', type: 1
Nov 08 22:49:53 skriatok kresd[9012]: [priming] cannot resolve address 'e.root-
servers.net.', type: 1
Nov 08 22:49:53 skriatok kresd[9012]: [priming] cannot resolve address 'f.root-
servers.net.', type: 1
...
thank you for help
Hi,
I am not able to force knot-resolver to forward some queries.
I have real DNS zone and in internal network I have few 3rd level subzones.
For them I would like to make my kresd forward queries to our internal DNS
server (bind9).
My computer is not inside company nework - connected via openvpn.
System is ubuntu 18.04.1 (up-to-date) and knot-resolver 3.0.0.
Relevant part of kresd.conf is:
policy.add(policy.suffix(
policy.FORWARD('10.0.0.1'),{
todname('sub1.company.cz'),
todname('sub2.company.cz')
}
))
dig machine.sub1.company.cz @127.0.0.53 does NOT work,
dig machine.sub1.company.cz @10.0.0.1 DOES work
I have set verbose(true) but with no help.
kresd queries 10.0.0.1 for 'company.cz' only, but that's all.
I am just working on it on my ubuntu workstation,
but real target will be turris omnia with its kresd,
which connects via openvpn to company network.
--
Sincerely
Ivo Panacek
Dear Knot Resolver users,
Is it possible to create a view with more than one policie?
If I do for example something like this:
view:addr('192.168.1.0/24',
policy.suffix(
policy.PASS,
policy.todnames({'good.com','better.com','best.com'})
)
)
view:addr('192.168.1.0/24',
policy.suffix(
policy.REFUSE,{todname('bad.com')}
)
)
Knot resolver will obey only the first view and users will be able to resolve the bad.com domain ... obviously the first view is the match and no other views are considered afterwards ...
Without multiple policies views are pretty much useless so I believe that I must be doing something wrong here so could anybody help me on this ...
Best regards,
Bratislav ILIC
