PowerDNS IPv6 PTR Global Wildcard

[SwimGeek]

Hi

I'm looking for some advice on setting up PowerDNS so it answers IPv6 PTR queries with a global wildcard response.

IPv4 is easy enough, just add one wildcard record per zone, but IPv6 is going to be a big pain to maintain - too many zones - too many client /48s.

Know of a way to tell the Powerdns that for anything in a /32 network which does not have an existing PTR record, answer with ‘wildcard answer’ ?

I noticed RFC 8501 talks about this problem, but after lots of web searches I can't find a solution.

Using pdns-server 4.9.3 with mysql backend.

[SwimGeek]

maybe it can support having a record like:

*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.8.9.8.e.f.f.c.2.ip6.arpa

[Habbie]

we are limited by the DNS specifications in how we handle wildcards, so this won't fly.

that said, I don't understand why your problem is hard for v6 if it's easy in v4.

[SwimGeek]

Hi, I set up the wildcard for v6 in the same way as v4 - but it does not work the same from my testing.

I found this: https://github.com/endreszabo/PowerDNS-Dynamic-Reverse-Backend

Will try that next.

[omoerbeek]

When reporting "something does not work", it helps to show exactly what you did, what you expected to see, what you actually saw and explain how that made you decide it did not work.

[SwimGeek]

Hi, for IPv4 - I added a wildcard on the /24 level - and the smaller networks below that all worked - probably because IPv4 has simple 'classful' lookups.

For IPv6, I added the wildcard on the /32 level, but the smaller networks under that did not work. Did not return the wildcard when looking up the PTR record.

[Habbie]

We cannot debug a vague description of a situation :) please -show- what you did and what happened. Keep https://blog.powerdns.com/2016/01/18/open-source-support-out-in-the-open in mind!

[SwimGeek]

No stress. I don't think modifying the DNS server is the solution. I think I need something to intercept the query, see if a record exists, if not return a wildcard answer for the full /32 range. - I'll look into the Dynamic-Reverse-Backend option I posted above.

[omoerbeek]

You were looking for advice, but not sharing details, so wasting everybody's time.

Check https://docs.powerdns.com/authoritative/lua-records/functions.html#reverse-dns-functions, they might do what you want.

[alsyundawy]

+1

[vecinohk]

Hi, I'd like to continue this thread. I am trying to use createReverse6 Reverse DNS functions but it only works for me if pdns is in the PRIMARY role. I don't know if this is intentional or a mistake - I couldn't find this information in the documentation.

My setup is: hidden master (primary) -> ns1 (secondary) + ns2 (secondary).

Our prefix is 2a01:168::/29. We have a few hundred static PTR queries, and I would like to use "createReverse6('%33%.hkfree.org')" for the rest.

MariaDB [pdns_externi]> SELECT * FROM records WHERE type='LUA';
+------+-----------+----------------------------+------+-----------------------------------------+------+------+----------+-----------+------+
| id   | domain_id | name                       | type | content                                 | ttl  | prio | disabled | ordername | auth |
+------+-----------+----------------------------+------+-----------------------------------------+------+------+----------+-----------+------+
| 3794 |        22 | *.8.6.1.0.1.0.a.2.ip6.arpa | LUA  | PTR "createReverse6('%33%.hkfree.org')" | 3600 |    0 |        0 | NULL      |    1 |
+------+-----------+----------------------------+------+-----------------------------------------+------+------+----------+-----------+------+

MariaDB [pdns_externi]> SELECT * FROM domainmetadata;
+----+-----------+--------------------+---------+
| id | domain_id | kind               | content |
+----+-----------+--------------------+---------+
|  2 |        22 | ENABLE-LUA-RECORDS | 1       |
+----+-----------+--------------------+---------+

# cat /etc/powerdns/pdns-externi.conf 

setgid=powerdns
setuid=powerdns

local-address=127.0.0.1, ::1
local-port=5302

launch=gmysql
gmysql-host=127.0.0.1
gmysql-user=
gmysql-password=
gmysql-dbname=pdns_externi
gmysql-dnssec=no

enable-lua-records=yes

secondary=yes
version-string=anonymous

trusted-notification-proxy=127.0.0.1, ::1


socket-dir=/var/run/pdns-externi
proxy-protocol-from=127.0.0.1, ::1

❌ result: Query test with a non-existent PTR query on ns1 slave:

# drill -x 2a01:168:3000::1 @10.107.252.150
;; ->>HEADER<<- opcode: QUERY, rcode: NXDOMAIN, id: 57845
;; flags: qr aa rd ; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 
;; QUESTION SECTION:
;; 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.8.6.1.0.1.0.a.2.ip6.arpa.    IN      PTR

;; ANSWER SECTION:

;; AUTHORITY SECTION:
8.6.1.0.1.0.a.2.ip6.arpa.       3600    IN      SOA     ns1.hkfree.org. vv.hkfree.org. 2025110604 10800 3600 604800 3600

version: 5.0.1 (everywhere)

Thank you for any tips and advice. @Habbie 🌟

[vecinohk]

I found out that the problem is caused by the fact that during AXFR transfer, non-terminal / NULL records are created on SECONDARY, and then createReverse6 stops working.

When I delete non-terminal / NULL in MariaDB so SECONDARY behaves exactly as I want it to.

I realize that this is not a solution. I don't want to delete anything, and it's clear that it will be created again after AXFR.

I don't know how to best solve the problem so that I can stay in the SECONDARY role.

Thanks for any tips.

[Habbie]

Pass a table as the second argument to createReverse6 with your exceptions, instead of listing them as separate records.

[vecinohk]

Oh, I guess I didn't understand this advice correctly on IRC. It's working now.
Some people, like me, may appreciate a specific example:
PTR "createReverse6('%33%.hkfree.org', { ['2a01:168:123::1'] = '123.hkfree.org', ['2a01:168:321::1'] = '321.hkfree.org' })"

doc: https://doc.powerdns.com/authoritative/lua-records/functions.html#createReverse6

@Habbie Many thanks. 😃

[omoerbeek]

Please don't hijack the subject. If yo have question on how to manage large Lua records, open a new discussion..

[omoerbeek]

I can only give a general hint: it is very likely your primary instance only works by accident. An AXFR creates a rectified copy on the secondary. Running rectify on your primary probably will make it break as well. The semantics of wildcards in DNS are tricky.

I'll leave it to auth experts to explain how to come to a proper solution.

[Habbie]

Indeed, we also explained this on IRC.

[vecinohk]

Yes, you're right. That's how it behaves.