Set source IP for zone notify

[malmeloo]

I am running Technitium DNS on Docker, attached to multiple macvlan interfaces. This allows me to 'drop' the server into multiple LANs and serve DHCP to both my private and guest network, for example. I also have another DNS server running at another site behind a VPN, and set up a secondary zone. So far so good.

Currently I am facing a problem where zone notifications don't work properly. As it turns out, Technitium DNS is using the interface attached to my guest LAN for outgoing zone notifications, probably due to Docker setting a random one as default gateway. However, my guest LAN cannot reach the other server across the VPN connection, for security reasons. This causes notifications to fail.

I'm wondering if there is a setting to set the source IP for zone notifications (/ transfers) specifically? I believe this would fix my issue. Or perhaps you know of another way to fix this?

[ShreyasZare]

Thanks for the post. On Linux, UDP packets get routed out using the default gateway irrespective of the interface the request came or that the destination IP address being accessible on a local interface. In case of notify, the request is being generated by the DNS server and it thus gets routed using the default gateway.

In such a setup, its best to configure your DNS server on just one IP address and let all of the network subnets use it instead of having the DNS listen on each interface you have on the server. Let routing take care of it.

The other option is to just configure your secondary zone with all IP addresses on the primary server so that it will accept notify requests that comes from any of the listed addresses.

[malmeloo]

Thank you for the swift response. I would still need to have the server on all subnets to serve DHCP, so I don't think running the DNS server on only one of the subnets will fix the issue, correct? Since Docker will still assign the 'wrong' default gateway to the container.

In my case the notify request never actually reaches the secondary server, because my router filters out the traffic - guests aren't allowed to reach across the VPN tunnel. I suppose I could create firewall exceptions, but I would rather not do that.

There are some tricks I haven't tried yet when it comes to theo rder of interface initialization in Docker, maybe that will influence the default gateway. I will try that and see if it works.

[ShreyasZare]

For DHCP, you can setup DHCP Relay Agent instead which will forward all DHCP requests to your DHCP server. This will simplify your setup and avoid any such complications.

[malmeloo]

Ohh great idea! I'll try that, thank you 🙂