Wildcard interfaces and UDP

Hello there,

our NSD setup is pretty simple, however the server one isn't.

there are 2 servers sharing one IP-address inbetween via CARP. though, a problem:

if "ip-address:" is specified, everything works flawlessly, otherwise dig returns timeout error. But tcp-connection works fine, and "dig -t A @... ... +tcp" returns correct answer.

tried to turn off firewall, disable ipv6, also some different configurations: no changes.

Linux 2.6.35, NSD 3.1.1-3.2.7. Is it a bug or a feature?

Thanks in advance for the answer.

Hi Vlad,

Hello there,

our NSD setup is pretty simple, however the server one isn't.

there are 2 servers sharing one IP-address inbetween via CARP.
though, a problem:

This messes with the routes and interfaces, right? NSD may need to have
ip-address: specified by hand, with the full IP addresses it services
(to avoid it calling the OS with zero IP and letting the route tables do
the wrong things).

if "ip-address:" is specified, everything works flawlessly, otherwise
dig returns timeout error. But tcp-connection works fine, and "dig -t
A @... ... +tcp" returns correct answer.

If everything works fine, then, it is fine?

tried to turn off firewall, disable ipv6, also some different
configurations: no changes.

Linux 2.6.35, NSD 3.1.1-3.2.7. Is it a bug or a feature?

I do not understand what the bug or feature you are talking about is.

Best regards,
   Wouter

Hi Vlad,

> Hello there,
>
> our NSD setup is pretty simple, however the server one isn't.
>
> there are 2 servers sharing one IP-address inbetween via CARP.
> though, a problem:

This messes with the routes and interfaces, right? NSD may need to have
ip-address: specified by hand, with the full IP addresses it services
(to avoid it calling the OS with zero IP and letting the route tables do
the wrong things).

oh I see, but well.. when you run apache, snmpd or anything else, it handles
such situation pretty carefully, no?

the idea is one more ip address is added dynamically as an alias to physical
interface:

ifconfig eth0:0 xx.xx.xx.xx netmsk yy.yy.yy.yy

then I can connect to http, snmp, etc.

when i use wildcard interface for nsd, static IP address works fine, but not
that "dynamic" one.

> if "ip-address:" is specified, everything works flawlessly, otherwise
> dig returns timeout error. But tcp-connection works fine, and "dig -t
> A @... ... +tcp" returns correct answer.

If everything works fine, then, it is fine?

the problem is: I can't specify it on both machines, since it can belong to
the only one. it's handled dynamically by CARP. and when I put non-existent
IP-address, NSD failes to start while binding to non-existent IP.

> tried to turn off firewall, disable ipv6, also some different
> configurations: no changes.
>
> Linux 2.6.35, NSD 3.1.1-3.2.7. Is it a bug or a feature?

I do not understand what the bug or feature you are talking about is.

the topic :wink:

Hi Vlad,

Hi Vlad,

Hello there,

our NSD setup is pretty simple, however the server one isn't.

there are 2 servers sharing one IP-address inbetween via CARP.
though, a problem:

This messes with the routes and interfaces, right? NSD may need to have
ip-address: specified by hand, with the full IP addresses it services
(to avoid it calling the OS with zero IP and letting the route tables do
the wrong things).

oh I see, but well.. when you run apache, snmpd or anything else, it handles
such situation pretty carefully, no?

the idea is one more ip address is added dynamically as an alias to physical
interface:

ifconfig eth0:0 xx.xx.xx.xx netmsk yy.yy.yy.yy

then I can connect to http, snmp, etc.

when i use wildcard interface for nsd, static IP address works fine, but not
that "dynamic" one.

Thank you for the explanation. Yes that sounds like something that NSD
does not do today; it is a feature that you need. Unbound has
'interface-automatic' for this.

With that option it sets lots of socket options, and basically asks the
system what interface the packet was received on, and instructs it to
send the reply via that specific interface. These options depend on the OS.

the problem is: I can't specify it on both machines, since it can belong to
the only one. it's handled dynamically by CARP. and when I put non-existent
IP-address, NSD failes to start while binding to non-existent IP.

Yes exactly, detecting that a new interface was added to the system.

Best regards,
   Wouter

Any plans to port the unbound code to nsd?

Paul