Slave using extern IP for sync

[spaantje]

I looks like the slave DNS server is using the wrong IP for the sync.

I have a Plesk server and 2 DNS servers behind a NAT setup.

I can add the slave DNS server via the extension with the internal IP and get a green checkmark.

But when the slave server tries to sync the zone file it get an error like in the syslog:
transfer of '<domain>/IN' from <external-master-ip>#53: Transfer status: REFUSED

When i do the named-nzd2nzf _default.nzd command i see the zones defined as:
zone "<domain>" { type slave; file "<domain>"; masters { <external-master-ip>; }; };

I was expecting the internal-master-ip there?
Is my assumption wrong? Or is my configuration wrong?

Versions:
Plesk: 18.0.66
Slave DNS Manager: 1.10.3-0
BIND (on slave): 9.18.30
OS: Ubuntu 22.04.5

[ayamshanov]

As an option, you can add additional IP addresses to Plesk to allow transferring DNS zones from these addresses as well, https://docs.plesk.com/en-US/obsidian/administrator-guide/dns/restricting-dns-zones-transfer.72219/.

Alternatively, I believe using the transfer-source setting could help,

Only valid for 'type slave' zones. transfer-source determines which local IPv4 address will be bound to TCP connections used to fetch zones transferred inbound by the server. It also determines the source IPv4 address, and optionally the UDP port, used for the refresh queries and forwarded dynamic updates. If not set, it defaults to a BIND controlled value which will usually be the address of the interface "closest to" the remote end. This address must appear in the remote end's allow-transfer option for the zone being transferred, if one is specified. This statement may be specified in normal zone or view clauses or in a global options clause.
(c) https://www.zytrax.com/books/dns/ch7/xfer.html#transfer-source

[spaantje]

Hi @ayamshanov

Thanks. I have added the external IP in the Transfer Restrictions Template but it does not seem to work.

About your transfer-source setting; Are you suggesting adding this to the slave config ?

[ayamshanov]

I have added the external IP in the Transfer Restrictions Template but it does not seem to work.

Any logs/errors? By the way, do you have a firewall? Could it block connections from the slave servers? If yes, it makes sense to adjust firewall settings to pass connections from slave to master as well.

Yes, transfer-source should be used on the slave server side.

[spaantje]

Hi @ayamshanov

When i add the transfer-source on the slave the bind service fails to start:

Jan 21 08:30:05 drndns02 systemd[1]: named.service: Failed with result 'exit-code'.
Jan 21 08:30:05 drndns02 systemd[1]: Failed to start BIND Domain Name Server.

I have tested it with the internal and external IP.

I indeed have a firewall running, all DNS ports are allowed externally, and all traffic between the master and slaves is allowed. So that should not be an issue?

Is it possible to configure the slave-dns-extension to use the internal ip address for the master ip address in the rdnc command?

[spaantje]

I just tested it with the internal IP address as master and that fixes everything.

Are you open to an PR adding an config option to use the internal IP address?