Error to use dnsdist

[IT-META]

Hello,
I have setup a PowerDNS 4.9.1 on a Ubuntu Server 22.0.4. It will use for my internal company DNS
I have also setup pdns-recursor and dnsdist on this server.
I have error with dnsdist and I don't undertand why :
Fatal Lua error: [string "chunk"]:6: attempt to call global 'addBackend' (a nil value)
stack traceback:
[string "chunk"]:6: in main chunk
dnsdist.service: Control process exited, code=exited, status=1/FAILURE
This is my dnsdist.conf:

**- Set up dnsdist to listen on port 53 for incoming queries
addLocal("0.0.0.0:53")

-- Define the backend servers
-- Add PowerDNS Recursor running on 127.0.0.1:5335
addBackend("127.0.0.1:5335")

-- Add PowerDNS Authoritative running on 127.0.0.1:53
addBackend("127.0.0.1:53")

-- Set PowerDNS Recursor as the default backend
addDefaultBackend("127.0.0.1:5335")

-- Example: Route queries for a specific domain to PowerDNS Authoritative
-- Replace 'example.com' with your actual domain
addAction("example.com.", Pool("127.0.0.1:53"))

-- Optional: Enable DNSSEC if applicable
setDNSSEC(true)

-- Optional: Configure caching
setCacheSize(1000000) -- Adjust size as needed

-- Optional: Set log level for debugging
setLogLevel(3) -- 0=error, 1=warning, 2=info, 3=debug**

I search on the Web and does not find anything.

Thanks for your help

[omoerbeek]

addBackend is not a valid configuration function. Try newServer. Ther are more configuration file issues. Where/how did you find this example? See https://dnsdist.org/ for some examples and the complete documentation.

[rgacogne]

In fact almost none of the directives used in your configuration file actually exist. I don't know, and don't want to know, how you generated such a file but please have a look at the documentation instead, as suggested by Otto.

[IT-META]

Hello,

I have modified the dnsdist.conf:

-- Listen on the standard DNS port 53
setLocal('127.0.0.1:53')

-- Allow all IPs access (IPv4 and IPv6)
setACL({'0.0.0.0/0'})

-- Backend for PowerDNS Authoritative (running on port 5300)
newServer({address='127.0.0.1:5300', pool='auth'})

-- Backend for PowerDNS Recursor (running on port 5335 or 5301 if specified)
newServer({address='127.0.0.1:5301', pool='recursor'})

-- Network mask group for recursive queries
recursive_ips = newNMG()
recursive_ips:addMask('10.10.20.0/24') -- Replace with your network

-- Route queries from recursive IPs to PowerDNS Recursor
addAction(NetmaskGroupRule(recursive_ips), PoolAction('recursor'))

-- Route all other queries to PowerDNS Authoritative
addAction(AllRule(), PoolAction('auth'))

-- dnsdist configuration file, an example can be found in /usr/share/doc/dnsdist/examples/

-- disable security status polling via DNS
-- setSecurityPollSuffix("")

The DNS request does not work:
ping google.fr
ping: google.fr: Temporary failure in name resolution

Anyone has an idea ?

Regards

[IT-META]

Thanks, it works now on the server.
I want to use this powerdns server for my windows client. It does not work for the moment.
Is it because the authoritative server is listening on port 5300 and not 53 ?
I have test to change pdns.conf to use port 53 and dnsdist to use port 5300. I have reboot the system but the server does not work.
Thanks for your help

[rgacogne]

I don't understand what doesn't work exactly so I am afraid I can't help you, sorry.

[IT-META]

My Windows Client which have my powerdns server configure does not work (DNS is KO). It seems because the DNS is running on the port 5300 and not 53. For test, I have change the authoritative port on the server to 53 and dnsdist port on 5300. Now, on the server, I have this :

dig @127.0.0.1 -p 5300 google.com

; <<>> DiG 9.18.28-0ubuntu0.22.04.1-Ubuntu <<>> @127.0.0.1 -p 5300 google.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6288
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;google.com. IN A

;; ANSWER SECTION:
google.com. 258 IN A 142.250.201.174

;; Query time: 71 msec
;; SERVER: 127.0.0.1#5300(127.0.0.1) (UDP)
;; WHEN: Thu Sep 19 14:54:51 CEST 2024
;; MSG SIZE rcvd: 55

metavonics@vm-d-powerdns-01-tls:~$ dig @127.0.0.1 -p 53 google.com

; <<>> DiG 9.18.28-0ubuntu0.22.04.1-Ubuntu <<>> @127.0.0.1 -p 53 google.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 25293
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;google.com. IN A

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
;; WHEN: Thu Sep 19 14:54:56 CEST 2024
;; MSG SIZE rcvd: 39

Do you understand ?

Thanks

[rgacogne]

Sure, DNS clients will always send queries to port 53 (some might be configurable but that's uncommon). But, didn't you set up a rule (NetmaskGroupRule(recursive_ips)...) so that DNSdist forwards queries from these clients to your authoritative server?

[IT-META]

I have this on my configuration:
-- Route queries from recursive IPs to PowerDNS Recursor
addAction(NetmaskGroupRule(recursive_ips), PoolAction('recursor'))

Moreover, when I launched dig vm-d-powerdns-01-tls.xxx.local @127.0.0.1 without dnsdist, it worked but now the issue is :

; <<>> DiG 9.18.28-0ubuntu0.22.04.1-Ubuntu <<>> vm-d-powerdns-01-tls.internal.xxx.com @127.0.0.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 56806
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;vm-d-powerdns-01-tls.internal.xxxx.com. IN A

;; AUTHORITY SECTION:
xxxx.com. 600 IN SOA ns1085.ui-dns.biz. hostmaster.1und1.com. 2017060111 28800 7200 604800 600

;; Query time: 239 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
;; WHEN: Thu Sep 19 20:54:24 CEST 2024
;; MSG SIZE rcvd: 143

Sorry but I don't understand where is the error ...