For some Internet services (e.g. sending email), in virtual machines (VMs) it is necessary to convert IP addresses into domain names. To perform this conversion, you need to configure VMmanager integration with the DNS server.

VMmanager supports integration with PowerDNS Authoritative Server. PowerDNS is a high-performance, free, open-source DNS server. Read more about PowerDNS in the official documentation

After the integration, PTR records will be created on the DNS server, converting VM addresses into domain names.

Matching of IP address and reverse domain name


To determine a domain name by IP address, the DNS server uses a PTR record of the reverse domain zone. To execute the request, the node address is converted to the reverse form. The translation method depends on the IP version.

IPv4

IPv4 address is written as four decimal numbers from 0 to 255, separated by dots. E.g., 192.168.0.1. To search for domain names by IPv4 addresses, the domain "in-addr.arpa." is used. The IP address is written in the domain name in reverse order. For example, the address 195.161.72.28 corresponds to the domain name "28.72.161.195.inaddr.arpa.".

IPv6

The IPv6 address is written as eight hexadecimal numbers from 0 to ffff, separated by colons. E.g., 3107:0c38:0a67:0000:0000:e446:3925:0091. To search for domain names by IPv6 addresses, the domain "ip6.arpa." is used. The IP address is written in the domain name in reverse order. For example, the address 3107:0c38:0a67:0000:0000:e446:3925:0091 corresponds to the domain name "1.9.0.0.5.2.9.3.6.4.4.e.0.0.0.0.0.0.0.7.6.a.0.8.3.c.0.7.0.1.3.ip6.arpa".

Configuring integration


Installing and configuring PowerDNS

Note

  1. The examples are commands for AlmaLinux 8. For other operating systems the commands may be different.
  2. In the basic configuration PowerDNS uses BIND as backend. BIND does not support API write requests via HTTP, so it is not suitable for integration setup. The example describes changing the backend to Generic Mysql. Read more in the official PowerDNS documentation.

On a server for PowerDNS:

  1. Add the epel-release repository:

    dnf -y install epel-release
    BASH
  2. Install the software updates:

    dnf -y update
    BASH
  3. Disable the SELinux service: 

    setenforce 0
    CODE
    sed -i 's/^SELINUX=.*/SELINUX=disabled/g' /etc/selinux/config
    CODE
  4. Install MySQL:

    dnf -y install mysql-server mysql
    BASH
    systemctl enable mysqld.service
    BASH
    systemctl start mysqld.service
    BASH
  5. Perform the initial MySQL security setup:

    mysql_secure_installation
    BASH
  6. Open the MySQL console:

    mysql -u root -p
    BASH
  7. Create a database and a powernds account in the console:

    CREATE DATABASE powerdns;
    SQL
    CREATE USER 'powerdns' IDENTIFIED BY '<powernds_mysql_pass>';
    SQL

    <powernds_mysql_pass> — password to the powerdns account in MySQL

    GRANT ALL PRIVILEGES ON powerdns.* TO 'powerdns';
    SQL
    FLUSH PRIVILEGES;
    SQL
  8. Exit the console:

    exit
    SQL
  9. Import the scheme for the data source:
    1. Save the scheme from the PowerDNS documentation to /root/powerdns.sql.

      Note

      Each version of PowerDNS has its own scheme.

    2. Import the saved file into the database:

      mysql -u powerdns -p powerdns < /root/powerdns.sql
      BASH
  10. If the systemd-resolved service is enabled, stop and disable it:

    systemctl disable systemd-resolved.service
    BASH
    systemctl stop systemd-resolved.service
    BASH
    systemctl mask systemd-resolved.service
    BASH
  11.  Install PowerDNS:

    dnf -y install pdns pdns-backend-mysql bind-utils
    BASH
    systemctl enable pdns.service
    BASH
    systemctl start pdns.service
    BASH
  12. Create the configuration file /etc/pdns/pdns.conf:

    Configuration for primary DNS

    api=yes
    api-key=<pdns_api_key>  
    webserver=yes
    webserver-port=<pdns_port>
    webserver-address=0.0.0.0
    webserver-allow-from=0.0.0.0/0
    
    launch=gmysql
    gmysql-host=127.0.0.1
    gmysql-user=powerdns
    gmysql-password=<powernds_mysql_pass>
    gmysql-dbname=powerdns
    
    primary=yes
    allow-axfr-ips=<transfer_zone_allow>
    CODE

    Configuration for secondary DNS

    api=yes
    api-key=<pdns_api_key>  
    webserver=yes
    webserver-port=<pdns_port>
    webserver-address=0.0.0.0
    webserver-allow-from=0.0.0.0/0
    
    launch=gmysql
    gmysql-host=127.0.0.1
    gmysql-user=powerdns
    gmysql-password=<powernds_mysql_pass>
    gmysql-dbname=powerdns  
    
    secondary=yes
    CODE

    <pdns_api_key> — PowerDNS API access key. Minimum length — 6 characters

    <pdns_port> — port of access to the built-in PowerDNS web server

    <powernds_mysql_pass> — password to the powerdns account in MySQL

    <transfer_zone_allow> — IP addresses of DNS servers that are allowed to request a domain zone transfer

  13. Open the DNS and PowerDNS web server ports in the firewall:

    firewall-cmd --permanent --zone=public --add-port=<pdns_port>/tcp
    BASH

    <pdns_port> — port of access to the built-in PowerDNS web server

    firewall-cmd --permanent --zone=public --add-service=dns
    BASH
    firewall-cmd --reload
    BASH
  14.  If PowerDNS is used as a secondary DNS:

    1. Add domain zones:

      pdnsutil create-secondary-zone <zone> <primary_dns>
      BASH

      <zone> — domain zone

      <primary_dns> — IP address of the primary DNS server

    2. Open the MySQL console: 

      mysql -u root -p
      SQL
    3. Add a record to the database with the settings of the main server: 

      INSERT INTO supermasters VALUES ('<primary_IP>', '<primary_domain>', 'powerdns') ;
      CODE

      <primary_IP> — IP address of the primary DNS server

      <primary_domain> — domain name of the primary DNS server

    4. Exit the console: 

      exit
      SQL
    5. In the /etc/pdns/pdns.conf file, set autosecondary to yes: 

      autosecondary=yes
      CODE
  15.  Restart PowerDNS:

    systemctl restart pdns.service
    BASH

Configuration VMmanager via the interface

On the server with VMmanager:

  1. Install a "Integration with PowerDNS" module: ModulesIntegration with PowerDNSInstall.

  2. Press Configure and specify PowerDNS API connection settings:
    1. Domain name or IP address.
    2. Connection Port.
    3. API key. 
    4. Name servers.

  3. Press Apply.

Note

If you have integration with other platforms through the Integration with IPmanager 6 module, install the "Integration with PowerDNS" module with the same settings in those platforms.

Configuration VMmanager via API

  1. Send data to VMmanager to connect to PowerDNS API:

    curl -d '{"type":"powerdns", "params":{"address":"<pdns_ip>:<pdns_port>", "password":"<pdns_api_key>"}}' -H "x-xsrf-token: <token>" -H "Host: instance-1" https://<vmmgr_ip>/dnsproxy/v3/settings/dns
    CODE

    <pdns_ip>:<pdns_port> — IP address and PowerDNS port

    <pdns_api_key> — PowerDNS API access key

    <token> — authorization token. Read more in API guide

    <vmmgr_ip> — IP address or domain name of the server with VMmanager

    If you get the message "Instance is starting now" in response, repeat the command.

  2. Enable the dnsproxy service on the server with VMmanager. This service performs integration with external DNS servers.

    curl -X POST -H "x-xsrf-token: <token>" https://<vmmgr_ip>/ip/v3/plugin/dnsproxy/enable
    CODE

    <token> — authorization token

    <vmmgr_ip> — IP address or domain name of the server with VMmanager

3. Start data synchronization with dnsproxy. After that, dnsproxy service will transfer PTR records to PowerDNS:

curl -X POST -H "x-xsrf-token: <token>" https://<vmmgr_ip>/ip/v3/ip/dnsproxy/sync
CODE

<token> — authorization token

<vmmgr_ip> — IP address or domain name of the server with VMmanager

Checking settings

  1. Check that ip6.arpa. and inaddr.arpa. DNS zones are added to PowerDNS:

    curl -v -H 'X-API-Key: <pdns_api_key>' http://<pdns_ip>:<pdns_port>/api/v1/servers/localhost/zones
    CODE

    <pdns_api_key> — PowerDNS API access key

    <pdns_ip>:<pdns_port> — IP address and PowerDNS port

    If the zones are added successfully, the response should contain information about their settings:

    [{
    "account": "",
    "dnssec": false,
    "id": "ip6.arpa.",
    "kind": "Master",
    "last_check": 0,
    "masters": [],
    "name": "ip6.arpa.",
    "notified_serial": 0,
    "serial": 2020032801,
    "url": "/api/v1/servers/localhost/zones/ip6.arpa."
    },
    {
    "account": "",
    "dnssec": false,
    "id": "in-addr.arpa.",
    "kind": "Master",
    "last_check": 0,
    "masters": [],
    "name": "in-addr.arpa.",
    "notified_serial": 0,
    "serial": 2020032812,
    "url": "/api/v1/servers/localhost/zones/in-addr.arpa."
    }]

  2. Check the creation of DNS records in ip6.arpa. and inaddr.arpa.:

    curl -v -H 'X-API-Key: <pdns_api_key>' http://<pdns_ip>:<pdns_port>/api/v1/servers/localhost/zones/in-addr.arpa.
    CODE
    curl -v -H 'X-API-Key: <pdns_api_key>' http://<pdns_ip>:<pdns_port>/api/v1/servers/localhost/zones/ip6.arpa.
    CODE

    <pdns_api_key> — PowerDNS API access key

    <pdns_ip>:<pdns_port> — IP address and PowerDNS port

    The response must contain PTR records for the VMs’ IP addresses.

    {
    "account": "",
    "api_rectify": false,
    "dnssec": false,
    "id": "in-addr.arpa.",
    "kind": "Master",
    "last_check": 0,
    "masters": [],
    "name": "in-addr.arpa.",
    "notified_serial": 0,
    "nsec3narrow": false,
    "nsec3param": "",
    "rrsets": [
    {
    "comments": [],
    "name": "14.250.31.172.in-addr.arpa.",
    "records": [
    {
    "content": "sunshine-ametrine.example.com.",
    "disabled": false
    }
    ],
    "ttl": 3600,
    "type": "PTR"
    },
    {
    "comments": [],
    "name": "0.250.31.172.in-addr.arpa.",
    "records": [
    {
    "content": "subnet.reserved.example.com.",
    "disabled": false
    }
    ],
    "ttl": 3600,
    "type": "PTR"
    },
    ...
    ],
    "serial": 2020032717,
    "soa_edit": "",
    "soa_edit_api": "DEFAULT",
    "url": "/api/v1/servers/localhost/zones/in-addr.arpa."
    }

  3. Check operation of PowerDNS:

    dig -x <IP> @<pdns_ip> +short
    CODE

    <IP> — IP address of the VM

    <pdns_ip> — IP address of PowerDNS

    The response must contain information about the PTR record for the requested IP address.

Diagnostics


VMmanager integration with PowerDNS is performed by the dnsproxy service. You can check the operation of dnsproxy service via the /var/log/dns_proxy_service_1_writer.log file in the vm_dns_proxy_1 docker container on the server with VMmanager.

To check the DNS zone settings in VMmanager, run the command on the server with VMmanager:

docker exec -it mysql bash -c "mysql isp -p\$MYSQL_ROOT_PASSWORD -e 'select * from dns_proxy_zone;' "
CODE

An example of response

*************************** 1. row ***************************
         id: 1
     status: ok
status_info: null
       name: in-addr.arpa
*************************** 2. row ***************************
         id: 2
     status: ok
status_info: null
       name: ip6.arpa
2 rows in set (0.00 sec)
CODE

status_info — DNS record status info. The "null" message means that the zone has been added successfully.


To check the DNS records settings in VMmanager, run the command on the server with VMmanager:

docker exec -it mysql bash -c "mysql isp -p\$MYSQL_ROOT_PASSWORD -e 'select * from dns_proxy_record;' "
CODE

An example of the command output:

An example of response

*************************** 1. row ***************************
         id: 1
     status: ok
status_info: null
       zone: 1
       name: 172.31.255.254
    content: gateway.reserved.example.com
       type: ptr
*************************** 2. row ***************************
         id: 2
     status: ok
status_info: null
       zone: 1
       name: 172.31.240.0
    content: subnet.reserved.example.com
       type: ptr
CODE

status_info — DNS record status info. The "null" message means that the record has been added successfully.

If you have problems configuring the integration:

  1. Disable the dnsproxy service:

    curl -X POST -H "x-xsrf-token: <token>" https://<vmmgr_ip>/ip/v3/plugin/dnsproxy/disable
    CODE

    <token> — authorization token

    <vmmgr_ip> — IP address or domain name of the server with VMmanager

  2. Delete the contents of dns_proxy_record and dns_proxy_zone tables:

    docker exec -it mysql bash -c "mysql isp -p\$MYSQL_ROOT_PASSWORD -e 'delete from dns_proxy_record; delete from dns_proxy_zone;' "
    CODE
  3. Reconfigure the integration.