Setting things up to have Tailscale play nice (ish) with DNS
I’ve written a couple of fairly basic drop-ins for doing pretty standard stuff, but on start I’m getting the first two lines returned on restart:
Jul 29 17:38:27 mymachine systemd-resolved[45377]: Failed to add DNS server address '[2001:4860:4860::8844]', ignoring: Invalid argument
Jul 29 17:38:27 mymachine systemd-resolved[45377]: Failed to add DNS server address '[fd7a:115c:a1e0::53]', ignoring: Invalid argument
What’s wrong with that config that causes systemd-resolved to dislike the second ipv6 [2001:4860:4860::8844] for FallbackDNS in 98-custom.conf and the ipv6 [fd7a:115c:a1e0::53] for DNS in 99-tailscale.conf?
Did you try to write it as described by the DNS provider?
Some devices require explicit values for all eight fields of IPv6 addresses and cannot accept the abbreviated :: IPv6 address syntax. For such devices enter:
Hmm, no… @hui I do remember seeing something about square brackets when specifying ports and so just included them - as for the IPv6 abbreviation, it is true, I did not go to the sourse. I will write out 100 times, always go to the source… But, why the apparent randomness in the failure?
Anyway, I was editing the OP to include the following but couldn’t because you’re reply was in so quick - more conceptually, I’m not at all sure I’ve got the basic config correct from what I’m trying to do:-
Is that a correct configuration for systemd-resolved for a split DNS server at 100.100.100.100 for domain ts.net? This output below leads me to suspect not. I’m more used to dnsmasq where a config for a DNS IP is on the same line as the domain it applies to, but I haven’t been able to figure out the logic of why simply putting a domain and IP in the same drop-in should associate the two together…?
:~> resolvectl status
Global
Protocols: +LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported
resolv.conf mode: foreign
Current DNS Server: 1.1.1.1
DNS Servers: 1.1.1.1 1.0.0.1 100.100.100.100
Fallback DNS Servers: 8.8.8.8 8.8.4.4
DNS Domain: home.lan office.lan ~ts.net
Link 2 (wlp0s20f3)
Current Scopes: DNS LLMNR/IPv4 LLMNR/IPv6
Protocols: +DefaultRoute +LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported
Current DNS Server: 192.168.0.10
DNS Servers: 192.168.0.10 fdc5:4e49:f07f:5::10
DNS Domain: ts.net home.lan
Default Route: yes
Link 4 (tailscale0)
Current Scopes: LLMNR/IPv6
Protocols: -DefaultRoute +LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported
Default Route: no
:~>
A space-separated list of IPv4 and IPv6 addresses to use as system DNS servers. Each address can optionally take a port number separated with “:”, a network interface name or index separated with “%”, and a Server Name Indication (SNI) separated with “#”. When IPv6 address is specified with a port number, then the address must be in the square brackets. That is, the acceptable full formats are “111.222.333.444:9953%ifname#example.com” for IPv4 and “[1111:2222::3333]:9953%ifname#example.com” for IPv6. DNS requests are sent to one of the listed DNS servers in parallel to suitable per-link DNS servers acquired from systemd-networkd.service(8) or set at runtime by external applications. For compatibility reasons, if this setting is not specified, the DNS servers listed in /etc/resolv.conf are used instead, if that file exists and any servers are configured in it. This setting defaults to the empty list.
Yes, thanks @GrandDixence2 it’s where I got the brackets from - but as port 53’s the default, then they’re not needed so the IPv6 addys can be left bare - though, I’m not quite sure I follow the reasoning that requires brackets for a port number but also requires no brackets without a port number, instead of them being optional without a port number - but, hay, I don’t write code.
What I’m really trying to work out is how to associate the IP of a DNS server with a domain for split DNS, like I would with dnsmasq with server=/ts.net/100.100.100.100
But, the reading seems to only provide directions to associate a domain with an interface cf the IP addy of a server.