Slave DNS Servers

LadyLinux

Hi,

Not quite clear how Slave/External DNS servers work

Do they have to be Openpanel servers ??

I just want to use standard bind servers for this with standard zone transfers

Thanks!!

LadyLinux

stefan

LadyLinux Hi!

No need to have openpanel on those servers, we’re using the standard Bind9 Docker container for DNS so any server that has docker or plain bind9 installed will work.

This is the current docker-compose.yml configuration
default Bind9 configuration files
Bind9 slave server Docker setup

Currently, I'm busy with a rewrite, so I can't provide a setup example or tutorial right now. However, I’ll add it to my to-do list and aim to create a tutorial after February. In the meantime, if you get a chance to try it out and manage to make it work, please share your results!

LadyLinux

stefan

Fantastic. Liking what I am seeing so far

Thanks!!

Ladylinux

stefan

LadyLinux Hello again,

I gave it a try, and it looks like the main requirement was a way to create zones on the slave server. To address this, I added checks when adding domains in OpenPanel (you’ll need to reinstall the v1.0), so it will automatically create the zone on the slave when domains are added. Then, Bind9 will handle the synchronization on each update.

Be sure to follow the steps to get everything up and running, and feel free to customize it further later on to suit your needs or enhance security.

Setup the Slave Server:

Install Bind
On the slave server, I used a separate VPS and ran the bind9 Docker image, as done in the OpenPanel example here.

Configure Bind
Create or edit the /etc/bind/named.conf.options file with the following configuration:

    acl trusted {
                localhost;
                192.168.1.0/24;
                172.0.0.0/8;
                MASTER_IP;
            };

    options {
        directory "/var/cache/bind";
        recursion yes;
        allow-recursion { trusted; };
        dnssec-validation auto;
        listen-on-v6 { any; };
    };

Replace MASTER_IP with the IP address of the master server.

Create zones dir

    mkdir -p /etc/bind/zones/

Ensure Bind is Running
After applying the configuration, make sure Bind is running properly on the slave server.

Configure the Master Server:

Configure Slave IP for Zone Updates
On the master server, you need to make two key adjustments:
- Allow zone updates from the master IP
- Establish SSH connection to the slave for zone file creation
SSH Setup
To streamline the process, I added a SSH key to ~/.ssh/id_rsa on the master server so that the connection to the slave server (via ssh root@slave-ip) is automatic. Once this SSH connection is working, proceed to the next step.

Configure Bind Options
On the master server, edit the /etc/bind/named.conf.options file and include the slave IP under the allow-transfer and also-notify directives, like so:

    acl trusted {
                localhost;
                192.168.1.0/24;
                172.0.0.0/8;
            };

    options {
        directory "/var/cache/bind";
        recursion yes;
        allow-recursion { trusted; };
        
        allow-transfer { SLAVE_IP; };
        also-notify { SLAVE_IP; };

        forwarders {
            8.8.8.8;
            8.8.4.4;
        };

        dnssec-validation auto;
        listen-on-v6 { any; };
    };

Replace SLAVE_IP with the IP address of the slave server.

Restart Bind Service
After saving the changes, restart the Bind service using Docker Compose:

    cd /root && docker compose up -d bind9

Final Steps:

Add New Domain
Now, you can add a new domain on the master server as a regular user from their OpenPanel account.

Test Zone Propagation
After creating the domain, verify that the zone is available on both the master and slave servers by running the following commands:

    dig A +short DOMAIN_NAME @SLAVE_IP
    dig A +short DOMAIN_NAME @MASTER_IP

Replace DOMAIN_NAME with the actual domain you added.

That’s all! You’ve successfully configured the master-to-slave DNS setup. 🙌

Give it a try, and I hope it meets your requirements. It will certainly need some refinement for broader use cases. I'd recommend modifying the DNS zone template to include records for the slave server, as well as adding a nameserver record with the slave's IP address.

LadyLinux

Hi,

I will give this a whirl in the next day or so

Thanks!!

LadyLinux

So I tried this and I am unable to create a zone on a "Vanilla" slave server.

Vanilla meaning default ubuntu bind not docker. I could not figure out how to just install bind9 docker properly.

Meaning only openpanel bind. It was missing a lot of config files.

docker logs

"17-Feb-2025 10:20:56.466 loading configuration from '/etc/bind/named.conf'
17-Feb-2025 10:20:56.467 /etc/bind/named.conf:9: parsing failed: file not found
17-Feb-2025 10:20:56.467 loading configuration: file not found
17-Feb-2025 10:20:56.467 exiting (due to fatal error)"

I gotta figure this file is created during some other phase of openpanel install

I guess in essence I want to be able to create openpanel "DNS Only" slave servers

Thanks

LadyLinux

Ok,

So I copied everything from overlay like so

cp /var/lib/docker/overlay2/9f20610cd77c84cd1f3b29de8dd38e82dd2b36745e17c512fd5cc9d60ed3f28e/diff/etc/bind/* /etc/bind/

And now it starts properly

LadyLinux

Hi,

Looks like the zone did not transfer over properly

"19-Feb-2025 11:36:57.412 master.c:2304:load_header(): unexpected error:
19-Feb-2025 11:36:57.412 isc_stdio_read failed: end of file
19-Feb-2025 11:36:57.412 zone ladylinux.net/IN: loading from master file /etc/bind/zones/ladylinux.net.zone failed: end of file
19-Feb-2025 11:36:57.413 zone ladylinux.net/IN: unable to load from '/etc/bind/zones/ladylinux.net.zone'; renaming file to '/etc/bind/zones/db-lxlF5mng' for failure analysis and retransferring."

The zone file on the slave had nothing but it was correct on the master

So I looked around and found files missing on the master

19-Feb-2025 11:35:52.903 zone 0.in-addr.arpa/IN: loading from master file /etc/bind/db.0 failed: file not found
19-Feb-2025 11:35:52.903 zone 0.in-addr.arpa/IN: not loaded due to errors.
19-Feb-2025 11:35:53.003 managed-keys-zone: Key 20326 for zone . is now trusted (acceptance timer complete)
19-Feb-2025 11:35:53.003 managed-keys-zone: Key 38696 for zone . is now trusted (acceptance timer complete)
19-Feb-2025 11:35:53.204 zone 255.in-addr.arpa/IN: loading from master file /etc/bind/db.255 failed: file not found
19-Feb-2025 11:35:53.204 zone 255.in-addr.arpa/IN: not loaded due to errors.
19-Feb-2025 11:35:53.404 received control channel command 'reload ladylinux.net'
19-Feb-2025 11:35:53.404 zone 127.in-addr.arpa/IN: loading from master file /etc/bind/db.127 failed: file not found
19-Feb-2025 11:35:53.404 zone 127.in-addr.arpa/IN: not loaded due to errors.
19-Feb-2025 11:35:53.406 zone localhost/IN: loading from master file /etc/bind/db.local failed: file not found
19-Feb-2025 11:35:53.406 zone localhost/IN: not loaded due to errors.
19-Feb-2025 11:35:53.502 any newly configured zones are now loaded

I copied over those files and after restarting the zone transfered

Not sure if this is something I did or ??

LadyLinux

stefan

LadyLinux The zones mentioned in the error are defined in /etc/bind/named.conf.default-zones. If you're using a standalone BIND setup, these zones won't be available.

In my case, I copied the /etc/bind/ directory from an existing OpenPanel installation and ran the same BIND container, as it already had the necessary paths mounted.

For a standalone BIND service, it's best to avoid using any configurations from OpenPanel. Instead, simply edit /etc/bind/named.conf.options to set the MASTER_IP in acl_trusted and enable recursion.

LadyLinux

stefan

OK to be clear these "db" zones are missing by default on the openpanel master server

Just verified on a clean new install

LadyLinux

stefan

you are right, they do not exist and are not needed, ill delete the include line for new installs

so those errors in the log appear to be unrelated to why that zone transfer failed.

check the zone with:
docker exec openpanel_dns named-checkzone ladylinux.net /etc/bind/zones/ladylinux.net.zone

check permissions with ls -l /etc/bind/zones/ladylinux.net.zone

try updating the records to see if file gets copied

LadyLinux

Hi,

Thanks Stefan 🙂

I will deal with this later this week as other things (Not Openpanel 🙂 ) have popped up that require my attention.

LadyLinux