[solved/answered] CoreDNS Groups Prefix

Bob.Dig

I only see one field, for Dual Stack that doesn't look sufficient. Am I correct that this is mainly for IPv4 only setups?

CoreDNS Zero Trust Egress Mode

When a client resolves a hostname through CoreDNS, CoreDNS remembers the IP addresses in the response and adds those to a special table for that client. CoreDNS tags connections from that client to the resolved addresses as being allowed.

So this will be only the IPv4-address of a client as well. If a client resolves via IPv4 but then tries to connect via IPv6, it will get blocked (according to the rules made separately), so wouldn't make much sense in regards to Zero Trust Egress Mode.

Are these assumptions correct?

Lets say, I am fine with this and create a CoreDNS Zero Trust Egress Mode IPv4 only LAN but have other LANs that will not use those new features but they should use dual stack, are there any problems I might run into with having CoreDNS as my main DNS on all the LANs or is the CoreDNS Default Group capable of all Dual Stack needs.
Or at this point, I could run CoreDNS on another port and only forcefully redirect all DNS queries on my CoreDNS Zero Trust Egress Mode IPv4 only LAN to it.

Bob.Dig

said in CoreDNS Groups Prefix:

forcefully redirect all DNS queries

I mean I would but the problem described here is still not tackled:
https://forum.netgate.com/topic/201131/26.07-release-port-forward-is-missing-pass/11?_=1789294343778

marcosm

It should work with both IPv4/6. If a client decides to source their requests from a different address than the one it used to make the DNS query then yes it will be blocked.

Bob.Dig

Thanks for clarifying. In the end, it is an IPv4 only or an IPv6 only thing, not really sufficient for Dual Stack.
The other guys have a clever alias type which is based on a MAC-address and is constantly updated with all the IP-Addresses in the background. With that a Dual Stack usage with ZTE would be doable.

jwt

@Bob.Dig “other guys” ?

Bob.Dig

@jwt The other camp, they can do smart things too.

Bob.Dig

Another thought on ZTE. On my phone, F-Droid is failing to load repos on the first try. It is probably on them for not trying again. Same with the weather app I am using. Edit: And many other stuff.
And I will not have a great time if I try to do calls with a messenger-app, because this will be p2p, without DNS.
So ZTE is not a silver bullet against DoH in a home-environment.

But in a work-environment, you can really lock things down, combine it with DNS-white-listing and you will have a super secure workspace.
Some exception could be made with DSCP-tagging on clients. And in such an environment, even I think, I wouldn't use Dual Stack to begin with.

Now when it comes to my usecase as a home user, I might use it on some servers/services. On my phone, I will disable it for UDP and will watch further how it goes.

Bob.Dig

Against those to early blocks, could the firewall resend blocked traffic once after 1 sec? It feels like there are to many of those right now.
Or is just me. I only ran it at my phone, with an always on VPN connection even at my WiFi at home. But I guess, more latency should help here, not make it worse.
Alternatively, everything must be run in RAM and be updated immediately.