Page MenuHomeVyOS Platform

PowerDNS config can't handle listening on IPv6 addresses
Closed, ResolvedPublicBUG


The current config syntax allows a single kind of listening address, listen-address. This sets the local-address option in /etc/powerdns/recursor.conf. Unfortunately, local-address is only for IPv4 addresses; a separate local-ipv6 setting in recursor.conf is required for IPv6 addresses.

See the documentation here:

As a result, this configuration:

# show service dns
 forwarding {
     listen-address 2604:3024:423e:b9f2::1
     listen-address 2604:3024:423e:b9f1::1
     listen-address 2604:3024:423e:b9f4::1
     name-server 2604:3024:423e:b9f1:3063:21ff:fee9:1234

creates this setting in recursor.conf:

# listen-on

The server does not, in fact, listen on any of the IPv6 addresses, although it does listen on the IPv4 addresses without complaint.

There should probably be a separate listen-address-v6 config option, or something similar.


Difficulty level
Unknown (require assessment)
Why the issue appeared?
Implementation mistake

Event Timeline

We should keep listen-address for all address types but we are able to distinguish between them when building up recursor.conf

The links you refer are for PowerDNS Authoritative Server, we are using PowerDNS Recursor, see

Can it be that your upstream IPv6 nameserver is ill formated? 2604:3024:423e:b9f1:3063:21ff:fee91234 does not look like an IPv6 address

Yes, I concur that keeping just listen-address for both address types would definitely be preferable, and we should just distinguish between them when building the config, if needed.

Sorry I pulled up the wrong docs. And no, that was just a typo I made while copying and pasting. (I've just fixed it, to reduce confusion.) The problem is definitely not in the upstream DNS servers; I can successfully make queries against the pdns_recursor instance using IPv4 addresses, including, and the answers come back correctly. Queries to any of the IPv6 addresses, on the other hand, are simply never responded to.

The plot thickens, however. According to netstat -an | grep :53, it is listening on the IPv6 addresses specified.

tcp        0      0  *               LISTEN
tcp        0      0*               LISTEN
tcp        0      0*               LISTEN
tcp        0      0*               LISTEN
tcp6       0      0 2604:3024:423e:b9f4::53 :::*                    LISTEN
tcp6       0      0 2604:3024:423e:b9f1::53 :::*                    LISTEN
tcp6       0      0 2604:3024:423e:b9f2::53 :::*                    LISTEN
udp        0      0  *
udp        0      0*
udp        0      0*
udp        0      0*
udp6       0      0 2604:3024:423e:b9f4::53 :::*
udp6       0      0 2604:3024:423e:b9f1::53 :::*
udp6       0      0 2604:3024:423e:b9f2::53 :::*

However, it doesn't work:

# dig @ -x

;; Query time: 92 msec
# dig @2604:3024:423e:b9f2::1 -x
; <<>> DiG 9.9.5-9+deb8u16-Debian <<>> @2604:3024:423e:b9f2::1 -x
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

I have no firewall rules set on these internal interfaces. This is from the VyOS router, itself, but I see the same results when I query from other local machines.

What could be going on? My initial diagnosis was clearly mistaken.

This comment was removed by gadams.

Aha! I have figured out what causes pdns-recursor not to answer requests on its IPv6 sockets, even though it binds to them. It's the allow-from setting. If I change it from:



allow-from=, ::/0

then everything works.

This is part of the non-configurable defaults section, so I suppose we should just change it.

Can you search for the following file on your device and edit it to test your proposed changes:

location should be: /usr/libexec/vyos/conf/mode/

c-po claimed this task.
c-po changed Why the issue appeared? from Will be filled on close to Implementation mistake.

Yes, that change works. I'll look forward to it appearing in an RC. :)