maradns as local zonemaster not working, no proper ip response

[iamadeadpixel]

Hello groups.

After using maradns for years on *nix machines, i try to get it working on my windows machine with xampp in a test setup.
yes, xampp is working, yes placing entries in hosts works, but its a no go after a while.
so i installed maradns on the machine (deadwood)

rewriting my old maradns stuff was pretty easy, but when i do a ping like ping test.xs4non.nl i only get the EXTERNAL ip adres
and not the lan ip adres as it should be (with hosts it does resolve)

so, could someone tell me what is wrong here ???

mararc file

csv2 = {}
csv2["xs4non.nl."] = "db.xs4non.nl"

ipv4_bind_addresses = "192.168.0.228, 127.0.0.1"
maradns_uid = 99
no_fingerprint = 0
max_chain = 8
max_ar_chain = 1
max_total = 20
verbose_level = 4

this is db zone file

xs4non.nl.	+3600	soa	ns.xs4non.nl.
[email protected] 201220707 14400 3600 604800 14400
xs4non.nl.	+3600	ns	ns.xs4non.nl.
ns.xs4non.nl.	+3600	ns	127.0.0.1
ns.xs4non.nl.	+3600	ns	192.168.0.228
xs4non.nl.	+3600	a	192.168.0.228
;
mail.		MX	10	mail.xs4non.nl.
mail.xs4non.nl.		+600	A	192.168.0.228
kutje.xs4non.nl.	+600	A	192.168.0.228
vu.xs4non.nl.		+600	A	192.168.0.234
linksys.xs4non.nl.	+600	a	192.168.0.240

i kept it for testing small enough to see if it works

this is the deadwood3c.txt file

bind_address="127.0.0.1, 192.168.0.228"
recursive_acl = "127.0.0.1/16, 192.168.0.0/16"
root_servers = {}

# ICANN DNS root servers 
root_servers["."]="198.41.0.4, 199.9.14.201, 192.33.4.12, 199.7.91.13,"
root_servers["."]+="192.203.230.10, 192.5.5.241, 192.112.36.4, "
root_servers["."]+="198.97.190.53, 192.36.148.17, 192.58.128.30, "
root_servers["."]+="193.0.14.129, 199.7.83.42, 202.12.27.33"
cache_file = "dw_cache_bin"
filter_rfc1918 = 0

and yes, i do the ping request on the machine where mara is running.
also.

dwlog.txt says this

donderdag 7 juli 2022 12:43:20: ==Deadwood started==
donderdag 7 juli 2022 12:43:20: Deadwood version 3.5.0022
donderdag 7 juli 2022 12:43:20: Deadwood: A DNS UDP non-recursive cache (IPv4-only)
donderdag 7 juli 2022 12:43:20: We bound to 2 addresses 

so i gues, no weard isues.

any sugestion on what i am doing wrong here ???

thnxs.
Tom.

edit - when vieuwing the cahce file , i see only WAN entries, so basicly it is working....

[samboy]

From https://github.com/samboy/MaraDNS/blob/master/deadwood-github/doc/FAQ.txt

   Deadwood, by default, filters out RFC1918 and other non-routable IPs
   from DNS replies, namely IPs in the form: 192.168.x.x, 172.[16-31].x.x,
   10.x.x.x, 127.x.x.x, 169.254.x.x, 224.x.x.x, and 0.0.x.x.

   To disable this behavior, so that Deadwood can resolve internal and
   other non-routable IPs, add this line to the Dwood3rc file:

filter_rfc1918 = 0

   Note that some routers filter DNS packets with non-routable IPs. Dave
   Owens, for example, had this problem.

(There are security issues with allowing external DNS resolvers to resolve to RFC1918 IPs, so it’s disabled by default)

Another thing: Deadwood now supports resolving names to bogus IPs without needing an external DNS server.

ip4

   This is a dictionary variable which allows us to have given names
   resolve to bogus IPv4 addresses. Here, we have the name "maradns.foo"
   resolve to "10.10.10.10" and "kabah.foo" resolve to "10.11.11.11",
   regardless of what real values these DNS records may have:
ip4 = {}
ip4["maradns.foo."] = "10.10.10.10"
ip4["kabah.foo."] = "10.11.11.11"

   Note that a given name can only resolve to a single IP, and that the
   records have a fixed TTL of 30 seconds.

   It is also possible to use ip4 to set up a blocklist by using "X" for
   the IP. When this is done, an IPv4 request for a given hostname results
   in a synthetic "this name does not exist" response. In addition, the
   corresponding IPv6 request will also return that "name does not exist"
   reply. For example:
ip4 = {}
ip4["evil.example.com."] = "X"

   Here, both the IPv4 and the IPv6 query for "evil.example.com" will not
   resolve in Deadwood.

[iamadeadpixel]

i know, the DNS is not open for the outside world, its pure for resolving local name servering on the local network.
just tried the bogus thing, still resolving to the WAN adres...

[samboy]

As an aside, I just edited your post. No content is changed, but keep in mind that GitHub uses Markdown, and not the old PhpBB/Vbulletin style syntax. Please go here to get help on using the Markdown format GitHub (and, yes, Reddit) uses:

https://docs.github.com/en/get-started/writing-on-github/getting-started-with-writing-and-formatting-on-github/basic-writing-and-formatting-syntax

In order to answer your question, some things to keep in mind:

• If you tell Deadwood to use the ICANN root servers to resolve names, it will use the ICANN root servers to resolve names.
• root_servers will still work, but it’s better these days to use upstream_servers. While root_servers works most of the time with most domains, there’s enough corner cases out there on the Internet I’m not going to recommend doing things that way. It’s a 99/1 situation; Deadwood can resolve 99% of the domains out there, but to get it to resolve the other 1% would require months to years of work, so it’s just good enough to have a mostly usable Internet.
• It’s possible to have Deadwood use a different DNS server to resolve a given domain, but that’s not the advice I will give here. If you want to do that, well, man deadwood or, if the man page isn’t installed, read
  https://github.com/samboy/MaraDNS/blob/master/deadwood-github/doc/Deadwood.txt and look for upstream_servers.
• Let’s suppose we want to use Deadwood to resolve names, but have "name.example.com" resolve to a different IP:

bind_address = "172.25.10.1"
recusive_acl = "172.25.0.0/16"
filter_rfc1918 = 0
upstream_servers = {}
upstream_servers["."] = "8.8.8.8, 8.8.4.4" # Google public DNS
ip4 = {}
ip4["name.example.com."] = "172.25.20.10"

There’s no longer a need to run a separate DNS server for the example.com names; we can just use the relatively new ip4 feature Deadwood has. Also, be sure to use the latest Deadwood.exe binary, be sure to stop and disable the old Deadwood service, and be sure the service is using the latest Deadwood version. Do this with a cmd shell running as the administrator:

net stop deadwood
Deadwood.exe --remove

That removes the old version of Deadwood. Then, to install the new version:

Deadwood.exe --install
net start Deadwood

Use the services manager (called services in Windows 10) to ensure Deadwood is automatically started up.

(You know, I really should make the above part of Deadwood’s documentation for Windows. Surprised I didn’t write that before. EDIT: DONE)

For the lurkers running Linux

While you’re running things in Windows, for people using some version of Linux (not you) This may or may not work with a given distro’s version of Deadwood—distros are notorious for using ancient versions of Deadwood—so compile the program from source to be sure to use the latest stable release (The Git release usually passes all automated tests, so the GitHub version is fine too). Please contact the support group for the Linux distribution you are using for instructions on how to compile Deadwood and run it with the particular init process the distribution in question uses. The only binary I supply is a Windows binary for Windows XP or newer. Just be glad you’re not trying to run a Python or NPM/Node script with a tangled web of dependencies; Deadwood only needs a C compiler and basic libc support to compile and run.

If using Ubuntu, to get Deadwood to run at start up time, this is what /etc/rc.local looks like on my Ubuntu 20.04 system:

#!/bin/sh
duende Deadwood

Also, /etc/rc.local has 755 permissions (man chmod).

[iamadeadpixel]

if it comes to start/restart

i made this.

net stop deadwood
Deadwood.exe --remove
timeout /t 2

Deadwood.exe --install
net start Deadwood
timeout /t 2

this stop and restart it when name changes are made, ya, lazy way but it works..

ok, back to topic...
adapted the recomended settings
ok, askmara isnow dumb, becouse she want 127.0.0.1 hehe
as for the build, i pulled it yesterday from the maradns site, so that should be recent enough.

but i think i am still stupid,,
i guess it can only be a small thing.

[iamadeadpixel]

got it working.....
found a older archive with maradns it self in it....
yes i know, not the idea but this build maradns-3-5-0004-win32 did the job for me (dont we love collecting versions)

[samboy]

There may be Y2038 issues with the MaraDNS daemon for Windows 32 (and having to use an external “service all” thingy also is problematic); that’s why I’m phasing it out, and because the newer ip4 and ip6 parameters handle most of the use cases which used to need Deadwood + MaraDNS.

I would use cygwin if MaraDNS proper is desired in Win32. Only Deadwood (and coLunacyDNS) has a real Windows port.

[iamadeadpixel]

wait,, i need CoLunacyDNS to ??
tought i needed DeadWood only,, hmky, its for tomorow ,pretty late here

[iamadeadpixel]

Good morning Sam.
Wel its 07:45 here in europe .

I have experimented with the bit older version maradns as mentioned before.
i HAD it working as it should be as a authoritive server for my LAN.
every ping i did resolved to the local network adresses 192.168. /16 range in my case

isue 1:
but i was a bit to greedy, dont ask me what i did ,but it replies now only with the WAN adres only
including querys i made for the blacklist zone file. (redirect to 127.0.0.1)
ya,forgot to make backups,my fault.

i rebuilded the mararc to this.

hide_disclaimer = "YES"

# The directory with all of the zone files
#chroot_dir = "d:\games\xampp\maradns"
# The numeric UID MaraDNS will run as
maradns_uid = 99
# The (optional) numeric GID MaraDNS will run as
# maradns_gid = 99

ipv4_bind_addresses = "192.168.0.228, 127.0.0.1"
zone_transfer_acl = "192.168.0.0/16"

# We must initialize the csv2 hash, or MaraDNS will be unable to
# load any csv2 zone files
csv2 = {}
csv2["xs4non.nl."] = "zonefiles/db.xs4non.nl"
csv2["blacklist."] = "zonefiles/db.blacklist.zone"


timestamp_type = 2
random_seed_file = "secret.txt"

upstream_servers = {}
upstream_servers["ns.xs4non.nl."]="192.168.0.228"
upstream_servers["xs4non.nl."]="192.168.0.228"
upstream_servers["."]="8.8.8.8, 8.8.4.4" # Servers we connect to

# It is also possible to use ICANN root servers.  However, to do this, 
# root_servers needs to be defined.  
root_servers = {}
root_servers["."] = "icann"

# ICANN: the most common and most controversial root name server
# http://www.icann.org
# This list can be seen at http://www.root-servers.org/ 
ipv4_alias["icann"]  = "198.41.0.4, 199.9.14.201, 192.33.4.12, 199.7.91.13,"
ipv4_alias["icann"] += "192.203.230.10, 192.5.5.241, 192.112.36.4, "
ipv4_alias["icann"] += "198.97.190.53, 192.36.148.17, 192.58.128.30, "
ipv4_alias["icann"] += "193.0.14.129, 199.7.83.42, 202.12.27.33"

filter_rfc1918 = 0
maxprocs = 96
max_tcp_procs = 64
default_rrany_set = 15
max_chain = 8
max_ar_chain = 1
max_total = 20
verbose_level = 4
maximum_cache_elements = 32768
no_fingerprint = 0
bind_star_handling = 1

interesting point..
when i remove some # comment stuff, it breaks the mararc file to !
and mara spits out dumb errors.

however, if i do a lookup with askmara (askmara 1:domain to resolve) ,it gives back the proper value.
But thats not the biggest point, if i try to visit a blacklisted site, i still can access it in the browser.
so for some reason redirect it to localhost (127.0.0.1) seems not to work anymore here.

isue 2:
Multiple zone files in the csv2 section.
csv2 = {}
csv2["xs4non.nl."] = "zonefiles/db.xs4non.nl"
csv2["blacklist."] = "zonefiles/db.blacklist.zone"

works perfect with askmara, but ping replies gives back the WAN adres (linked to isue1)
i call it blacklist.zone ,where it contains 160857 entries (this was more, but thanks to wildcards i could reduce it a lot)
isue: maradns reports on start up this.

Log: Binding to address 192.168.0.228, 127.0.0.1
Miercoles, 13 de Julio, a 03:53:59 (UTC)  Log: Socket opened on UDP port 53
Processing zone xs4non.nl. right now.
Filename: zonefiles/db.xs4non.nl
Processing zone blacklist. right now.
Filename: zonefiles/db.blacklist.zone
MaraDNS proudly serves you 100032 DNS records
WARNING: Your system does not allow setting memory allocation limits!Miercoles, 13 de Julio, a 03:54:00 (UTC)  Log: All RRs have been loaded

i am missing 60K+ entires.
when it comes to memory usage, it only eat 56MB......

isue 3:
As mentioned before, i work with a localzone for my domain to quick resolve the LAN adresses (prefered with ping, but for some reason that
does not work anymore here,as sayd, it gives back the WAN adres.)

and a blacklist zone file what contains unwanted parasite entries.
in basic i had to place in one huge file
THIS is what i wanted to add.

csv2["wildcards."] = "zonefiles/db.wildcards.zone"
csv2["blogspot."] = "zonefiles/db.blogspot.zone"
csv2["cloudfront."] = "zonefiles/db.cloudfront.zone"
csv2["omtrdc."] = "zonefiles/db.omtrdc.zone"
csv2["site."] = "zonefiles/db.site.zone"
csv2["2o7."] = "zonefiles/db.2o7.zone"
csv2["tumblr."] = "zonefiles/db.tumblr.zone"
csv2["zooplus."] = "zonefiles/db.zooplus.zone"
csv2["xyz."] = "zonefiles/db.xyz.zone"
csv2["herokuapp."] = "zonefiles/db.herokuapp.zone"
csv2["freecounters."] = "zonefiles/db.freecounters.zone"
csv2["ebis."] = "zonefiles/db.ebis.zone"
csv2["over-blog."] = "zonefiles/db.over-blog.zone"

csv2["br-domains."] = "zonefiles/db.br-domains.zone"
csv2["it-domains."] = "zonefiles/db.it-domains.zone"
csv2["jp-domains."] = "zonefiles/db.jp-domains.zone"
csv2["ru-domains."] = "zonefiles/db.ru-domains.zone"
csv2["tr-domains."] = "zonefiles/db.tr-domains.zone"
csv2["pl-domains."] = "zonefiles/db.pl-domains.zone"
csv2["pk-domains."] = "zonefiles/db.pk-domains.zone"
csv2["fr-domains."] = "zonefiles/db.fr-domains.zone"
csv2["tk-domains."] = "zonefiles/db.tk-domains.zone"

yes, the zonefiles/ directive is working...

but when i do this, mara is spitting out megaload on error on the mararc cfg file
i guess there is a limit on how many csv entries i can have.

oh, only the db.xs4non.nl file contains the SOA record entries.
i notice there was no afect when i removed it from the other zone files.

where did i took the wrong turn that is specialy went wrong with isue 1.

As it comes to deadwood.
i dont think the deadwood rc file is gonna like it when i enter all the blacklist stuff it, i still dont know if mararc and deadwood can work together.

Tom.

[samboy]

MaraDNS has not been both recursive and authoritative since 2015; MaraDNS 1 has been end of life for seven years now.

Please also be aware that here in 2022 some browsers, by default, use predefined DNS-over-HTTPS servers. Contact the support for your browser maker to get help removing that functionality.

It is possible to use a large blocklist with Deadwood, but the format is different.

Here’s a pointer:

https://github.com/samboy/MaraDNS/blob/master/deadwood-github/tools/make.blocklist.sh

This will take a fairly current block list and convert it in to Deadwood’s blocklist format.

[iamadeadpixel]

gotsha !
thats a begin i can work with !

[iamadeadpixel]

seems it is working with deadwood.
pinging on the dns server machine give the local ip correct.
only on other machines i get the WAN adres,
but if i get the deadwoodrc fixed and working (getting huge with the blacklisted trackers)
well, using hosts files, but want to avoid it,

[samboy]

Locking discussion to stop spam bots.