[BUG] We need another DNS approach for [Synology] systems. #1983

zzecool · 2024-05-14T13:08:16Z

In Synology the current DNS implementation fails like this if you have a DNS running localy :

The local DNS is listening in all available addresses for that we need a DNS that will listen in a different port but not with the current implementation as it is not supported.

sudo netstat -tuln | grep -w ':53'

tcp6       0      0 :::53                   :::*                    LISTEN     
udp6       0      0 :::53                   :::*

2024-05-13T23:20:38+03:00 WARN client/internal/dns/service_listener.go:185: binding dns on 100.115.6.17:53 is not available, error: listen udp 100.115.6.17:53: bind: address already in use
2024-05-13T23:20:38+03:00 WARN client/internal/dns/service_listener.go:185: binding dns on 127.0.0.1:53 is not available, error: listen udp 127.0.0.1:53: bind: address already in use
2024-05-13T23:20:38+03:00 WARN client/internal/dns/service_listener.go:185: binding dns on 127.0.0.153:53 is not available, error: listen udp 127.0.0.153:53: bind: address already in use
2024-05-13T23:20:38+03:00 WARN client/internal/dns/service_listener.go:215: failed to load DNS forwarder eBPF program, error: field NbXdpProg: program nb_xdp_prog: map .rodata: map create: read- and write-only maps not supported (requires >= v5.2)
2024-05-13T23:20:38+03:00 WARN client/internal/dns/server.go:316: the DNS manager of this peer doesn't support custom port. Disabling primary DNS setup. Learn more at: https://docs.netbird.io/how-to/manage-dns-in-your-network#local-resolver
2024-05-13T23:20:38+03:00 ERRO client/internal/dns/server.go:322: unable to configure DNS for this peer using file manager without a nameserver group with all domains configured

You guys are active, so we are very close to make Netbird fully supported in Synology.

The text was updated successfully, but these errors were encountered:

zzecool · 2024-05-14T13:46:47Z

@bcmmbaga Hop in now that you are on fire :P

mlsmaycon · 2024-05-22T15:15:22Z

Hello @zzecool thanks for reporting this issue.

Can you test using user space mode?

If you are on DSM 7.0+ you can do that by using the following commands:

sudo mkdir -p /etc/sysconfig
echo 'NB_WG_KERNEL_DISABLED=true' | sudo tee -a /etc/sysconfig/netbird
sudo systemctl restart netbird

zzecool · 2024-05-22T15:58:57Z

sudo mkdir -p /etc/sysconfig
echo 'NB_WG_KERNEL_DISABLED=true' | sudo tee -a /etc/sysconfig/netbird
sudo systemctl restart netbird

@mlsmaycon Yes here you are :

2024-05-22T18:52:59+03:00 INFO client/internal/connect.go:115: starting NetBird client version 0.27.7 on linux/amd64
2024-05-22T18:52:59+03:00 WARN client/system/info_linux.go:115: geucwReleaseInfo: exit status 1
2024-05-22T18:53:00+03:00 WARN client/internal/wgproxy/factory_linux.go:17: failed to initialize ebpf proxy, fallback to user space proxy: field NbXdpProg: program nb_xdp_prog: map .rodata: map create: read- and write-only maps not supported (requires >= v5.2)
2024-05-22T18:53:00+03:00 INFO iface/tun_usp_linux.go:33: using userspace bind mode
2024-05-22T18:53:00+03:00 INFO client/internal/routemanager/manager.go:93: Routing setup complete
2024-05-22T18:53:00+03:00 INFO iface/tun_usp_linux.go:45: create tun interface
2024-05-22T18:53:00+03:00 ERRO client/firewall/iptables/router_linux.go:51: failed to cleanup routing rules: failed to list rules in FORWARD chain: running [/sbin/iptables -t filter -S FORWARD --wait]: exit status 1: iptables: No chain/target/match by that name.

2024-05-22T18:53:00+03:00 ERRO client/firewall/create_linux.go:48: failed to create iptables manager: failed to list rules in FORWARD chain: running [/sbin/iptables -t filter -S FORWARD --wait]: exit status 1: iptables: No chain/target/match by that name.

2024-05-22T18:53:00+03:00 INFO client/internal/dns/host_linux.go:68: System DNS manager discovered: file
2024-05-22T18:53:00+03:00 INFO client/internal/engine.go:359: Network monitor is disabled, not starting
2024-05-22T18:53:00+03:00 INFO client/internal/connect.go:261: Netbird engine started, the IP is: 100.150.200.200/16
2024-05-22T18:53:00+03:00 INFO signal/client/grpc.go:158: connected to the Signal Service stream
2024-05-22T18:53:00+03:00 INFO management/client/grpc.go:147: connected to the Management Service stream
2024-05-22T18:53:00+03:00 WARN client/internal/engine.go:551: running SSH server is not permitted
2024-05-22T18:53:00+03:00 INFO client/internal/dns/file_linux.go:107: created a NetBird managed /etc/resolv.conf file with the DNS settings. Added 1 search domains. Search list: [netbird.selfhosted]
2024-05-22T18:53:00+03:00 INFO client/internal/dns/file_repair_linux.go:48: start to watch resolv.conf: /etc/resolv.conf
2024-05-22T18:53:00+03:00 INFO client/internal/acl/manager.go:52: ACL rules processed in: 549.946µs, total rules count: 22
2024-05-22T18:53:02+03:00 WARN client/internal/dns/upstream.go:185: probing upstream nameserver 1.1.1.1:53: read udp 10.0.0.50:36965->1.1.1.1:53: i/o timeout
2024-05-22T18:53:02+03:00 WARN client/internal/dns/upstream.go:185: probing upstream nameserver 1.0.0.1:53: read udp 10.0.0.50:46327->1.0.0.1:53: i/o timeout
2024-05-22T18:53:02+03:00 WARN client/internal/dns/upstream.go:265: Upstream resolving i2024-05-22T18:53:00+03:00 INFO client/internal/dns/host_linux.go:68: System DNS manager discovered: file
2024-05-22T18:53:00+03:00 INFO client/internal/engine.go:359: Network monitor is disabled, not starting
2024-05-22T18:53:00+03:00 INFO client/internal/connect.go:261: Netbird engine started, the IP is: 100.150.200.200/16
2024-05-22T18:53:00+03:00 INFO signal/client/grpc.go:158: connected to the Signal Service stream
2024-05-22T18:53:00+03:00 INFO management/client/grpc.go:147: connected to the Management Service stream
2024-05-22T18:53:00+03:00 WARN client/internal/engine.go:551: running SSH server is not permitted
2024-05-22T18:53:00+03:00 INFO client/internal/dns/file_linux.go:107: created a NetBird managed /etc/resolv.conf file with the DNS settings. Added 1 search domains. Search list: [netbird.selfhosted]
2024-05-22T18:53:00+03:00 INFO client/internal/dns/file_repair_linux.go:48: start to watch resolv.conf: /etc/resolv.conf
2024-05-22T18:53:00+03:00 INFO client/internal/acl/manager.go:52: ACL rules processed in: 549.946µs, total rules count: 22
2024-05-22T18:53:02+03:00 WARN client/internal/dns/upstream.go:185: probing upstream nameserver 1.1.1.1:53: read udp 10.0.0.50:36965->1.1.1.1:53: i/o timeout
2024-05-22T18:53:02+03:00 WARN client/internal/dns/upstream.go:185: probing upstream nameserver 1.0.0.1:53: read udp 10.0.0.50:46327->1.0.0.1:53: i/o timeout
2024-05-22T18:53:02+03:00 WARN client/internal/dns/upstream.go:265: Upstream resolving is Disabled for 30s
2024-05-22T18:53:02+03:00 INFO [nameservers: [{1.1.1.1 udp 53} {1.0.0.1 udp 53}]] client/internal/dns/server.go:504: Temporarily deactivating nameservers group due to timeout
2024-05-22T18:53:02+03:00 ERRO [nameservers: [{1.1.1.1 udp 53} {1.0.0.1 udp 53}]] client/internal/dns/server.go:525: Failed to apply nameserver deactivation on the host: unable to configure DNS for this peer using file manager without a nameserver group with all domains configureds Disabled for 30s
2024-05-22T18:53:02+03:00 INFO [nameservers: [{1.1.1.1 udp 53} {1.0.0.1 udp 53}]] client/internal/dns/server.go:504: Temporarily deactivating nameservers group due to timeout
2024-05-22T18:53:02+03:00 ERRO [nameservers: [{1.1.1.1 udp 53} {1.0.0.1 udp 53}]] client/internal/dns/server.go:525: Failed to apply nameserver deactivation on the host: unable to configure DNS for this peer using file manager without a nameserver group with all domains configured

mlsmaycon · 2024-05-22T16:05:14Z

@zzecool can you try adding a default nameserver in the NetBird's dashboard? As the detected DNS mode was file, it won't resolve DNS queries without one.

zzecool · 2024-05-22T16:08:45Z

@mlsmaycon

I have a dns for this node in the Web management interface.

The dns is up and running fine.

It is on the same machine that netbird is running on port 53.

mlsmaycon · 2024-05-22T16:10:35Z

in that case, you can add one of the node's local IPs as a nameserver and distribute it to a group that only contains the Synology node.

zzecool · 2024-05-22T16:17:18Z

in that case, you can add one of the node's local IPs as a nameserver and distribute it to a group that only contains the Synology node.

@mlsmaycon

This is exactly what i have.

On the web interface for this node group the DNS is the 10.0.0.50

and this is inside the node :

Its ip address just to be clear

$ ifconfig | grep -A 1 ovs
ovs_bond0 Link encap:Ethernet  HWaddr 00:15:30:9F:71:02  
          inet addr:10.0.0.50  Bcast:10.0.0.255  Mask:255.255.255.0

The resolv test :

$ nslookup google.com     
Server:         10.0.0.50
Address:        10.0.0.50#53

Non-authoritative answer:
Name:   Google.com
Address: 172.217.17.110
Name:   google.com
Address: 2a00:1450:4017:810::200e

zzecool · 2024-05-22T16:20:38Z

@mlsmaycon

Maybe this is the problem that after this rule i have cloudflare for ALL ?

Does the first rule matched have higher priority and used or not ?

Thanks

mlsmaycon · 2024-05-22T16:22:11Z

Could be. The peers in the personal group might be using the cloudflare addresses.

Just to confirm, your Synology is part of the personal group? if not it should be, or you should add one of its group to the distribution groups.

zzecool · 2024-05-22T16:24:23Z

Could be. The peers in the personal group might be using the cloudflare addresses.

Just to confirm, your Synology is part of the personal group? if not it should be, or you should add one of its group to the distribution groups.

Yes its part of the personal group.

mlsmaycon · 2024-05-22T16:30:56Z

ok, to validate the setup try limiting the cloudflare configuration to another group.

zzecool · 2024-05-22T16:51:27Z

ok, to validate the setup try limiting the cloudflare configuration to another group.

Yeap that did the trick. So the first matched rule is getting ignore and replaced, you have to consider if this is what you want, as most ppl we are used to the iptables way priority of rules.

2024-05-22T19:48:25+03:00 INFO client/internal/dns/file_linux.go:107: created a NetBird managed /etc/resolv.conf file with the DNS settings. Added 1 search domains. Search list: [netbird.selfhosted]
2024-05-22T19:48:25+03:00 INFO client/internal/dns/file_repair_linux.go:48: start to watch resolv.conf: /etc/resolv.conf
2024-05-22T19:48:25+03:00 INFO client/internal/acl/manager.go:52: ACL rules processed in: 508.582µs, total rules count: 22

Removing the /etc/sysconfig/netbird breaks everything again.

So now that your install.sh script detects Synology just fine, please add the creation of /etc/sysconfig/netbird file :D

kind to explain what the userspace is doing exactly with the NB_WG_KERNEL_DISABLED=true config ?

We are making progress :D

mlsmaycon · 2024-05-22T17:05:57Z

@zzecool can you confirm that this local resolver, 10.0.0.50#53, comes with every Synology by default?

zzecool · 2024-05-22T17:06:44Z

@zzecool can you confirm that this local resolver, 10.0.0.50#53, comes with every Synology by default?

Nope this is a DNS that im personaly running on this machine.

mlsmaycon · 2024-05-22T17:08:39Z

Okay, in that case, it is better not to default to userspace mode just yet, as it may affect other users.

We will look into the masquerade issue and then make a decision.

Thanks for validating this.

zzecool · 2024-05-23T07:09:01Z

Okay, in that case, it is better not to default to userspace mode just yet, as it may affect other users.

We will look into the masquerade issue and then make a decision.

Thanks for validating this.

Can you think any other way to make this work in kernel space while having another DNS running in the same machine ?

zzecool added the triage-needed label May 14, 2024

zzecool mentioned this issue May 15, 2024

[PULL REQUEST] Support for BIN install in Synology #1977

Closed

zzecool changed the title ~~[BUG] We need another DNS approach for Synology systems.~~ [BUG] We need another DNS approach for [Synology] systems. May 16, 2024

mlsmaycon added bug Something isn't working client dns synology and removed triage-needed labels May 22, 2024

mlsmaycon mentioned this issue May 22, 2024

Linux Client fails to create iptables Masquerade rules in [Synology] #1976

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[BUG] We need another DNS approach for [Synology] systems. #1983

[BUG] We need another DNS approach for [Synology] systems. #1983

zzecool commented May 14, 2024 •

edited

Loading

zzecool commented May 14, 2024 •

edited

Loading

mlsmaycon commented May 22, 2024

zzecool commented May 22, 2024 •

edited

Loading

mlsmaycon commented May 22, 2024

zzecool commented May 22, 2024 •

edited

Loading

mlsmaycon commented May 22, 2024

zzecool commented May 22, 2024

zzecool commented May 22, 2024

mlsmaycon commented May 22, 2024

zzecool commented May 22, 2024

mlsmaycon commented May 22, 2024

zzecool commented May 22, 2024 •

edited

Loading

mlsmaycon commented May 22, 2024

zzecool commented May 22, 2024 •

edited

Loading

mlsmaycon commented May 22, 2024

zzecool commented May 23, 2024 •

edited

Loading

[BUG] We need another DNS approach for [Synology] systems. #1983

[BUG] We need another DNS approach for [Synology] systems. #1983

Comments

zzecool commented May 14, 2024 • edited Loading

zzecool commented May 14, 2024 • edited Loading

mlsmaycon commented May 22, 2024

zzecool commented May 22, 2024 • edited Loading

mlsmaycon commented May 22, 2024

zzecool commented May 22, 2024 • edited Loading

mlsmaycon commented May 22, 2024

zzecool commented May 22, 2024

zzecool commented May 22, 2024

mlsmaycon commented May 22, 2024

zzecool commented May 22, 2024

mlsmaycon commented May 22, 2024

zzecool commented May 22, 2024 • edited Loading

mlsmaycon commented May 22, 2024

zzecool commented May 22, 2024 • edited Loading

mlsmaycon commented May 22, 2024

zzecool commented May 23, 2024 • edited Loading

zzecool commented May 14, 2024 •

edited

Loading

zzecool commented May 14, 2024 •

edited

Loading

zzecool commented May 22, 2024 •

edited

Loading

zzecool commented May 22, 2024 •

edited

Loading

zzecool commented May 22, 2024 •

edited

Loading

zzecool commented May 22, 2024 •

edited

Loading

zzecool commented May 23, 2024 •

edited

Loading