DNS Settings on PVE Server

[spetrillo]

Hello all,

My PVE server has two vlans setup, one being the IP it should be communicating on and the second is for iSCSI storage needs. Each time I check the DNS settings for the server it is defaulting to the iSCSI IP, which has no access outside of its vlan. I change it back but on the next reboot it changes back. I have manually edited /etc/resolv.conf and changed it there but the next reboot changes the file again. Why is this happening and what file should I be editing to permanently change the DNS.

Thanks,
Steve

 

[sw-omit]

Have you also tried doing it from the GUI: <node> -> System -> DNS -> DNS Server 1(+2+3)?

 

[spetrillo]

Yes from both the GUI and CLI. It seems it takes the last IP gateway of the last vlan assigned. Once I remove the iSCSI vlan it goes back to the IP it should be looking at all the time. This seems like a bug.

I just checked my PBS server and it is exhibiting the same problem. This is soo weird.

Ok I can add a second DNS server entry, to get around this but this should not be happening in the first place.

 

[sw-omit]

Wait, "Last" gateway? As in that you have multiple gateways set up?
The server should only have one gateway, and since the storage network doesn't need to go outside that network, why does it even have a gateway?

Could you post the output of the following?

ip a
cat /etc/network/interfaces

 

[spetrillo]

So let me list everything in one reply:

1) My PVE has two IPs attached to it. One for the normal resolution and the second one for iSCSI storage access.
2) It seems that the DNS settings are getting set from the last Linux bridge, which in my case is the iSCSI storage vlan.

Please see attached interfaces file, as well as GUI configuration. VLAN 25 equates to the subnet where 192.168.2.161 is the gateway of the subnet. I would update the GUI to the right DNS server and reboot. Upon reboot it would go back to 192.168.2.161, so its getting this from somewhere else I suspect.

In the GUI DNS settings I can add a second DNS server IP for the DNS server it should be querying, to get around this issue but it does not explain why both my PBS and PVE are setting the DNS from the last Linux bridge it sees.

One thing I am going to try right now is change the order of the Linux sub bridge interfaces and see if that fixes things. If it does then it tells me this is a bug. DNS should not be getting set from what is in my interfaces file.

 

[spetrillo]

And as I expected the order change of my sub bridges yields the right DNS server being in the GUI. I do not know about anyone else but this is a bug in my humble opinion. During the installation you set the DNS server explicitly. It should honor this!

 

[sw-omit]

Ah, I see your issue.
You are telling your server to get it's IP-settings from DHCP...
A small quiz:
Q: What does it get from DHCP?
A: IP, Subnet-mask, Gateway, DNS-Server and optionally other DHCP-options.

So it basically is doing exactly what you are telling it to do

Your options are:
1. (Best option IMO): Set a static IP-address for both interfaces (in the correct range) that is outside of the DHCP-Range, and also one on your PBS (different from PVE of course), which I expect you have set the same.
2. Change the DHCP-Client settings to ignore / not get the DNS-Server settings.

Edit: Typo's and additions

 

[sw-omit]

If you want to go that second option btw (again, not adviced but possible), take a look here:
https://forums.debian.net/viewtopic.php?p=765929#p765929

 

[spetrillo]

Is DHCP doing what I am telling it to do...yes. Is PVE or PBS honoring this...absolutely no! PVE and PBS are making an arbitrary decision to pull the DNS settings from the last Linux sub bridge setting. This should not be happening.

Attached are the DHCP settings for my iSCSI VLAN. Notice there is nothing in the DNS Server section, so PVE and PBS are pulling the gateway and making it the DNS server...thats bogus in my mind.

I use DHCP reservations, which makes everything really easy to identify and keep track of. If I set a static IP then I have no place on my router where that static set device shows up. Its easy to look at my DHCP listing for all the devices in my local network.

 

[sw-omit]

Ah, but that's not proxmox issue but an opnsense-issue.
If you click the (i) next to the DNS-servers it says the following:

Leave blank to use the system default DNS servers: This interface IP address if a DNS service is enabled or the configured global DNS servers.

Meaning: Because you left it blank, it selected the default, which is the OpnSense server itself, so OpnSense is the one filling in the DNS-Server for you, then proxmox is asking for both in order, and because they both get DNS options, the "last" one overwrites the previous one.
Is that wanted? In your case not, but then again you have (in my opinion) a bit of an unusual setup, with having multiple ports requesting multiple DNS-entries.

What you could do is one of the following:

1. In the opnsense iscsi dhcp set the DNS of the primairy dns.
2. Set static IP's
3. Disable the requesting of DNS all-together with the link I provided in the second smaller post (#8)

 

[spetrillo]

Ah, but that's not proxmox issue but an opnsense-issue.
If you click the (i) next to the DNS-servers it says the following:

Meaning: Because you left it blank, it selected the default, which is the OpnSense server itself, so OpnSense is the one filling in the DNS-Server for you, then proxmox is asking for both in order, and because they both get DNS options, the "last" one overwrites the previous one.
Is that wanted? In your case not, but then again you have (in my opinion) a bit of an unusual setup, with having multiple ports requesting multiple DNS-entries.

What you could do is one of the following:

1. In the opnsense iscsi dhcp set the DNS of the primairy dns.
2. Set static IP's
3. Disable the requesting of DNS all-together with the link I provided in the second smaller post (#8)

As you mention its going to take the system default DNS server. I am using Unbound and this would be the right IP I would want. That is not happening...still a bug IMHO. To get around this I will update the storage vlan with the right IP and all done. I should not have to do this.