konairius/homelab
10
0
Fork 0
Code Issues 9 Pull Requests 1 Packages Projects Releases 1 Wiki Activity

feat(ingress): allow netbird-ingress peer to forward DNS over TCP/53 #28

Closed
k.renner wants to merge 1 commits from netbird-mesh-dns-tcp into main
pull from: netbird-mesh-dns-tcp
merge into: :main
Conversation 0 Commits 1 Files Changed 1
+7 -1
k.renner commented 2026-06-25 18:16:10 +00:00
Owner
Copy Link
Copy Source

Follow-up hardening on top of #27.

Now that the old 10.2.40.53 / LXC-260 gateway DNS path is decommissioned, mesh peers resolve renner.uno via the in-cluster kube-dns-lb LoadBalancer (fd99::83 / 10.2.99.83, kube-system) forwarded through the netbird-ingress routing peer. The netbird-ingress-egress CNP already permitted UDP/53 to kube-dns; this adds TCP/53 (the kube-dns-lb Service exposes both) so large/truncated DNS answers aren't dropped by the egress policy.

Not required for basic resolution (UDP/53 already works); purely robustness.

🤖 Generated with Claude Code

Follow-up hardening on top of #27. Now that the old `10.2.40.53` / LXC-260 gateway DNS path is **decommissioned**, mesh peers resolve `renner.uno` via the in-cluster `kube-dns-lb` LoadBalancer (`fd99::83` / `10.2.99.83`, kube-system) forwarded through the `netbird-ingress` routing peer. The `netbird-ingress-egress` CNP already permitted UDP/53 to kube-dns; this adds **TCP/53** (the `kube-dns-lb` Service exposes both) so large/truncated DNS answers aren't dropped by the egress policy. Not required for basic resolution (UDP/53 already works); purely robustness. 🤖 Generated with Claude Code
k.renner added 1 commit 2026-06-25 18:16:10 +00:00
feat(ingress): allow netbird-ingress peer to forward DNS over TCP/53 dbdc3cda4b 
Mesh peers resolve renner.uno via the kube-dns LoadBalancer (kube-dns-lb,
fd99::83 / 10.2.99.83) through the netbird-ingress routing peer, now that
the old 10.2.40.53 / LXC-260 gateway DNS path is decommissioned. The
kube-dns-lb Service exposes 53 on both UDP and TCP; add TCP so large or
truncated DNS answers aren't dropped by the egress policy.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
k.renner closed this pull request 2026-06-26 05:24:44 +00:00

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
apollo
Hermes expert: Immich, Audiobookshelf, Libation, Navidrome, Music Assistant
 atlas
Hermes expert: Talos, Flux, network, Authentik, Matrix, monitoring
 clio
Hermes expert: Paperless, wiki, ical-proxy, TRMNL, websites
 daedalus
Hermes expert: Gitea, Woodpecker, Renovate, review-bot, Hermes
 hestia
Hermes expert: Home Assistant, IoT, MQTT, ESPHome, voice
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
alert-monitor-bot claude-bot (Claude Bot) flux hermes-bot issue-fix-bot k.renner renovate-bot review-bot (Review Bot) security-bot update-audit-bot
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: konairius/homelab#28