Hello everyone,
I’m trying to set up an authoritative secondary DNS server (using NSD) inside a container on a MicroCloud cluster. My goal is to have this container pull the zone information from LXD’s built-in DNS server via an AXFR transfer for an OVN network. I’m running into a connectivity issue and would appreciate some guidance.
My Environment:
- LXD cluster managed by MicroCloud 4 nodes
- A default OVN network is configured as follows:
default | ovn | YES | 10.94.219.1/24
Configuration Steps:
- I have created the forward and reverse network zones:
# lxc network zone list
+------------------------+-------------+---------+
| NAME | DESCRIPTION | USED BY |
+------------------------+-------------+---------+
| 219.94.10.in-addr.arpa | | 1 |
+------------------------+-------------+---------+
| lxd.utn.ac.cr | | 1 |
+------------------------+-------------+---------+
- The zones are configured with a peer (ns1) which has a static IP of 10.94.219.5:
# lxc network zone show lxd.utn.ac.cr
config:
dns.nameservers: ns1.lxd.utn.ac.cr
peers.ns1.address: 10.94.219.5
- I have enabled LXD’s built-in DNS server to listen on the OVN network’s gateway IP and a non-standard port:
# lxc config show
config:
core.dns_address: 10.94.219.1:8853
- Inside the ns1 container, NSD is configured to request the zone transfer from the OVN gateway:
# cat /etc/nsd/nsd.conf.d/server.conf
server:
ip-address: 10.94.219.5
zone:
name: "lxd.utn.ac.cr"
request-xfr: AXFR 10.94.219.1@8853 NOKEY
zone:
name: "219.94.10.in-addr.arpa"
request-xfr: AXFR 10.94.219.1@8853 NOKEY
The Problem:
The zone transfer fails. When I query the ns1 server, I get a SERVFAIL response, as expected since it never received the zone data.
# host ns1.lxd.utn.ac.cr 10.94.219.5
Host ns1.lxd.utn.ac.cr not found: 2(SERVFAIL)
To diagnose this, I checked the network connectivity from the ns1 container to the OVN gateway IP on the AXFR port. The connection fails (it times out with no response).
# lxc exec ns1 -- nc -zv 10.94.219.1 8853
(Command hangs and eventually fails)
This appears to be the root of the problem: the container cannot reach the OVN gateway IP on the port specified in core.dns_address.
logs → sudo journalctl -u snap.lxd.daemon -f
Oct 22 14:58:27 m1 lxd.daemon[333282]: time=“2025-10-22T14:58:27Z” level=error msg=“Failed to bind TCP DNS address "10.94.219.1:8853": listen tcp 10.94.219.1:8853: bind: cannot assign requested address”
Oct 22 14:58:30 m1 lxd.daemon[333103]: => LXD is ready
if i change de config to accept for anyware ip
config:
cluster.https_address: 10.100.27.21:8443
core.dns_address: :8853
and add peers.local.address: 127.0.0.1 to test in the microcloud node
lxc network zone show lxd.utn.ac.cr
name: lxd.utn.ac.cr
description: “”
config:
dns.nameservers: ns1.lxd.utn.ac.cr
peers.local.address: 127.0.0.1
peers.ns1.address: 10.94.219.5
used_by:
- /1.0/networks/default
project: “”
dig @127.0.0.1 lxd.utn.ac.cr AXFR -p 8853
; <<>> DiG 9.18.39-0ubuntu0.24.04.1-Ubuntu <<>> @127.0.0.1 lxd.utn.ac.cr AXFR -p 8853
; (1 server found)
;; global options: +cmd
lxd.utn.ac.cr. 3600 IN SOA lxd.utn.ac.cr. ns1.lxd.utn.ac.cr. 1761145829 120 60 86400 30
lxd.utn.ac.cr. 300 IN NS ns1.lxd.utn.ac.cr.
default.gw.lxd.utn.ac.cr. 300 IN A 10.94.219.1
cont-04.lxd.utn.ac.cr. 300 IN A 10.94.219.7
ns1.lxd.utn.ac.cr. 300 IN A 10.94.219.5
The lxd dns seems to work but there is no zone transfer from the ns1 container and it does not work from the external network.
Any help or clarification on the correct architecture for this would be greatly appreciated.
Thank you
