Howto force Nginx resolver to use new source UDP port
mdounin at mdounin.ru
Thu Nov 17 20:20:56 UTC 2022
On Thu, Nov 17, 2022 at 05:17:06AM -0500, jeanpaul wrote:
> We're using Nginx as ingress controller in a Kubernetes environment. Nginx
> uses a DNS service inside k8s with 1 single service-IP and multiple DNS PODs
> behind that.
> The translation from service-IP to any of the multiple DNS PODs is done via
> DNAT rules.
> The problem:
> - Nginx establishes an UDP 'connection' on for example localIP 22.214.171.124
> source-port 12345 towards serviceIP 126.96.36.199
> - DNAT translates this as sourceport 12345 towards any DNS-POD; for example
> - If DNS-POD 188.8.131.52 terminates Nginx is not aware of this because of the
> 'connection' towards serviceIP 184.108.40.206
> - Nginx will send all future DNS request using the same tuple of
> serviceIP:sourcePort, so 220.127.116.11:12345 -> 18.104.22.168:53
> - This will result in a timeout because the destination POD isn't there
> Is it possible to force Nginx to use different source UDP ports every X
> seconds, of after a timeout?
No, nginx will continue to use the same source port unless there
will be an error when sending a UDP packet, which is not going to
happen in the described setup.
Note that even if there will be a way to force nginx to use
difference source ports every X seconds, this will anyway result
in downtime till the next source port change if the DNS POD
terminates. This suggests that it might be a good idea to rethink
how DNS balancing works in your setup.
More information about the nginx