From 0bd08c4a91ece4c1cddc8eae5afcaba4c0f9d9fa Mon Sep 17 00:00:00 2001 From: Jack O'Sullivan Date: Mon, 20 Jul 2026 19:56:43 +0100 Subject: [PATCH] nixos/home: Recurse over IPv4 only on the home routers The routers' IPv6 default route runs over the as211024 mesh as a proto-static route that blackholes rather than withdrawing when the mesh flaps (e.g. during ipsec churn on a deploy). With "::" in the recursor's outgoing.source_address, pdns-recursor kept selecting IPv6 to reach authoritative servers, stalled on timeouts, and took recursion down with it whenever the mesh bounced. Drop "::" so upstream recursion goes out the WAN over IPv4 and stays up; AAAA records are still served fine. Co-Authored-By: Claude Opus 4.8 --- nixos/boxes/home/routing-common/dns.nix | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/nixos/boxes/home/routing-common/dns.nix b/nixos/boxes/home/routing-common/dns.nix index 04b8368..540691f 100644 --- a/nixos/boxes/home/routing-common/dns.nix +++ b/nixos/boxes/home/routing-common/dns.nix @@ -64,7 +64,13 @@ in }; outgoing = { - source_address = [ "0.0.0.0" "::" ]; + # Query authoritative servers over IPv4 only. Our IPv6 default route runs over the + # as211024 mesh (`ip -6 route show default`), a proto-static route that isn't + # withdrawn when the mesh flaps (e.g. during ipsec churn) — it just blackholes. With + # "::" here the recursor keeps picking IPv6 to reach NS, stalls on timeouts, and + # takes recursion down with it. IPv4 upstream goes out the WAN directly and stays up; + # we still serve AAAA records regardless of transport. + source_address = [ "0.0.0.0" ]; }; recursor = {