Serve only A/ANY queries; answer AAAA and all other record types with NOERROR and
no data, for overrides and forwarded names alike. The console LAN has no IPv6
route, so returning a real AAAA made clients stall on an unreachable address.
This fixes the PS5 Payload Manager looping on "synchronizing repositories": its
dual-stack catalog host itsplk.github.io handed back an IPv6 address and the
manager's libcurl download (no timeout) hung on it indefinitely.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Add 8.8.8.8 as a second ordered upstream in [upstream] server so DNS forwarding
falls back when 1.1.1.1 is unreachable. Note in [general] allowed_clients that
the 192.168.40.0/28 range already authorizes both consoles, PS5PRO
(192.168.40.14) and PS5FAT (192.168.40.13).
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Replace the gateway's env-var DNS policy with docker/nanodns.ini, modelled on
https://github.com/drakmor/nanoDNS#config: [general] (redirect_url,
allowed_clients), [upstream] (ordered resolver list + timeout_ms), [overrides]
(mask = IPv4 spoof) and [exceptions] (masks forwarded upstream). Masks use
shell-style wildcards and match case-insensitively; resolution order is
exceptions -> overrides -> NXDOMAIN.
The unmatched-name behaviour is deliberately inverted from upstream nanoDNS:
names matching no rule return NXDOMAIN (default-deny) instead of being forwarded,
so PSN, updates and telemetry stay blocked. The source-client allowlist now lives
in [general] allowed_clients. The INI is baked into the image; CONFIG_FILE can
point at a mounted file for per-host overrides.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Broaden ALLOWED_CLIENTS from the console VLAN alone to also include the server
VLAN (192.168.20.0/24) and the trusted management VLAN (192.168.10.0/27) so the
resolver can be tested and administered from those networks. The consoles still
only require the 192.168.40.0/28 range.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Add an ALLOWED_CLIENTS source-address filter to the DNS service so it only
answers queries from the authorized PS5 VLAN (192.168.40.0/28 by default).
Queries from any other source address are dropped and logged as "denied" on
both UDP and TCP. The value accepts a comma-separated mix of individual
addresses and CIDR ranges, and an empty value disables the filter.
Record the two authorized consoles (PS5PRO 192.168.40.14, PS5FAT
192.168.40.13) and the stale 192.168.10.x workstation address in the docs.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
kadinhoandClaude Opus 4.8