PRF's questions

I'm configuring some databases in a swarm cluster environment to use endpoint-mode = dnsrr

Documentation says (https://docs.docker.com/network/overlay/):

"A DNS query for the service name on the Docker host returns a list of IP addresses for the nodes running the service"

I'm having trouble to understand what this sentence is saying.

If I use dig to query the service name, which dns server which I have to use?. Swarm manager (which I understand as docker host) is not running a DNS server as I know.

What I do know is that inside an overlay network you can resolve using tasks.$servicename, but for dnsrr and host network, how it is done?

I have an openvpn 2.4 running very well, but a new requirement comes. I need to create iptables rules for diferent client ip segments for giving they access to a few services in our network.

So I decided to follow this document https://openvpn.net/community-resources/configuring-client-specific-rules-and-access-policies/

I think it works, because the client is getting the appropiate ip but once connected the vpn side network is unreachable.

I managed to make it work by doing this:

server side:

route add -net 10.8.1.0 netmask 255.255.255.0 dev tun0

client side (macos)

sudo route add -net 10.8 -interface utun4
sudo route delete -net 192.168.13
sudo route add -net 192.168.13 10.8.0.1

The untouched network table after connecting is this (trunked for convenience)

Internet:
Destination        Gateway            Flags        Netif Expire
default            192.168.0.1        UGScg          en0
10.8.1.1           10.8.1.1           UH           utun4
127                127.0.0.1          UCS            lo0
127.0.0.1          127.0.0.1          UH             lo0
192.168.13         10.8.0.1           UGSc           en0

The problem that I saw is the gateway assigned for the client is the same as the ip assigned to him (configured in ccd/user1).

What I need to do is to route a wider range (10.8) to the tun interface and then route our lan subnet (192.168.13) via 10.8.0.1 gateway, which is the default.

It is possible to replace this routes only with openvpn server configurations?

Here is my config files

server.conf

dev tun0
proto udp
port 1194
ca /etc/openvpn/easy-rsa/pki/ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/server_8UY7QzRl8yjjzVAx.crt
key /etc/openvpn/easy-rsa/pki/private/server_8UY7QzRl8yjjzVAx.key
dh /etc/openvpn/easy-rsa/pki/dh2048.pem
topology subnet
server 10.8.0.0 255.255.255.0
push "dhcp-option DNS 192.168.13.5"
push "dhcp-option DNS 192.168.13.2"
push "block-outside-dns"
push "route 192.168.13.0 255.255.255.0"
push "redirect-private"

client-config-dir /etc/openvpn/ccd

client-to-client
keepalive 10 120
remote-cert-tls client
tls-version-min 1.2
tls-auth /etc/openvpn/easy-rsa/pki/ta.key 0
cipher AES-256-CBC
auth SHA256
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
crl-verify /etc/openvpn/crl.pem
status /var/log/openvpn-status.log 20
status-version 3
syslog
verb 3

ccd/user1

ifconfig-push 10.8.1.1 10.8.1.2

I'll appreciate any help.

I was trying to make an acl rule in waf2 which allows only a regex matched cookie value, but only if the cookie exists.

sadly, this type of conditional rule aren't possible and I tried many ways and regex tricks with no luck.

The same for any other header, for example a X-Csrf-Token, I would like to validate it (format) but for the very first request on the site this header will not exists, hence the request will be blocked.

Am I doing and/or thinking this wrong?, I can't believe that a very common sense rule like those are so hard to create.

Thanks!