# Intercepting SRV records **URL:** \ **Category:** Uncategorized\ **Created:** [February 14, 2025, 9:40pm UTC](https://openziti.discourse.group/t/intercepting-srv-records/3967 "2025-02-14T21:40:46Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![pgross](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/pgross/32/2345_2.png) [@pgross](https://openziti.discourse.group/u/pgross)\ **Post date:** [February 14, 2025, 9:40pm UTC](https://openziti.discourse.group/t/intercepting-srv-records/3967/1 "2025-02-14T21:40:46Z")
Good evening, here is the second thread I promised 😃 I'm pretty sure I read that ziti will intercept srv records and I'm rather sure I already got it working once. I shorten the configs a little: intercept-config reads like: ```auto "addresses": [ "_kerberos._udp.ad.company.de", "adw-dc01.ad.company.de", "ad-dc01.ad.company.de" ], ``` host-config reads like: ```auto "forwardProtocol": true, "forwardAddress": true, "forwardPort": true, "allowedAddresses": [ "_kerberos._udp.ad.company.de", "adw-dc01.ad.company.de", "ad-dc01.ad.company.de" ], ``` Windows client with Ziti Desktop Edge Client: ```auto PS C:\Users\p.gross> Resolve-DnsName -type SRV _kerberos._udp.ad.company.de Resolve-DnsName : _kerberos._udp.ad.company.de : Der DNS-Vorgang wurde abgelehnt In Zeile:1 Zeichen:1 + Resolve-DnsName -type SRV _kerberos._udp.ad.company.de + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : ResourceUnavailable: (_kerberos._udp.ad.company.de:String) [Resolve-DnsName], Win32Exc eption + FullyQualifiedErrorId : RCODE_REFUSED,Microsoft.DnsClient.Commands.ResolveDnsName ``` ```auto PS C:\Users\p.gross> Resolve-DnsName ad-dc01.ad.company.de Name Type TTL Section IPAddress ---- ---- --- ------- --------- ad-dc01.ad.company.de A 60 Answer 100.64.0.5 ``` ```auto root@ad-ztna01:~# ziti edge policy-advisor services active-directory.svc OKAY : ad-ztna02 (3) -> active-directory.svc (3) Common Routers: (3/3) Dial: Y Bind: Y OKAY : AD-NB08 (3) -> active-directory.svc (3) Common Routers: (3/3) Dial: Y Bind: N ``` AD-NB08 is the ZDEW. I have no idea, what is going wrong here. Any help is highly appreciated! ---
**Author:** ![emoscardini](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/emoscardini/32/753_2.png) [@emoscardini](https://openziti.discourse.group/u/emoscardini)\ **Post date:** [February 14, 2025, 9:57pm UTC](https://openziti.discourse.group/t/intercepting-srv-records/3967/2 "2025-02-14T21:57:53Z")
Hello again @pgross, Our Windows client(ZDEW) has the ability to automatically tunnel SRV records that match a wildcard configuration, you might want to review this thread: [Conneting Remote Endpoints with a On-Prem AD - #6 by emoscardini](https://openziti.discourse.group/t/conneting-remote-endpoints-with-a-on-prem-ad/815/6) Let me know if that makes sense & if you have questions afterwards. ---
**Author:** ![pgross](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/pgross/32/2345_2.png) [@pgross](https://openziti.discourse.group/u/pgross)\ **Post date:** [February 15, 2025, 7:46am UTC](https://openziti.discourse.group/t/intercepting-srv-records/3967/3 "2025-02-15T07:46:51Z")
Thank you! So it ONLY works with wildcard domains? No option to finetune access? For example: Active Directory needs Samba (Port 445) to work properly. Adding this wildcard will allow access to every samba share of any domain computer (as those usually get a dns name automatically assigned). ---
**Author:** ![pgross](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/pgross/32/2345_2.png) [@pgross](https://openziti.discourse.group/u/pgross)\ **Post date:** [February 17, 2025, 6:43pm UTC](https://openziti.discourse.group/t/intercepting-srv-records/3967/4 "2025-02-17T18:43:44Z")
@emoscardini is there any way to finetune access? Does it work if I add the wildcard intercept only to a DNS (port 53) service and split the other (LDAP, SMB, etc.) into other services without wildcard domains? ---
**Author:** ![emoscardini](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/emoscardini/32/753_2.png) [@emoscardini](https://openziti.discourse.group/u/emoscardini)\ **Post date:** [February 18, 2025, 2:21pm UTC](https://openziti.discourse.group/t/intercepting-srv-records/3967/5 "2025-02-18T14:21:25Z")
Hi @pgross, > [@pgross](#): > > So it ONLY works with wildcard domains? As far as I know, it only works with wildcard configuration. @ekoby Can you confirm this? > [@pgross](#): > > No option to finetune access? I've never tried to narrow this down like you suggested, give it a shot & let me know if you can get it working. ---
**Author:** ![ekoby](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/ekoby/32/14_2.png) [@ekoby](https://openziti.discourse.group/u/ekoby)\ **Post date:** [February 18, 2025, 2:27pm UTC](https://openziti.discourse.group/t/intercepting-srv-records/3967/6 "2025-02-18T14:27:29Z")
That's correct -- SRV records are only supported at part of wildcard domain configuration (at this time). ---
**Author:** ![pgross](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/pgross/32/2345_2.png) [@pgross](https://openziti.discourse.group/u/pgross)\ **Post date:** [February 19, 2025, 1:23pm UTC](https://openziti.discourse.group/t/intercepting-srv-records/3967/7 "2025-02-19T13:23:13Z")
Thank you. I'll try and let you know. ---
**Author:** ![pgross](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/pgross/32/2345_2.png) [@pgross](https://openziti.discourse.group/u/pgross)\ **Post date:** [February 24, 2025, 10:57am UTC](https://openziti.discourse.group/t/intercepting-srv-records/3967/8 "2025-02-24T10:57:34Z")
I'm still testing but I (think) I'm observing a rather unintuitive behaviour? I have a setup where I have a public edge router, reachable via _[ziti01.company.com](http://ziti01.company.com)_. I have a private edge router reachable via _ziti02._ **ad.** _[company.com](http://company.com)_ [ad.company.com](http://ad.company.com) is the Active Directory domain. Now I need to set a wildcard domain intercept for \*.ad.company.com to intercept SRV records. I now see in Wireshark ```auto 3 0.000227 100.64.0.1 100.64.0.2 DNS 71 Standard query 0xb361 AAAA ziti02.ad.company.com 4 0.000449 100.64.0.2 100.64.0.1 DNS 82 Standard query response 0xb361 AAAA ziti02.ad.company.com OPT 5 0.001094 100.64.0.1 100.64.0.11 TCP 52 51025 → 3022 [SYN] Seq=0 Win=65535 Len=0 MSS=65495 WS=256 SACK_PERM ``` So ZDEW tries to reach the private edge router via the tunnel. This is not working. I believe I could circumvent this by advertising a address outside of the [ad.company.com](http://ad.company.com) zone. Just wanted to share my observations. Maybe it would be useful to not resolve advertised adresses of the overlay via the overlay at all? Hope this makes sense. ---
**Author:** ![pgross](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/pgross/32/2345_2.png) [@pgross](https://openziti.discourse.group/u/pgross)\ **Post date:** [February 24, 2025, 12:42pm UTC](https://openziti.discourse.group/t/intercepting-srv-records/3967/9 "2025-02-24T12:42:33Z")
I have now setup two different services. 1. active-directory-client.svc 2. active-directory-dns.svc ```auto { "name": "active-directory-dns.svc-intercept-config", "configTypeId": "g7cIWbcGg", "data": { "portRanges": [ { "high": 53, "low": 53 } ], "addresses": [ "*.ad.company.com" ], "protocols": [ "tcp", "udp" ] }, "tags": {} } ``` ```auto { "name": "active-directory-dns.svc-host-config", "configTypeId": "NH5p4FpGR", "data": { "address": "*.ad.company.com", "port": 53, "forwardProtocol": true, "allowedProtocols": [ "tcp", "udp" ], "httpChecks": [], "portChecks": [] }, "tags": {} } ``` The other service _active-directory-client.svc_ basically intecepts the A records for the domain controllers for ports 138,389,445,1024-65535,88,636,123,135,3128. This is meant to finetune the access to domain resources as mentiones above. I thought: active-directory-dns.svc let me intercept the SRV records, those contain references to for example the domain controllers. When the IP adresses of those domain controllers are resolved, the active-directory-client.svc can now provide access to them. But if one tries to access a fileserver, there's no service for that and it fails. But the result is: ```auto PS C:\Users\p.gross> Resolve-DnsName -Type SRV _ldap._tcp.AUE._sites.dc._msdcs.ad.company.com Resolve-DnsName : _ldap._tcp.AUE._sites.dc._msdcs.ad.company.com : DNS-Serverfehler In Zeile:1 Zeichen:1 + Resolve-DnsName -Type SRV _ldap._tcp.AUE._sites.dc._msdcs.ad.company.com ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : ResourceUnavailable: (_ldap._tcp.AUE....ad.company.com:String) [Resolve-DnsName], Win32 Exception + FullyQualifiedErrorId : RCODE_SERVER_FAILURE,Microsoft.DnsClient.Commands.ResolveDnsName ``` The windows client reports: ```auto [2025-02-24T12:25:56.908Z] INFO tunnel-cbs:ziti_dns.c:686 on_proxy_connect() proxy resolve connection established for domain[*.ad.company.com] ``` Any idea, why this is not working? ---
**Author:** ![ekoby](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/ekoby/32/14_2.png) [@ekoby](https://openziti.discourse.group/u/ekoby)\ **Post date:** [February 28, 2025, 3:12pm UTC](https://openziti.discourse.group/t/intercepting-srv-records/3967/10 "2025-02-28T15:12:45Z")
you hosting configuration is missing forwarding option for. host and port. wildcard domains won't work without `forwardAddress` being set to `true`. sorry for delayed response