Is it possible to add some forwarding to Rancher internal DNS server


Let me try to explain what I’m trying to achieve:

  1. I’ve got two networks in different geo-locations on Azure Cloud running Rancher server in both, plus several machines with the rancher agent.
  2. I want to make services in one network resolvable by some name from another network.
  3. I started Bind9 DNS server and RFC 2136 DNS updater from the Rancher catalog in both networks and cross link them so that the updated in one network updates DNS server in another one.
  4. In both networks I changed the network default DNS server to be the DNS server I’m running.

Everything works fine and I can resolve services residing in one network from another if I’m performing a request from the VMs like this

ping <service>.<stack>.<environment>.<domain>

The problem is that if I try to do the same from inside of a container it doesn’t work.

Here how /etc/reslove.conf looks on the VM:


where my DNS server I’m using to resolve services in another network.

Here is my /etc/resolve.conf in a container (managed network).

search grafana.rancher.internal
ernal rancher.internal

Is it possible to tell Rancher internal DNS server ( to forward requests of DNS records belonging to my <domain> to my DNS server

The normal behavior is that containers are pointed at, which is a DNS server running in the Network Agent on the same host as the container. It responds to service discovery requests (*.rancher.internal) and proxies anything else either to the servers configured for the container or the Docker daemon.

Hi Vincent, thanks for your reply.

In the managed network mode, if I add my DNS IP address ( into Resolving Servers and then try to cat /etc/resolve.comf inside of the container, I see the following:

search grafana.rancher.internal grafana.grafana.rancher.internal rancher.internal
# nameserver

and the forwarding doesn’t work.

If I try to run a container (ubuntu:latest) specifying --dns= --dns= resolve.conf shows me


but the name resolution still fails.
If, in the same container, I try to specify DNS server in nslookup explicitly and try to resolve something it gives me this:

root@49c4732df485:/# nslookup
> server
Default server:
> bind9.bind9.default.rancher
;; reply from unexpected source:, expected
;; reply from unexpected source:, expected

Where is the IP of docker0 interface on the machine where I’m running Docker.

Please note that the same name (bind9.bind9.default.rancher) I can successfully resolve in the VM where I’m running Docker and resolve.conf looks identical to the one in the container.

I think I can get the DNS resolution from my DNS server if I switch to the host network mode but does it mean that I’ll loose the Rancher DNS resolution at the same time and won’t be able to resolve by <service_name>.<strack_name>?

Problem solved, it was the changes in iptables made by rancher agent. I can successfully ping everything (rancher governed services and services in other networks resolvable by my DNS server) from a VM which is not running DNS container.