Netbox DNS and a bit of Ansible for the GUUG in July 2026

Note, this is NOT an official Netbox DNS logo!

Transcript

1. NetBox DNS Jan-Piet Mens (JP designed the image which was then drawn by ↯⌀⌁⌂ --NOCARRIER) July 2026 @jpmens@mastodon.social GUUG
2. dig @::1 +dnssec JP $ORIGIN jan-piet.mens. $TTL 1D @ SOA ns _ 1 3H 1H 52W 1H NS @ TXT "Jan-Piet Mens" RP jp.mens.de. @ MX 0 . A 192.0.2.53 ; RFC5737 AAAA 2001:db8:2::2025 ; RCF3849 HTTPS 0 jpmens.net. JP CNAME @ jpmens TXT "small-time fiddler, plain text, WTF-8" HINFO "Epson HX-20" "SomethIX OS" LOC 38 55 18.435 N 1 25 50.418 E 10m 10m 100m 10m jo PTR jo.jpmens.github.com. _geo URI 0 0 "https://owntracks.org" ansible PTR NO🐄 S toot TXT "mastodon.social/@jpmens"
3. NetBox fi • network source of truth • IP address management (IPAM) • RACK,VLAN, AS, device modeling • VPN, IPSec policies • virtual machines, etc., etc. • change logs, search, events, scripts • custom elds
4. NetBox DNS do you need Netbox DNS? it depends. if you work alone and manage your DNS with vi/emacs/nano or nsupdate then possibly not ;-) But …
5. NetBox DNS • created by Peter Eckel • not bound to speci c DNS integrate with that • we CI/CD pipelines • • scripts • con g management • API • UI, REST API, bits of Ansible fi fi github.com/peteeckel/netbox-plugin-dns
6. NetBox DNS • internationalized domain names (IDN) • tenancy on objects • optional automatic SOA serial • RFC 2137 classless delegation • IPAM DNSsync
7. adding plugin to NetBox • add NetBox DNS to existing NetBox $ cd /opt/netbox/ $ source venv/bin/activate (venv) $ pip install netbox-plugin-dns (venv) $ echo netbox-plugin-dns >> local_requirements.txt (venv) $ echo "PLUGINS=['netbox_dns']" >> netbox/netbox/configuration.py (venv) $ /opt/netbox/netbox/manage.py migrate $ sudo systemctl restart netbox netbox-rq • or do all-in-one:
8. playbook - name: Install NetBox and netbox-plugin-dns hosts: nb vars: nb_host: "{{ ansible_default_ipv4.address }}" netbox_version: v4.4.2 # or latest netbox_local_requirements: - netbox-plugin-dns==1.4.1 netbox_config: ALLOWED_HOSTS: [ "{{ nb_host }}" ] PLUGINS: [ "netbox_dns", ] PLUGINS_CONFIG: netbox_dns: zone_nameservers: [ "nsa.example", "usb.example" ] zone_soa_mname : "nsa.example" zone_soa_rname: "noc.example.org" filter_record_types: [ "A6", "AFSDB", "APL", "AVC", "DLV" ] netbox_setup_systemd: true netbox_setup_web_frontend: true roles: # https://github.com/gmazoyer/ansible-role-netbox - gmazoyer.netbox
9. preliminaries • I use environment variables in examples $ echo $NETBOX_API https://netbox.example $ echo $NETBOX_TOKEN xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx • tokens are user-speci c and fi permissions apply
10. DNS views • views are yuck can be practical • BIND-style (and now Unbound and PowerDNS have them too!) • each zone belongs in a view • two zones example. can exist if they are in two distinct views (that's the point, innit?)
11. create a view • create view, assign DNSsync pre x #!/usr/bin/env python3 import pynetbox import os viewname = "external" nb = pynetbox.api(os.getenv("NETBOX_API"), token = os.getenv("NETBOX_TOKEN")) fi v = nb.plugins.netbox_dns.views.create(name=viewname, display=viewname, description="Outward-facing zones", prefixes=[ { "prefix": "192.0.2.0/24" } ])
12. DNS zones • manage in UI • use zone templates to add common sets of objects to zones #!/bin/sh jo name="$1" \ default_ttl=7200 \ soa_ttl=43200 \ soa_rname=noc.example.org. \ soa_refresh=7200 \ soa_retry=1800 \ soa_expire=4838400 \ soa_minimum=900 | curl -sSf \ -H "Authorization: Token $NETBOX_TOKEN" \ -H "Content-type: application/json" \ "${NETBOX_API}/api/plugins/netbox-dns/zones/" \ --data @-
13. resource records • rdata validation on input (also via API) • record templates → zone templates from form • optionally filter_record_types
14. adding an address • create an IP address in NetBox - name: Get next available IPv4 address netbox.netbox.netbox_ip_address: data: prefix: "192.0.2.0/24" dns_name: "{{ hostname }}.{{ zone }}" state: "new" • DNSsync → zone
15. Ansible inventory • from the netbox.netbox collection --plugin: netbox.netbox.nb_inventory validate_certs: true flatten_custom_fields: true config_context: true query_filters: - cf_special: "tonic" group_by: - sites - location cache: false rename_variables: - pattern: "tags" repl: "xtags" - pattern: "serial" repl: "xserial" dns_name: true
16. ceci n'est pas ... NetBox DNS is not a DNS server, however with help, it can feed DNS data into authoritative servers, signers BIND Cascade Knot DNS NSD PowerDNS
17. serving DNS
18. octodns • manage DNS records across providers • many providers • zone master les, RFC 2136, ... • support for NetBox DNS as source fi github.com/octodns/octodns github.com/olofvndrhr/octodns-netbox-dns
19. octodns providers /etc/hosts; Akamai Edge DNS; Amazon Route 53; AutoDNS; Azion DNS; Azure DNS; BIND, AXFR, RFC-2136; Bunny DNS; Cloud are DNS; ClouDNS; Constellix; deSEC; DigitalOcean; DNS Made Easy; DNSimple; easyDNS; EdgeCenter DNS; Fastly; G-Core Labs DNS; Gandi; Google Cloud DNS; Hetzner DNS; Infoblox; Infomaniak; Lexicon; Mythic Beasts DNS; NetBox-DNS; NS1; OVHcloud DNS; Pi-hole; PowerDNS; Rackspace; Scaleway; Selectel; TransIP; UltraDNS;YAML; Zone le fi fl octodns.readthedocs.io/en/latest/
20. more octodns • Con gure --providers: netbox: # pip install octodns-netbox-dns class: octodns_netbox_dns.NetBoxDNSProvider url: env/NETBOX_API token: env/NETBOX_TOKEN zonefiles: # pip install octodns-bind class: octodns_bind.ZoneFileSource directory: ./zonefiles file_extension: "" • Run zones: "*": sources: [ netbox ] targets: [ zonefiles ] fi $ octodns-sync --config-file=./config/production.yml --doit --quiet
21. octo nits • SOA serial updated at every run • invents SOA rname • doesn't honour NetBox SOA timers!! • provider code quality ? • limited rrtype support in providers • basic docs good, providers' so-so • (learn to read stack traces ... :-( ) jpmens.net/2025/02/22/notes-to-self-on-octodns-and-its-providers/ jpmens.net/2025/02/19/netbox-dns-and-a-pinch-of-octodns/
22. DNSSEC in NetBox fi • document policies and signing keys • e.g. KASP • use to generate DNS server con gs • key material is not in NetBox and should not be (HSM?) • signers typically manage keys
23. key templates • describe desired key types • use to automate key generation
24. DNSSEC policies fi • describe signing parameters which can be assigned to zones • key types, lifetimes, etc. • use to generate DNS server con gs
25. fi generate con gs
26. how else? (3) • for instance, PowerDNS $ pdnsutil add-zone-key example.net. KSK active published ECDSAP256SHA256 • for instance, BIND 9.6 tools • for instance, LDNS tools • for instance, Cascade $ dnssec-keygen -a ECDSAP256SHA256 -f ksk example.net. $ ldns-keygen -a ECDSAP256SHA256 -k example.net. # How keys are generated. [key-manager.generation] use-csk = true algorithm = "ECDSAP256SHA256"
27. NetBox scripts • run any Python script on demand (even trigger run of Ansible playbooks) • ask for input elds • captures stdout and displays it • logging possible fi jpmens.net/2020/02/28/dial-a-for-ansible-and-r-for-runner/
28. choose script
29. run script
30. • re on any NetBox object • create, update, delete, job start/end • actions are webhook, script, noti cation • trigger almost anything ... fi fi Events on DNS
31. changelogs (1)
32. changelogs (2)
33. con g contexts fi fi jpmens.net/2025/02/21/netbox-and-con guration-contexts-templates/
34. further reading • GraphQL $ curl -sSf -H "Authorization: Token $NETBOX_TOKEN" \ -H "Content-type: application/json" \ "${NETBOX_API}/graphql/" \ --data '{"query":"query {netbox_dns_zone_list { id name { "data": { "netbox_dns_zone_list": [ { "id": "2", "name": "2.0.192.in-addr.arpa" }, { "id": "1", "name": "example.net" } ] } } }}"}'
35. on the horizon • DHCP parameters (not a server) • DNS catalog zones
36. Fin jpmens.net @jpmens@mastodon.social