.\" comment
.TH "tdns\-svr\-proxy" "7" "27 May 2015" "1.0" "tdns-svr-proxy man page"
.SH "NAME"
.B tdns\-svr\-proxy
\- a DNS server side proxy to receive queries over TCP or TLS, and forward queries to local over UDP to avoid head of line blocking in connections and achieve good performance.
.SH "SYNOPSIS"
.B tdns\-svr\-proxy
.RB [ \-h ]
.RB [ \-a
.IR IP ]
.RB [ \-l
.IR port ]
.RB [ \-s
.IR IP ]
.RB [ \-p
.IR port ]
.RB [ \-t
.IR connection ]
.RB [ \-k
.IR keyfile ]
.RB [ \-c
.IR certfile ]
.SH "DESCRIPTION"
.B tdns\-svr\-proxy
receives connection based (TCP/TLS) DNS queries, and forwards the queries over UDP to a recursive DNS server. The recursive DNS server is normally running at the same local host. 
.PP
It receives the DNS responses from the recursive DNS server, and forwards the responses back to the original client over TCP or TLS.
.PP
It can be set up to receive TCP with STARTTLS or direct TLS with option -t. By default, this server proxy supports persistent connections, but with a timeout. The default connection timeout is 60 seconds and they can be set in server_proxy.hh: 
  #define WRITE_TIMEOUT  60
  #define READ_TIMEOUT   60
.PP
A client side proxy is built to pair with this server proxy. For more details, please see tdns-clt-proxy(3).
.SH "OPTIONS"
.TP
.B \-h
Show option help.
.TP
.B \-a \fIIP
the local IP address to listen on, default is any addresses
.TP
.B \-l \fIport
the local port to listen on, default is 10053
.TP
.B \-s \fIIP
the IP address of DNS server
.TP
.B \-p \fIport
the port number of DNS server, default is 53
.TP
.B \-t \fIconnection
the type of listen connection. It could be TCP or TLS. Default is TCP (with STARTTLS)
.TP
.B \-k \fIkeyfile
path to the key file, required
.TP
.B \-c \fIcertfile
path to the certificate file, required
.SH "SET UP"
.PP
ldns, libevent, openssl are required to compile and run.
.PP
A certificate and key files are required to run the program.
You can generate self-signed certificate with GnuTLS or OpenSSL command line.
.PP
For GnuTLS certificate tool:
  certtool --generate-privkey --outfile key.pen --sec-param=high
  certtool --generate-self-signed --load-privkey key.pem --outfile cert.pem
.PP
For OpenSSL command line tool:
  openssl genrsa -out pkey 4096
  openssl req -new -key pkey -out cert.req
  openssl x509 -req -days 365 -in cert.req -signkey pkey -out cert
.PP
Before running this proxy, you need to set up a recursive DNS server accepting UDP queries. For security, you might need to limit access to this recursive DNS server.
.SH "EXAMPLE"
.TP
tdns\-svr\-proxy -s 1.2.3.4 -p 53 -l 5.6.7.8 -a 53 -t TCP -k keyfile -c certfile
.SH "SEE ALSO"
tdns-clt-proxy(3)
.".SH BUGS
."No known bugs.
.SH "AUTHOR"
Liang Zhu (liangzhu@usc.edu)
