Using own apt mirror with apt. apt update try to connect to prod.debian.map.fastly.net istead of deb.debian.org

Question

I create own apt mirror available locally for all servers. To not change /etc/apt/sources.list I also run dnsmasq, that resolve deb.debian.org (and security.debian.org) to private IP address, where apt mirror is running.

So apt mirror client configuration:

root@apt-client:~# cat /etc/resolv.conf 
nameserver 10.14.122.165
root@apt-client:~# cat /etc/apt/sources.list| grep -v '^#'

deb http://deb.debian.org/debian stretch main contrib non-free
deb-src http://deb.debian.org/debian stretch main contrib non-free

deb http://security.debian.org/ stretch/updates main contrib non-free
deb-src http://security.debian.org/ stretch/updates main contrib non-free
deb http://deb.debian.org/debian stretch-updates main contrib non-free
deb-src http://deb.debian.org/debian stretch-updates main contrib non-free

deb http://deb.debian.org/debian stretch-backports main contrib non-free
deb-src http://deb.debian.org/debian stretch-backports main contrib non-free

root@apt-client:~# ping deb.debian.org
PING deb.debian.org (10.14.122.165) 56(84) bytes of data.
64 bytes from deb.debian.org (10.14.122.165): icmp_seq=1 ttl=64 time=0.317 ms
^C
--- deb.debian.org ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.317/0.317/0.317/0.000 ms
root@apt-client:~# ping security.debian.org
PING security.debian.org (10.14.122.165) 56(84) bytes of data.
64 bytes from deb.debian.org (10.14.122.165): icmp_seq=1 ttl=64 time=0.274 ms
^C
--- security.debian.org ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.274/0.274/0.274/0.000 ms
root@apt-client:~# apt update
0% [Connecting to prod.debian.map.fastly.net (151.101.12.204)] [Connecting to prod.debian.map.fastly.net (151.101.12.204)]

I don't know why apt try to connect to prod.debian.map.fastly.net istead of deb.debian.org. In /etc/apt.sources.list I have deb.debian.org. Ping shows that deb.debian.org is resolved for local address: 10.14.122.165 and apt should connect there.

apt mirror server and dnsmasq server it's the same server with IP: 10.14.122.165

root@apt-client# host deb.debian.org
deb.debian.org has address 10.14.122.165
deb.debian.org is an alias for debian.map.fastly.net.
debian.map.fastly.net has IPv6 address 2a04:4e42:3::645
deb.debian.org is an alias for debian.map.fastly.net.

Answer 1

The reason is that APT uses SRV records to look up hostnames in a round-robin if they're available. This solves two problems:

• If a DNS round-robin is used, then a user may connect to one host which is up to date to download manifests and then connect to another host which hasn't been updated yet, causing failures.
• For HTTPS servers, it's difficult to use a single generic hostname because multiple different parties would either have to share a certificate or issue their own certificates for the same name.

So when you look up the DNS entries, you also need to look up SRV records:

$ host -t srv _http._tcp.deb.debian.org
_http._tcp.deb.debian.org has SRV record 10 1 80 prod.debian.map.fastly.net.
$ host -t srv _https._tcp.deb.debian.org
_https._tcp.deb.debian.org has SRV record 10 1 443 debian.map.fastly.net.

You'll either need to override those or return NXDOMAIN upon receiving a query for them.