webserver / API fails - Recv failure: Connection reset by peer

[HachimanSec]

Hello everyone,

I am currently stuck enabling the webserver and api (https://doc.powerdns.com/authoritative/http-api/index.html).

I configured pdns.conf, restarted the services, no firewall.
The pdns process is listening on the correct ip and port (see below).
But access to either webserver or api fail.

Any idea what I might be missing here?

pdns.conf

#################################
# api   Enable/disable the REST API (including HTTP listener)
#
api=yes

#################################
# api-key       Static pre-shared authentication key for access to the REST API
#
api-key=API_SECRET

#################################
# webserver     Start a webserver for monitoring (api=yes also enables the HTTP listener)
#
webserver=yes

#################################
# webserver-address     IP Address of webserver/API to listen on
#
webserver-address=192.168.2.11

#################################
# webserver-allow-from  Webserver/API access is only allowed from these subnets
#
# webserver-allow-from=127.0.0.1,::1

#################################
# webserver-loglevel    Amount of logging in the webserver (none, normal, detailed)
#
# webserver-loglevel=normal

#################################
# webserver-max-bodysize        Webserver/API maximum request/response body size in megabytes
#
# webserver-max-bodysize=2

#################################
# webserver-password    Password required for accessing the webserver
#
webserver-password=SECRET

#################################
# webserver-port        Port of webserver/API to listen on
#
webserver-port=8081

curl:

curl -k -vv http://192.168.2.11:8081
*   Trying 192.168.2.11:8081...
* Connected to 192.168.2.11 (192.168.2.11) port 8081
> GET / HTTP/1.1
> Host: 192.168.2.11:8081
> User-Agent: curl/8.7.1
> Accept: */*
>
* Request completely sent off
* Recv failure: Connection reset by peer
* Closing connection
curl: (56) Recv failure: Connection reset by peer

curl for api endpoint:

curl -v -H 'X-API-Key: API_SECRET' http://192.168.2.11:8081/api/v1/servers/localhost
*   Trying 192.168.2.11:8081...
* Connected to 192.168.2.11 (192.168.2.11) port 8081
> GET /api/v1/servers/localhost HTTP/1.1
> Host: 192.168.2.11:8081
> User-Agent: curl/8.7.1
> Accept: */*
> X-API-Key: API_SECRET
>
* Request completely sent off
* Recv failure: Connection reset by peer
* Closing connection
curl: (56) Recv failure: Connection reset by peer

port is open and listening

sudo lsof -nP -iTCP -sTCP:LISTEN
COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
pdns_recu 592 pdns    5u  IPv4  18579      0t0  TCP 192.168.2.11:53 (LISTEN)
pdns_serv 593 pdns    6u  IPv4  18062      0t0  TCP 127.0.0.1:5300 (LISTEN)
pdns_serv 593 pdns    7u  IPv4  18063      0t0  TCP 192.168.2.11:8081 (LISTEN)
sshd      635 root    3u  IPv4  18502      0t0  TCP *:22 (LISTEN)
sshd      635 root    4u  IPv6  18513      0t0  TCP *:22 (LISTEN)

[Habbie]

webserver-allow-from=127.0.0.1,::1

you need to allow yourself here

[HachimanSec]

Ah ok, so the allow list is a mandatory setting - not optional.
this did the trick. Thx @Habbie 👍

[Habbie]

the commented version is also the default value, yes. You're welcome :)