DNS Problem (BIND)

**d45h** · 12-31-2009, 11:19 PM

I'm completely stumped. Here's the issue. I have a Gentoo server running Apache and BIND v9.x. I have two NIC's, one for my public address, a bridged connection with a static IP, and one for the local network. BIND is working on the internal network (192.168.0.1/24) just fine. So is Apache. I have configured iptables to allow udp/tcp traffic on port 53, and BIND is listening on all interfaces on port 53. I can telnet to port 53 over the internet just fine, and the connection shows up in netstat's output on the server (netstat ran via ssh). I can even see that port 53 is open when I NMAP the public IP. The public view in the BIND config seems to be working just fine if I query from the localhost (via ssh). But if I use nslookup, or dig and use the public IP as the nameserver, the connection times out and the reply is "no servers could be reached". HELP!?

**d45h** · 12-31-2009, 11:57 PM

Here is the bind configuration:

options {
directory "/var/bind";
pid-file "/var/run/named/named.pid";
allow-transfer { none; };
listen-on port 53 { any; };
};

logging {
channel log {
file "/var/log/named/named.log" versions 3 size 5m;
severity dynamic;
print-time yes;
print-severity yes;
print-category yes;
};

category default { log; };
category general { log; };
category config { log; };
category queries { log; };
category network { log; };
category notify { log; };
};

view "private" {
match-clients { 127.0.0.1; 192.168.0.1/24; };
recursion yes;

zone "." IN {
type hint;
file "named.ca";
};

zone "localhost" IN {
type master;
file "pri/localhost.zone";
allow-update { none; };
notify no;
};

zone "127.in-addr.arpa" IN {
type master;
file "pri/localhost-rev.zone";
allow-update { none; };
notify no;
};

zone "d45h.net" IN {
type master;
file "pri/private.zone";
allow-update { none; };
notify no;
};

zone "0.168.192.in-addr.arpa" IN {
type master;
file "pri/private-rev.zone";
allow-update { none; };
notify no;
};
};

view "public" {
match-clients { any; };
match-destinations { any; };
recursion no;

zone "d45h.net" {
type master;
file "pri/public.zone";
allow-query { any; };
allow-update { none; };
notify no;
};

zone "45.79.64.in-addr.arpa" IN {
type master;
file "pri/public-rev.zone";
allow-query { any; };
allow-update { none; };
};
};

**peter** · 01-01-2010, 01:43 AM

Does this happen when you try it from a machine / host on the internet?

Do you have iptables set to log all denied traffic? You should. What do the logs show on udp/tcp port 53 when this fails?

**peter** · 01-01-2010, 01:43 AM

BTW, welcome to the forums!

**d45h** · 01-01-2010, 02:04 AM

Thank You!

Yes this error occurs when trying to use nslookup from a computer on the internet, or a remote host of any kind.

I'm not all that familiar with the details of iptables. I'm not sure I have logging enabled. I'll do some looking and try to get that working.

The funny part is that I get the same error even if I disable iptables completely.

**peter** · 01-01-2010, 04:00 AM

What happens when you do something like this with the external view?

Code:

match-clients      { !localnets; !localhost; !safe-subnet; any;};

and do the query externally from the internet?

Based on this DNS configuration example?

**d45h** · 01-01-2010, 07:42 AM

No dice. In fact the !safe-subnet argument broke the config all together. I guess my version of BIND doesn't support that.

**peter** · 01-01-2010, 01:50 PM

Sorry, the !safe-subnet was taken literally from the page. So it didn't work then with the others?

**d45h** · 01-01-2010, 06:45 PM

Yeah I tried it with the other arguments, and it still timed out.

**d45h** · 01-04-2010, 01:54 AM

I installed wireshark on the server and set up a packet capture for anything coming in on port 53. When I use nmap from a remote host to the public, external IP of the server, I get hits on the packet capture. So connectivity on port 53 is working, or so it would seem. When I try dig @ip_of_server, nothing shows up on the packet capture. Anyone have any ideas?