[SOLVED] Bind9 only works local

Hmail · 02-20-2016, 12:28 PM

Hi all,

I am a bit new in this territory, so this is probably an easy issue, but I want to get some knowledge in this area.

I have configured a VPS with Bind as an authoritative DNS server. I have configured one zone, vpsnu.nl, and if I check it on the local machine, I get the proper response with the IP address I configured.

However, once I try to do the same from my home computer, I get an error. This is what happens on the VPS:

Code:

> vpsnu.nl
Server:         127.0.0.1
Address:        127.0.0.1#53

Name:   vpsnu.nl
Address: 95.211.172.130

And this is what happens locally:

Code:

> server ns1.hjts.nl
Default server: ns1.hjts.nl
Address: 95.211.172.130#53
> vpsnu.nl
;; connection timed out; no servers could be reached

When I try to get the a record on mxtoolbox.com, the server reports: "Loop detected! We were referred back to '95.211.172.130'"
Now the IP for the domain and the IP for the nameserver are the same, but is that a problem? And if so, why?

This is my configuration, named.conf.options:

Code:

options {
        directory "/var/cache/bind";
        recursion no;
        allow-transfer { none; };
        listen-on { any; };
        listen-on-v6 { any; };
        allow-query { any; };
};

named.conf.local:

Code:

zone "vpsnu.nl" {
        type master;
        file "/etc/bind/zones/db.vpsnu.nl";
};

and /etc/bind/zones/db.vpsnu.nl:

Code:

;
; BIND data file for local loopback interface
;
$TTL    86400
@       IN      SOA     ns1.hjts.nl. my.email.com. (
                     2015022002         ; Serial
                           3600         ; Refresh
                            900         ; Retry
                        1209600         ; Expire
                           1800 )       ; Negative Cache TTL

; Name servers
        IN      NS      ns1.hjts.nl.    ; master
        IN      NS      ns2.hjts.nl.    ; slave

; A records
@       IN      A       95.211.172.130
www     IN      A       95.211.172.130

If I'm doing something horribly wrong, please let me know, I really want to understand this.

bathory · 02-20-2016, 03:55 PM

Quote:

dig vpsnu.nl @95.211.172.130 +tcp

; <<>> DiG 9.10.3-P3 <<>> vpsnu.nl @95.211.172.130 +tcp
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7500
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;vpsnu.nl. IN A

;; ANSWER SECTION:
vpsnu.nl. 86400 IN A 95.211.172.130

;; AUTHORITY SECTION:
vpsnu.nl. 86400 IN NS ns2.hjts.nl.
vpsnu.nl. 86400 IN NS ns1.hjts.nl.

;; Query time: 80 msec
;; SERVER: 95.211.172.130#53(95.211.172.130)
;; WHEN: Sat Feb 20 23:53:12 EET 2016
;; MSG SIZE rcvd: 94

It works using tcp, so you need to open port 53 udp on your server firewall

Regards

Hmail · 02-21-2016, 03:34 AM

I knew it should be something simple..
You are right, UDP wasn't even forwarded and probably responding as a DNS resolver for the hosts behind the firewall. I moved the DNS resolver to another machine and indeed, (as I should have known) forwarded both TCP and UDP to this nameserver and everything works as it should.

Thanks a lot!