DNS Internal/External Views

dansdionne · 07-18-2015, 09:20 AM

Hello everyone,

I am hoping someone can help me get my DNS working on my Ubuntu Server 12.10 system. It was working yesterday, and I reconfigured to use internal and external views in an attempt to be able to access my server from it's FQDN from internal machines instead of having to type the internal IP of the server.

Now, when I ping, dig, or nslookup, I recieve:

Quote:

dig google.com
connection timed out; no servers could be reached

When I restart bind, there are no errors. I looked at the system log and it loaded the internal and external views correctly, shown below, where hostname.myftp.org is the FQDN of my server that I want to be able to resolve internally (I replaced the actual host name with hostname for this post).

Quote:

received control channel command 'stop -p'
shutting down: flushing changes
stopping command channel on 127.0.0.1#953
exiting
zone hostname.myftp.org/IN/internal: loaded serial 1
managed-keys-zone ./IN/internal: loaded serial 4
zone 0.in-addr.arpa/IN/external: loaded serial 1
zone 10.in-addr.arpa/IN/external: loaded serial 1
zone 127.in-addr.arpa/IN/external: loaded serial 2
zone 16.172.in-addr.arpa/IN/external: loaded serial 1
zone 17.172.in-addr.arpa/IN/external: loaded serial 1
zone 18.172.in-addr.arpa/IN/external: loaded serial 1
zone 19.172.in-addr.arpa/IN/external: loaded serial 1
zone 20.172.in-addr.arpa/IN/external: loaded serial 1
zone 21.172.in-addr.arpa/IN/external: loaded serial 1
zone 22.172.in-addr.arpa/IN/external: loaded serial 1
zone 23.172.in-addr.arpa/IN/external: loaded serial 1
zone 24.172.in-addr.arpa/IN/external: loaded serial 1
zone 25.172.in-addr.arpa/IN/external: loaded serial 1
zone 26.172.in-addr.arpa/IN/external: loaded serial 1
zone 27.172.in-addr.arpa/IN/external: loaded serial 1
zone 28.172.in-addr.arpa/IN/external: loaded serial 1
zone 29.172.in-addr.arpa/IN/external: loaded serial 1
zone 30.172.in-addr.arpa/IN/external: loaded serial 1
zone 31.172.in-addr.arpa/IN/external: loaded serial 1
zone 255.in-addr.arpa/IN/external: loaded serial 1
zone localhost/IN/external: loaded serial 2
zone hostname.myftp.org/IN/external: loaded serial 1
managed-keys-zone ./IN/external: loaded serial 4
running

Here is my named.conf.local file: I have commented out the default zones in the internal view while debugging. It is not working with or without the default zones in the internal view.

Quote:

//
// Do any local configuration here
//

acl internals { 192.168.1.0/24; 127.0.0.0/8; };

view "internal" {
match-clients { internals; };
allow-recursion { any; };
zone "hostname.myftp.org" {
type master;
notify no;
file "/etc/bind/internals/db.hostname.myftp.org";
};
// zone "1.168.192.in-addr.arpa" {
// type master;
// file "/etc/bind/internals/db.192.168.1";
// };
// zone "." {
// type hint;
// file "/etc/bind/db.root";
// };
// zone "localhost" {
// type master;
// file "/etc/bind/db.local";
// };
// zone "127.in-addr.arpa" {
// type master;
// file "/etc/bind/db.127";
// };
// zone "0.in-addr.arpa" {
// type master;
// file "/etc/bind/db.0";
// };
// zone "255.in-addr.arpa" {
// type master;
// file "/etc/bind/db.255";
// };
// // Consider adding the 1918 zones here, if they are not used in your
// // organization
// include "/etc/bind/zones.rfc1918";
};

view "external" {
match-clients { any; };
recursion no;
zone "hostname.myftp.org" {
type master;
file "/etc/bind/externals/db.hostname.myftp.org";
};
zone "." {
type hint;
file "/etc/bind/db.root";
};
zone "localhost" {
type master;
file "/etc/bind/db.local";
};
zone "127.in-addr.arpa" {
type master;
file "/etc/bind/db.127";
};
zone "0.in-addr.arpa" {
type master;
file "/etc/bind/db.0";
};
zone "255.in-addr.arpa" {
type master;
file "/etc/bind/db.255";
};
// Consider adding the 1918 zones here, if they are not used in your
// organization
include "/etc/bind/zones.rfc1918";
};

bathory · 07-18-2015, 12:14 PM

Quote:

connection timed out; no servers could be reached

Check /etc/resolv.conf to see if you have the correct name server(s) listed

Regards

dansdionne · 07-18-2015, 04:17 PM

Hi bathory, thanks for your reply.

This is the contents of my /etc/resolv.conf:

Quote:

# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
# DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 8.8.8.8

berndbausch · 07-18-2015, 05:56 PM

In other words, you don't use your own nameserver?

By the way, use code tags, not quote tags, when posting the content of a config file.

bathory · 07-19-2015, 02:12 AM

Quote:

Originally Posted by dansdionne

Hi bathory, thanks for your reply.

This is the contents of my /etc/resolv.conf:
# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
# DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 8.8.8.8

As berndbausch said, you're not using your dns, but google's. But even that is not accessible, so you should check your connectivity.
To test your dns, you can use:

Code:

dig google.com @x.x.x.x

where x.x.x.x is your server IP/

BTW if you want to use your own nameserver(s) in /etc/resolv/conf, have a look here

Regards

dansdionne · 07-19-2015, 09:25 AM

Quote:

Originally Posted by berndbausch

In other words, you don't use your own nameserver?

By the way, use code tags, not quote tags, when posting the content of a config file.

I guess I wasn't. I fixed that. Thanks for the tip.

Quote:

Originally Posted by bathory

But even that is not accessible, so you should check your connectivity.

The more I thought about it yesterday, I came to the same conclusion. I can't figure out why I am not connected. When I ping google.com, I get:

Quote:

ping: unknown host google.com

I am currently connected to a router, which is connected to a cable modem/router combo. The modem/router has internal IPs 10.0.0.1 through 10.0.0.252. The router is assigned 10.0.0.2. The router has internal IPs 192.168.1.1 through 192.168.1.149. My pc is wirelessly connected to the router with a static IP of 192.168.1.141. My server (web/dns) is wired to the router with a static IP 192.186.1.140.

This setup was working friday night, and everything had connectivity. On Friday night I started enabling port forwarding (modem to router, router to server) and switched my DNS to use split views (internal and external). Now I can't figure out why the server is not connected.

Here is my /etc/network/interfaces file:

Code:

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto eth0
iface eth0 inet static
address 192.168.1.140
netmask 255.255.255.0
gateway 192.168.1.1
dns-nameservers 192.168.1.140

resolv.conf was listing 8.8.8.8 because I listed 8.8.8.8 in /etc/network/interfaces, so I switched that before I saw your reply, bathory, and now resolv.conf shows 192.168.1.140.

And when I type ifconfig:

Quote:

eth0 Link encap:Ethernet HWaddr xx:xx:xx:xx:xx:xx
inet addr:192.168.1.140 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: xxxx::xxxx:xxxx:xxxx:xxxx/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:665 errors:0 dropped:0 overruns:0 frame:0
TX packets:1691 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:132527 (132.5 KB) TX bytes:200636 (200.6 KB)

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:1348 errors:0 dropped:0 overruns:0 frame:0
TX packets:1348 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:305649 (305.6 KB) TX bytes:305649 (305.6 KB)

Thanks for your help with this, it is appreciated.

Dan

berndbausch · 07-19-2015, 11:24 AM

You can't ping google.com because you have no name resolution. Can you ping 8.8.8.8 (probably not, otherwise you would have had name resolution earlier)? And 192.168.1.1? And 10.0.0.2?
I guess your wireless PC has internet access.
What happens if you undo port forwarding?

lazydog · 07-19-2015, 02:05 PM

First things first, ensure that you have internet connectivity and your route is setup correctly;

Code:

route -n

Make sure you have something along these lines

Code:

$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.1    0.0.0.0         UG    100    0        0 eth0
192.168.1.0    0.0.0.0         255.255.255.0   U     0      0        0 eth0
192.168.1.0    0.0.0.0         255.255.255.0   U     202    0        0 eth0
$

dansdionne · 07-19-2015, 05:37 PM

Quote:

Originally Posted by berndbausch

Can you ping 8.8.8.8 (probably not, otherwise you would have had name resolution earlier)? And 192.168.1.1? And 10.0.0.2?
I guess your wireless PC has internet access.
What happens if you undo port forwarding?

Port forwarding is disabled, and still no connection.

When I ping 8.8.8.8, 192.168.1.1, and 10.0.0.2 the output is:

Quote:

PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.

and there is no other output.

Quote:

Originally Posted by lazydog

First things first, ensure that you have internet connectivity and your route is setup correctly;

The output of route -n is:

Code:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG    0      0        0 eth0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0

lazydog · 07-20-2015, 12:23 PM

Now can you ping yourself 192.168.1.140?

lazydog · 07-20-2015, 12:29 PM

Quote:

Originally Posted by dansdionne

This setup was working friday night, and everything had connectivity. On Friday night I started enabling port forwarding (modem to router, router to server) and switched my DNS to use split views (internal and external). Now I can't figure out why the server is not connected.

Have you completely backed out all the changes you did on the routers? I'm beginning to think something you done with the port forwarding is the reason it isn't working any more.

dansdionne · 07-20-2015, 05:42 PM

Quote:

Originally Posted by lazydog

Now can you ping yourself 192.168.1.140?

Yes, I can ping myself

Finally, some progress.

Quote:

Originally Posted by lazydog

Have you completely backed out all the changes you did on the routers? I'm beginning to think something you done with the port forwarding is the reason it isn't working any more.

I have disabled all port forwarding on both the modem and the router. The only thing I hadn't backed out is static IP assignments for my server and pc on the router. Let me try.... It worked! I removed the static IP assignment for the server and now I can ping 8.8.8.8, google.com, and anything else. Any ideas why that might be causing a problem?

Now I can finally start debugging my split view DNS. It doesn't resolve my FQDN internally yet, but I don't have any specific questions about it yet. When I do, I will post here! If I figure it out on my own, I will be sure to update the thread with my solution as well.

Thanks for all of your help!

-Dan

dansdionne · 07-20-2015, 05:52 PM

When I dig hostname.myftp.org, I get:

Quote:

; <<>> DiG 9.8.1-P1 <<>> hostname.myftp.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27673
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;hostname.myftp.org. IN A

;; AUTHORITY SECTION:
hostname.myftp.org. 86400 IN SOA ns.hostname.myftp.org. hostname.gmail.com. 1 28800 7200 2419200 86400

;; Query time: 0 msec
;; SERVER: 192.168.1.140#53(192.168.1.140)
;; WHEN: Mon Jul 20 18:46:25 2015
;; MSG SIZE rcvd: 94

When I nslookup hostname.myftp.org, I get:

Quote:

root@server:~# nslookup hostname.myftp.org
Server: 192.168.1.140
Address: 192.168.1.140#53

*** Can't find hostname.myftp.org: No answer

And when I ping it:

Quote:

root@server:~# ping hostname.myftp.org
ping: unknown host hostname.myftp.org

berndbausch · 07-20-2015, 10:28 PM

Quote:

Originally Posted by dansdionne

When I dig hostname.myftp.org, I get:

When I nslookup hostname.myftp.org, I get:

And when I ping it:

dig returns your SOA record.
Since you have no A record for hostname.myftp.org, nslookup returns nothing and ping fails.

While your code is quite readable, use code tags around it instead of quote tags.

dansdionne · 07-21-2015, 10:15 AM

Quote:

Originally Posted by berndbausch

dig returns your SOA record.
Since you have no A record for hostname.myftp.org, nslookup returns nothing and ping fails.

I am at work, so I can't test this, but should my SOA read "ns.myftp.org" instead of "ns.hostname.myftp.org", with A records:

Code:

ns          IN  A      192.168.1.140
hostname    IN  A      192.168.1.140

I don't need to resolve any other hosts at myftp.org.