LinuxQuestions.org
Latest LQ Deal: Linux Power User Bundle
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices


Reply
  Search this Thread
Old 05-11-2012, 02:04 PM   #1
Rohit_4739
Member
 
Registered: Oct 2010
Distribution: Red Hat
Posts: 228

Rep: Reputation: 9
Split DNS not working with Bind-9.7


Hi All,

Distros of machines : RHEL6
Bind Vesrion : Bind-9.7-3.2

I am trying to set up a test DNS for my home network. I have two rhel 6 machines A and B. Machine A has 2 NICs and is acting as a router also, one NIC is facing intranet and the otehr is facing intranet. On machine A i have configured the DNS server on the internal interface and i am forwarding all the queries from DNS server to another DNS. It works fine when i try to do any name lookup from machine A.

Now there is a machine B which has a private IP configured. From this machine i try to ping the machine A's internal interface IP on which DNS is configured, ping works fine, then i try doing a telnet on the same IP on port 53 and that also works fine. However when i use this internal DNS to do lookup on machine B it never works. I get an error saying

connection timed out, no server could be reached.

Internal IP of machine A : 192.168.30.1
External IP of machine A : 20.198.226.121
IP of machine B : 192.168.30.3

I am pasting my named.conf file
Code:
/*
 Sample named.conf BIND DNS server 'named' configuration file
 for the Red Hat BIND distribution.

 See the BIND Administrator's Reference Manual (ARM) for details, in:
   file:///usr/share/doc/bind-{version}/arm/Bv9ARM.html
 Also see the BIND Configuration GUI : /usr/bin/system-config-bind and
 its manual.
*/

options
{
        // Put files that named is allowed to write in the data/ directory:
        directory               "/var/named";           // "Working" directory
        dump-file               "data/cache_dump.db";
        statistics-file         "data/named_stats.txt";
        memstatistics-file      "data/named_mem_stats.txt";


        /*
          Specify listenning interfaces. You can use list of addresses (';' is
          delimiter) or keywords "any"/"none"
        */
        //listen-on port 53     { any; };
        listen-on port 53       { 127.0.0.1; 192.168.30.1; };

        allow-query             { localhost; };

        // Enable/disable recursion - recursion yes/no;
        recursion yes;
};

logging
{
/*      If you want to enable debugging, eg. using the 'rndc trace' command,
 *      named will try to write the 'named.run' file in the $directory (/var/named).
 *      By default, SELinux policy does not allow named to modify the /var/named directory,
 *      so put the default debug log file in data/ :
 */
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

/*
 Views let a name server answer a DNS query differently depending on who is asking.

 By default, if named.conf contains no "view" clauses, all zones are in the
 "default" view, which matches all clients.

 Views are processed sequentially. The first match is used so the last view should
 match "any" - it's fallback and the most restricted view.

 If named.conf contains any "view" clause, then all zones MUST be in a view.
*/

#view "localhost_resolver"
#{
/* This view sets up named to be a localhost resolver ( caching only nameserver ).
 * If all you want is a caching-only nameserver, then you need only define this view:
 */
#       match-clients           { localhost; };
#       recursion yes;

        # all views must contain the root hints zone:
#       zone "." IN {
#               type hint;
#               file "/var/named/named.ca";
#       };

        /* these are zones that contain definitions for all the localhost
         * names and addresses, as recommended in RFC1912 - these names should
         * not leak to the other nameservers:
         */
#       include "/etc/named.rfc1912.zones";
#};
view "internal"
{
/* This view will contain zones you want to serve only to "internal" clients
   that connect via your directly attached LAN interfaces - "localnets" .
 */
        match-clients           { 192.168.30.0/24; };
        recursion yes;
        forwarders { 20.198.16.155;};
        zone "." IN {
                type hint;
                file "/var/named/named.ca";
        };

        /* these are zones that contain definitions for all the localhost
         * names and addresses, as recommended in RFC1912 - these names should
         * not leak to the other nameservers:
         */
        include "/etc/named.rfc1912.zones";

        // These are your "authoritative" internal zones, and would probably
        // also be included in the "localhost_resolver" view above :

        /*
          NOTE for dynamic DNS zones and secondary zones:

          DO NOT USE SAME FILES IN MULTIPLE VIEWS!

          If you are using views and DDNS/secondary zones it is strongly
          recommended to read FAQ on ISC site (www.isc.org), section
          "Configuration and Setup Questions", questions
          "How do I share a dynamic zone between multiple views?" and
          "How can I make a server a slave for both an internal and an external
           view at the same time?"
        */

#       zone "my.internal.zone" {
#               type master;
#               file "my.internal.zone.db";
#       };
#       zone "my.slave.internal.zone" {
#               type slave;
#               file "slaves/my.slave.internal.zone.db";
#               masters { /* put master nameserver IPs here */ 127.0.0.1; } ;
                // put slave zones in the slaves/ directory so named can update them
#       };
#       zone "my.ddns.internal.zone" {
#               type master;
#               allow-update { key ddns_key; };
#               file "dynamic/my.ddns.internal.zone.db";
                // put dynamically updateable zones in the slaves/ directory so named can update them
#       };
};

#key ddns_key
#{
#       algorithm hmac-md5;
#       secret "use /usr/sbin/dnssec-keygen to generate TSIG keys";
#};

#view "external"
#{
/* This view will contain zones you want to serve only to "external" clients
 * that have addresses that are not match any above view:
 */
#       match-clients           { any; };

#       zone "." IN {
#               type hint;
#               file "/var/named/named.ca";
#       };

#       recursion no;
        // you'd probably want to deny recursion to external clients, so you don't
        // end up providing free DNS service to all takers

        // These are your "authoritative" external zones, and would probably
        // contain entries for just your web and mail servers:

#       zone "my.external.zone" {
#               type master;
#               file "my.external.zone.db";
#       };
#};

/* Trusted keys

  This statement contains DNSSEC keys. If you want DNSSEC aware resolver you
  have to configure at least one trusted key.

  Note that no key written below is valid. Especially root key because root zone
  is not signed yet.
*/
/*
trusted-keys {
// Root Key
"." 257 3 3 "BNY4wrWM1nCfJ+CXd0rVXyYmobt7sEEfK3clRbGaTwSJxrGkxJWoZu6I7PzJu/
             E9gx4UC1zGAHlXKdE4zYIpRhaBKnvcC2U9mZhkdUpd1Vso/HAdjNe8LmMlnzY3
             zy2Xy4klWOADTPzSv9eamj8V18PHGjBLaVtYvk/ln5ZApjYghf+6fElrmLkdaz
             MQ2OCnACR817DF4BBa7UR/beDHyp5iWTXWSi6XmoJLbG9Scqc7l70KDqlvXR3M
             /lUUVRbkeg1IPJSidmK3ZyCllh4XSKbje/45SKucHgnwU5jefMtq66gKodQj+M
             iA21AfUVe7u99WzTLzY3qlxDhxYQQ20FQ97S+LKUTpQcq27R7AT3/V5hRQxScI
             Nqwcz4jYqZD2fQdgxbcDTClU0CRBdiieyLMNzXG3";

// Key for forward zone
example.com. 257 3 5 "AwEAAaxPMcR2x0HbQV4WeZB6oEDX+r0QM65KbhTjrW1ZaARmPhEZZe
                      3Y9ifgEuq7vZ/zGZUdEGNWy+JZzus0lUptwgjGwhUS1558Hb4JKUbb
                      OTcM8pwXlj0EiX3oDFVmjHO444gLkBO UKUf/mC7HvfwYH/Be22GnC
                      lrinKJp1Og4ywzO9WglMk7jbfW33gUKvirTHr25GL7STQUzBb5Usxt
                      8lgnyTUHs1t3JwCY5hKZ6CqFxmAVZP20igTixin/1LcrgX/KMEGd/b
                      iuvF4qJCyduieHukuY3H4XMAcR+xia2 nIUPvm/oyWR8BW/hWdzOvn
                      SCThlHf3xiYleDbt/o1OTQ09A0=";

// Key for reverse zone.
2.0.192.IN-ADDRPA.NET. 257 3 5 "AQOnS4xn/IgOUpBPJ3bogzwcxOdNax071L18QqZnQQQA
                                VVr+iLhGTnNGp3HoWQLUIzKrJVZ3zggy3WwNT6kZo6c0
                                tszYqbtvchmgQC8CzKojM/W16i6MG/ea fGU3siaOdS0
                                yOI6BgPsw+YZdzlYMaIJGf4M4dyoKIhzdZyQ2bYQrjyQ
                                4LB0lC7aOnsMyYKHHYeRv PxjIQXmdqgOJGq+vsevG06
                                zW+1xgYJh9rCIfnm1GX/KMgxLPG2vXTD/RnLX+D3T3UL
                                7HJYHJhAZD5L59VvjSPsZJHeDCUyWYrvPZesZDIRvhDD
                                52SKvbheeTJUm6EhkzytNN2SN96QRk8j/iI8ib";
};
*/
Also logging is also not working properly. I am not getting any useful information in the logs, if you could explain about that too, it would be great.
Please let me know if you would need any information to diagnose the issue better.
 
Old 05-11-2012, 02:37 PM   #2
lithos
Senior Member
 
Registered: Jan 2010
Location: SI : 45.9531, 15.4894
Distribution: CentOS, OpenNA/Trustix, testing desktop openSuse 12.1 /Cinnamon/KDE4.8
Posts: 1,144

Rep: Reputation: 217Reputation: 217Reputation: 217
You don't mention any firewall, but DNS queries happen on UDP port 53 so allow it on your machine A and B (in/out).
Configure your gateway and DNS on your machine B (/etc/sysconfig/network, /etc/resolv.conf - examples 1, 2) pointing to your machine A.

Last edited by lithos; 05-11-2012 at 02:40 PM.
 
Old 05-11-2012, 02:51 PM   #3
Rohit_4739
Member
 
Registered: Oct 2010
Distribution: Red Hat
Posts: 228

Original Poster
Rep: Reputation: 9
Quote:
Originally Posted by lithos View Post
You don't mention any firewall, but DNS queries happen on UDP port 53 so allow it on your machine A and B (in/out).
Configure your gateway and DNS on your machine B (/etc/sysconfig/network, /etc/resolv.conf - examples 1, 2) pointing to your machine A.
Hey Lithos,

Thanks for the response, that was a great catch i missed such a basic thing that it works on UDP. I allowed my firewall to accept connections on port 53 but on TCP, the rule for UPD was not set. I created the rule and it is working now.

Thanks a lot for your reply.
 
Old 05-11-2012, 03:44 PM   #4
lithos
Senior Member
 
Registered: Jan 2010
Location: SI : 45.9531, 15.4894
Distribution: CentOS, OpenNA/Trustix, testing desktop openSuse 12.1 /Cinnamon/KDE4.8
Posts: 1,144

Rep: Reputation: 217Reputation: 217Reputation: 217
Great, I'm glad to read this!

can you please mark the thread as solved then. (please read my signature if you missed where/how)
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
BIND - reverse dns queries only working locally, forward dns works fine. SloS13 Linux - Networking 3 08-25-2011 01:46 PM
Need help with split DNS (bind) on Ubuntu bax Linux - Server 1 11-09-2010 01:21 AM
Bind.DNS Help needed on Split DNS server manya Linux - Server 3 10-28-2010 09:39 AM
BIND 9.3.3 split dns recursion disallow twantrd Linux - Software 2 12-15-2006 07:12 PM
Looking for Split DNS Information using Bind jrbush82 Linux - Networking 2 04-22-2005 09:00 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Server

All times are GMT -5. The time now is 05:03 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration