LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 02-23-2017, 03:21 PM   #1
Carinavb
LQ Newbie
 
Registered: Dec 2015
Posts: 6

Rep: Reputation: Disabled
Bind9 not working reverse zone


Hello everybody, I recently change my OS to debian jessie and I can't make the server work properly.
/etc/resolv.conf
================
nameserver xxx.yyy.zzz.2
nameserver 8.8.8.8
nameserver 8.8.4.4

hosts
======
/hosts
127.0.0.1 localhost
xxx.yyy.zzz.2 ns1.midominio.com ns1

named.conf.local
================
include "/etc/bind/named.conf.log";
//JUJUYTEL
//directa

zone "midominio.com" IN {
type master;
file "/etc/bind/directa/midominio.com1";
allow-query { any; };
};

//reversa
zone "zzz.yyy.xxx.IN-ADDR.ARPA" {
type master;
file "/etc/bind/midominio.com.reversa";
allow-query { any; };
};

//WEBMAIL
//directa

zone "webmail.midominio.com" IN {
type master;
file "/etc/bind/webmail.midominio.com";
allow-query { any; };
};

//MAIL
//directa

zone "mail.midominio.com" IN {
type master;
file "/etc/bind/mail.midominio.com";
allow-query { any; };
};

named.conf.options
==================

options {
directory "/var/cache/bind";
forwarders {
8.8.8.8;
};

version "No version";
auth-nxdomain no; # conform to RFC1035
allow-query { any; };
rate-limit {
responses-per-second 10;

};
};

zone midominio.com
====================
$ORIGIN midominio.com.
$TTL 1W
@ IN SOA ns1.midominio.com. root.ns1.midominio.com. (
2017022005 ; Serial
3600 ; Refresh
300 ; Retry
1209600 ; Expire
3600 ; Minimum
)

IN NS ns1.midominio.com.
IN NS web.midominio.com.
IN NS ns1.arnet.com.ar.
IN NS ns2.arnet.com.ar.
IN MX 0 mail.midominio.com.
;--------------------------------------------------------------
localhost IN A 127.0.0.1

ns1 IN A xxx.yyy.zzz.2
IN HINFO DNS Server

web IN A xxx.yyy.zzz.5
IN HINFO Web Server

mail IN A xxx.yyy.zzz.6
IN HINFO Mail Server


www IN CNAME web.midominio.com.
webmail IN CNAME mail.midominio.com.
proxy IN CNAME ns1.midominio.com.

reverse zone
============
;
; BIND reverse data file for local loopback interface
;
$TTL 604800
@ IN SOA ns1.midominio.com. root.midominio.com. (
2017022002 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
;
@ IN NS ns1.midominio.com.
2 IN PTR ns1.midominio.com.
5 IN PTR web.midominio.com.
6 IN PTR mail.midominio.com.


I get this error
============
nslookup
> xxx.yyy.zzz.2
;; Got SERVFAIL reply from xxx.yyy.zzz.2, trying next server
;; Got SERVFAIL reply from 8.8.8.8, trying next server
Server: 8.8.4.4
Address: 8.8.4.4#53

** server can't find 2.zzz.yyy.xxx.in-addr.arpa: SERVFAIL

I hope someone can guide me with this.
Best regards.
 
Old 02-24-2017, 02:00 AM   #2
bathory
LQ Guru
 
Registered: Jun 2004
Location: Piraeus
Distribution: Slackware
Posts: 12,700

Rep: Reputation: 1823Reputation: 1823Reputation: 1823Reputation: 1823Reputation: 1823Reputation: 1823Reputation: 1823Reputation: 1823Reputation: 1823Reputation: 1823Reputation: 1823
Quote:
Hello everybody, I recently change my OS to debian jessie and I can't make the server work properly.
You mean that previously it was working? If that's the case review the steps you've taken to (re)configure bind and/or take a look at named logs.


Quote:
I get this error
============
nslookup
> xxx.yyy.zzz.2
;; Got SERVFAIL reply from xxx.yyy.zzz.2, trying next server
<-snip->
The SERVFAIL could happen because a variety of reasons. You can check the reverse zonefile to see if there is an error:
Code:
named-checkzone zzz.yyy.xxx.IN-ADDR.ARPA /etc/bind/midominio.com.reversa
 
Old 02-24-2017, 06:28 AM   #3
Carinavb
LQ Newbie
 
Registered: Dec 2015
Posts: 6

Original Poster
Rep: Reputation: Disabled
Bathory thanks foy your reply, I found the error.
I have comments in my named.conf.local, I delete those lines and worked again.
Thanks a lot.
I have another issue, in my named.conf.option change recursion to NO, but now I get Status REFUSED.
I have another question.
I have a different domain that I need to delegate, how I can do that?
Thanks

Best Regards

Last edited by Carinavb; 02-24-2017 at 06:37 AM.
 
Old 02-24-2017, 07:06 AM   #4
bathory
LQ Guru
 
Registered: Jun 2004
Location: Piraeus
Distribution: Slackware
Posts: 12,700

Rep: Reputation: 1823Reputation: 1823Reputation: 1823Reputation: 1823Reputation: 1823Reputation: 1823Reputation: 1823Reputation: 1823Reputation: 1823Reputation: 1823Reputation: 1823
Quote:
I have another issue, in my named.conf.option change recursion to NO, but now I get Status REFUSED.
This is not because of "recursion no", but rather that you have a "allow-query..." or similar option where you didn't add the host that gets the "REFUSED" error.


Quote:
I have a different domain that I need to delegate, how I can do that?
I'm not sure I understand what you're saying,
If you want to add a new domain (zone) for your dns to be authoritative of, just add the zone definition in named.conf and create the zonefile of the zone in question.
If that's not what you're trying to do, please elaborate.

Regards
 
Old 02-24-2017, 07:16 AM   #5
Carinavb
LQ Newbie
 
Registered: Dec 2015
Posts: 6

Original Poster
Rep: Reputation: Disabled
My named.conf.option is...

directory "/var/cache/bind";
forwarders {
8.8.8.8;
};

//recursion no;
auth-nxdomain no; # conform to RFC1035
allow-query { any; };
rate-limit {
responses-per-second 10;
};
 
Old 02-24-2017, 07:55 AM   #6
bathory
LQ Guru
 
Registered: Jun 2004
Location: Piraeus
Distribution: Slackware
Posts: 12,700

Rep: Reputation: 1823Reputation: 1823Reputation: 1823Reputation: 1823Reputation: 1823Reputation: 1823Reputation: 1823Reputation: 1823Reputation: 1823Reputation: 1823Reputation: 1823
Quote:
Originally Posted by Carinavb View Post
My named.conf.option is...

directory "/var/cache/bind";
forwarders {
8.8.8.8;
};

//recursion no;
auth-nxdomain no; # conform to RFC1035
allow-query { any; };
rate-limit {
responses-per-second 10;
};
Maybe you have another "allow-query" statement in a different config file that does not have the "any" keyword, resulting in the REFUSED error. Could you please post the output of the next command (masking sensitive data)
Code:
dig midominio.com @ns1.midominio.com
BTW you don't need forwarders as you're running an authoritative nameserver
 
Old 03-01-2017, 01:27 PM   #7
Carinavb
LQ Newbie
 
Registered: Dec 2015
Posts: 6

Original Poster
Rep: Reputation: Disabled
Bathory, here is what you ask...

dig midominio.com @ns1.midominio.com

; <<>> DiG 9.9.5-9+deb8u9-Debian <<>> midominio.com @ns1.midominio.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43297
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;midominio.com. IN A

;; AUTHORITY SECTION:
midominio.com. 3600 IN SOA ns1.midominio.com. root.ns1.midominio.com. 2017024005 3600 300 1209600 3600

;; Query time: 0 msec
;; SERVER: xxx.yyy.zzz.2#53(xxx.yyy.zzz.2)
;; WHEN: Wed Mar 01 16:24:17 ART 2017
;; MSG SIZE rcvd: 92


With nslookyp I get this...
root@ns1:/etc/bind# nslookup midominio.com
Server: xxx.yyy.zzz.2
Address: xxx.yyy.zzz.2#53


*** Can't find midominio.com: No answer


root@ns1:/etc/bind# nslookup www.midominio.com
Server: xxx.yyy.zzz.2
Address: xxx.yyy.zzz.2#53


www.midominio.com canonical name = midominio.com.

I still have something wrong.

I change my named.conf.option file commenting forwarders and uncomment recursion like this...

options {
directory "/var/cache/bind";

// If there is a firewall between you and nameservers you want
// to talk to, you may need to fix the firewall to allow multiple
// ports to talk. See http://www.kb.cert.org/vuls/id/800113

// If your ISP provided one or more IP addresses for stable
// nameservers, you probably want to use them as forwarders.
// Uncomment the following block, and insert the addresses replacing
// the all-0's placeholder.

// forwarders {
// 8.8.8.8;
// };

//========================================================================
// If BIND logs error messages about the root key being expired,
// you will need to update your keys. See https://www.isc.org/bind-keys
//========================================================================
//dnssec-validation no;
recursion no;
auth-nxdomain no; # conform to RFC1035
allow-query { any; };
//listen-on-v6 { any; };
rate-limit {
responses-per-second 10;
// log-only yes; //comentar
};
};

But I get this error.... REFUSED

01-Mar-2017 16:35:39.662 query-errors: info: client aaa.bbb.ccc.123#17529 (clients4.google.com): rate limit drop REFUSED error response to aaa.bbb.ccc.0/24
01-Mar-2017 16:35:39.704 query-errors: info: client aaa.bbb.ccc.90#61512 (emupdate.avcdn.net): rate limit slip REFUSED error response to aaa.bbb.ccc.0/24
01-Mar-2017 16:35:39.837 query-errors: info: client aaa.bbb.ccc.130#14852 (www.facebook.com): rate limit drop REFUSED error response to aaa.bbb.ccc.0/24
01-Mar-2017 16:35:39.906 query-errors: info: client aaa.bbb.ccc.16#24348 (graph2.facebook.com): rate limit slip REFUSED error response to aaa.bbb.ccc.0/24
01-Mar-2017 16:35:39.982 rate-limit: info: limit REFUSED error responses to 192.168.20.0/24
01-Mar-2017 16:35:39.982 query-errors: info: client 192.168.20.151#23499 (apis.google.com): rate limit slip REFUSED error response to 192.168.20.0/24
01-Mar-2017 16:35:40.160 query-errors: info: client aaa.bbb.ccc.130#14852 (www.google.com.ar): rate limit drop REFUSED error response to aaa.bbb.ccc.0/24
01-Mar-2017 16:35:40.233 query-errors: info: client aaa.bbb.ccc.179#26182 (connectivitycheck.android.com): rate limit slip REFUSED error response to aaa.bbb.ccc.0/24
01-Mar-2017 16:35:40.238 query-errors: info: client aaa.bbb.ccc.179#26184 (connectivitycheck.android.com): rate limit drop REFUSED error response to aaa.bbb.ccc.0/24
01-Mar-2017 16:35:40.307 query-errors: info: client aaa.bbb.ccc.211#15764 (a.root-servers.net): rate limit slip REFUSED error response to aaa.bbb.ccc.0/24

Last edited by Carinavb; 03-01-2017 at 01:42 PM. Reason: missing log output
 
Old 03-02-2017, 02:16 AM   #8
bathory
LQ Guru
 
Registered: Jun 2004
Location: Piraeus
Distribution: Slackware
Posts: 12,700

Rep: Reputation: 1823Reputation: 1823Reputation: 1823Reputation: 1823Reputation: 1823Reputation: 1823Reputation: 1823Reputation: 1823Reputation: 1823Reputation: 1823Reputation: 1823
Quote:
dig midominio.com @ns1.midominio.com

; <<>> DiG 9.9.5-9+deb8u9-Debian <<>> midominio.com @ns1.midominio.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43297
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
<-snip->
This is because you don't have a RR for midominio.com. Add in the zonefile
Code:
midominio.com. IN A xxx.yyy.zzz.2
increase the serial, reload zone and test.


Quote:
But I get this error.... REFUSED
You need to allow recursion for your clients (hosts, networks).
So in named.conf use:
Code:
//recursion no;
allow-recursion {xxx.yyy.zzz.2; aa.bbb.ccc.0/24;};
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Bind9 zone transfer not working on Centos 7 to another name server - really stuck hcape Linux - Networking 3 11-17-2016 11:23 PM
Reverse DNS on LAN using bind9 not working bennetfox Linux - Networking 5 02-02-2013 03:49 PM
DNS reverse zone delgation work in BIND8 but not BIND9 nixlayman Linux - Networking 1 04-03-2012 03:26 PM
bind9 reverse zone alkingg Linux - Server 7 02-25-2011 09:36 AM
BIND forward zone working reverse not working n03x3c Linux - Server 1 07-03-2010 04:52 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 09:06 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration