0

Basically,

I'm attempting to set up a DNS server that points to two other internal DNS servers.

Internal DNS servers: 192.168.0.4 // 192.168.0.5 My box: 192.168.97.6 .. name is kerrigan.zipp

I've got bind configured and clients can hit internal addresses but can't seem to grab anything external.

[root@zeratul ~]# ping kerrigan.zipp
-- Ping succeeds --

[root@zeratul ~]# ping google.com
ping: unknown host google.com

In doing a tcpdump on Kerrigan.zipp, I can see that the request for google.com is being made to dns1 (192.168.0.4) and a reply is coming back.

15:30:37.775949 IP kerrigan.zipp.50825 > dns1.internal.box.domain: 13756+ A? google.com. (28)
15:30:37.776383 IP dns1.internal.box.domain > kerrigan.zipp.50825: 13756 4/13/8 A 72.14.204.99, A 72.14.204.103, A 72.14.204.104, A 72.14.204.147 (491)

It appears as though kerrigan.zipp is getting the replies and then not doing anything with them. If I take the ip address returned from dns1, I can ping it without a problem.

[root@zeratul ~]# ping 72.14.204.99
-- Ping succeeds --

Any ideas? Oh, and I turned off the firewall just to be sure. Port 53 tcp / udp were open.

Result of the dig commands.. These show that I can get it from my forward DNS but not my new, local DNS:

[root@kerrigan named]# dig @192.168.0.4 google.com

; <<>> DiG 9.7.3-RedHat-9.7.3-1.fc14 <<>> @192.168.0.4 google.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33681
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 13, ADDITIONAL: 8

;; QUESTION SECTION:
;google.com.            IN  A

;; ANSWER SECTION:
google.com.     256 IN  A   72.14.204.104
google.com.     256 IN  A   72.14.204.147
google.com.     256 IN  A   72.14.204.99
google.com.     256 IN  A   72.14.204.103

;; Query time: 1 msec
;; SERVER: 192.168.0.4#53(192.168.0.4)
;; WHEN: Wed Mar  2 16:33:26 2011
;; MSG SIZE  rcvd: 491

[root@kerrigan named]# dig @127.0.0.1 google.com

; <<>> DiG 9.7.3-RedHat-9.7.3-1.fc14 <<>> @127.0.0.1 google.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 61769
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;google.com.            IN  A

;; Query time: 1 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Wed Mar  2 16:33:36 2011
;; MSG SIZE  rcvd: 28
2
  • The all-important bind.conf snippet, showing the world how you've told your local machine's DNS server to forward query resolution off to other DNS servers in the first place, is missing.
    – JdeBP
    Mar 3, 2011 at 3:57
  • You mean these? (/etc/named.conf) forwarders { 192.168.0.4; 192.168.0.5; }; forward only; I set it to 'forward only' for testing. I plan on running it as 'forward first'
    – Zipp
    Mar 3, 2011 at 16:06

3 Answers 3

1

Try using the host command to see what the servers are returning. The command host google.com dns1.internal.box.domain will tell you what dns1.internal.box.domain believes the addresses of google.com are. (Google should have multiple addresses, most sites have one.) Try it with each of your DNS servers.

Also try getent hosts google.com. This will give the resolver's version of addresses for google.com. You should get roughly the same results for all four commands.

EDIT: To run the host command you may need to install the bind9-host package to get the host command. However, it is often installed by other packages.

EDIT2: If one of the DNS servers is not returning a result to you, check its security setting. You may also want to temporarily enable logging on the DNS server. The following is the logging specification block I have used on my bind server.

logging {
        channel query.log {
                file "/var/log/query.log";

                // Set the severity to dynamic to see all the debug messages.
                severity debug 3;
        };

        // Selectively Enable logging
        category default { query.log; };
        category general { query.log; };
        category client { query.log; };
        category unmatched { query.log; };
        category network { query.log; };
        category queries { query.log; };
        category security { query.log; };
        category dispatch { query.log; };
        category delegation-only { query.log; };
};
7
  • I just appended some digs, if you'd like to take a look.
    – Zipp
    Mar 2, 2011 at 21:38
  • @Zipp. I added some bind logging code I used to debug configuration issues.
    – BillThor
    Mar 2, 2011 at 21:52
  • Mar 2 17:32:20 kerrigan named[8138]: received control channel command 'querylog' Mar 2 17:32:20 kerrigan named[8138]: query logging is now on
    – Zipp
    Mar 2, 2011 at 22:33
  • dumping master file: tmp-84AJoGtrui: open: permission denied << This seems odd. Shows up in /var/log/messages
    – Zipp
    Mar 2, 2011 at 22:39
  • Bind needs to be started as root or the file pre-created wit appropriate accesd to enable logging to the specified file. Log level likely duplicates to messages, but it can be more difficult to watch it than a dedicated file.
    – BillThor
    Mar 2, 2011 at 22:42
1

Well, I got it.

/var/log/messages was showing this:

Mar  2 21:35:32 kerrigan named[8138]: error (broken trust chain) resolving 'google.com/A/IN': 192.168.0.4#53

So I figured something was up with dnssec. Previously I had commented them out; I explicitly set them to 'no' in /etc/named.conf

dnssec-enable no;
dnssec-validation no;

My client can hit the interpipes and ping my bind server's master zones. >:3

1

The most common reason for a broken trust chain is that the time on your machine is significantly wrong. The authors of BIND have chosen to switch DNSSEC on by default so it would preferable to fix the time problem rather than turn off DNSSEC. So:

  • Temporarily fix the problem by manually setting the date on the server with date -s or ntpdate <ip-address>
  • If you don't have NTP installed, configured and set start on boot, do that now
  • If you do and your clock is still wrong find out why.

If you've configured your NTP with a time source that accessed by DNS name, and your NTP uses the failing DNS Server for its DNS, then you can end up in unvirtuous circle whereby DNS is failing because the time is wrong, and NTP is failing to correct the time because DNS is failing. For example when I reboot my home Raspberry Pi router I end up with this in /var/log/daemon.log:

Oct 20 05:23:00 pirouter ntpd_intres[579]: host name not found: 2.debian.pool.ntp.org

You could:

  • Add an RTC module if your Pi doesn't have one (they don't by default), allowing it to keep the time while off (cheapest reliable way)
  • Add a GPS time source to your server (very satisfying)
  • Pick a single upstream time source and reference it by IP (which will work as long as that time source keeps it IP)
1
  • Those are great points, but unfortunately this question is five years old. I haven't had to mess with my bind configuration since then.
    – Zipp
    Oct 20, 2016 at 19:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .