Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an EC2 micro instance running with the Amazon linux. I installed bind and set up an entry for a certain domain, and it works fine if you are on that server and type:

nslookup localhost

but I can't get to it from external servers by typing


In my security group, I set it to allow incoming traffic on port 53 (both TCP and UDP) but still, nothing. Anyone know what I am missing?

share|improve this question
should be – BenGC Jul 30 '11 at 20:17
"should be – BenGC 2 hours ago" - actually nope, not in my case. – cocorios Jul 30 '11 at 22:21
I take it you have verified the hostname, the format I have usually seen is: You can get it from curl (run from your instance) [Side note: since AWS DNS names include the IP, the '10' at the start implies a private DNS - just double check that you have the public DNS] – cyberx86 Jul 30 '11 at 22:34
yeah that's my bad. sorry! – BenGC Jul 30 '11 at 23:28
Is bind listening on an interface other than the loopback? For example can you do a lookup against the physical IP address while on the instance, as opposed to against 'localhost'? – user87664 Jul 31 '11 at 0:23
up vote 1 down vote accepted

Check AWS Security Group

Log into the aws management console, click on the EC2 tab, click on Security Groups in Navigation section on the left.

Security Groups is where you manage a virtual firewall for your instances. Has nothing to do with the OS running on the instance.

At one time you were restricted to changing security groups that were not assigned. Now you can make changes to groups assigned to live instances and they will be applied immediately.

Check Bind Configuration

By default, bind only listens on Make sure you are listening on all interfaces. Edit /etc/named.conf, change appropriate line to:

listen-on port 53 { any; };

Then restart the service.

service named restart

To confirm named is listening to "everything", use netstat like so.

[root@...]# netstat -nlp | grep named
tcp        0      0  *                   LISTEN      8664/named
tcp        0      0   *                   LISTEN      8664/named
tcp        0      0  *                   LISTEN      8664/named
tcp        0      0 ::1:953                  :::*                        LISTEN      8664/named
udp        0      0  *                               8664/named
udp        0      0   *                               8664/named

Look for named listening on the network accessible interfaces (in this case

share|improve this answer
Yeah, I actually did that too, created another instance in case the security groups update didn't take effect if you did it AFTER launching an instance, but still no luck. I guess I wasn't clear on that too, but the first thing I did to try and make this work was add port 53 TCP and UDP to my security group, but it didn't do anything (I did do this for port 80 the other day on a different instance and it worked, so I know what I'm SUPPOSED to be doing in there) – cocorios Jul 31 '11 at 2:04
I just tested this out on a fresh instance with a restricted security group. Installed and started dnsmasq, added dns ports to the security group and it worked immediately from a remote (non-aws) system. Sounds more like a bind configuration problem. – h0tw1r3 Jul 31 '11 at 5:16
Tested bind myself, worked fine but I did need to change the default configuration. Updated answer to reflect things to check. – h0tw1r3 Jul 31 '11 at 5:34

Check for firewalls which may be blocking the port(s).

share|improve this answer
Firewalls where though? I don't think EC2 has any installed by default in their linux distro – cocorios Jul 30 '11 at 20:20
Start with the local instance with a test against the loopback ( address for access. – user48838 Jul 30 '11 at 20:24
I can do an nslookup while logged into the instance if I just type: nslookup localhost – cocorios Jul 30 '11 at 22:11
How about a telnet to port 53 of the system from another EC2 instance (possibly in addition to what h0w1r3 has identified) - which is working/troubleshooting outward from the system? – user48838 Jul 31 '11 at 0:44
Yeah, telnetting to it does not work, either from a differnet EC2 instance or a whole non-Amazon server. I also tried using the internal hostname from the other EC2 instance, same thing, no dice. If I telnet to localhost on the actual machine I am talking about, I do get connected on port 53 though. – cocorios Jul 31 '11 at 2:08

Check to see if you have an firewall rules that may be blocking you DNS server.

sudo iptables -L -v

If you get any output check to see if you are allowing input on port 53 in this format it would be something like

102 11468 ACCEPT   udp  --  any  any   anywhere           anywhere       udp dpt:domain
 20  1013 ACCEPT   tcp  --  any  any   anywhere           anywhere       tcp dpt:domain

If you need to enable port 53 then you can do this like so

sudo /sbin/iptables -I INPUT -p udp -m udp --dport 53 -j ACCEPT
sudo /sbin/iptables -I INPUT -p tcp -m tcp --dport 53 -j ACCEPT
share|improve this answer
Thanks, I tried that, but no luck so far, nothing showed up in iptables, but I ran those commands anyway and it shows the proper lines for those 2 rules now, but still nothing doing, can't connect – cocorios Jul 30 '11 at 22:10

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.