Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to fix the Bind (named) on CentOS server which only accepts connections from localhost.

My server has local IP 192.168.2.2 and dig works if I run it on same sever where named is installed. But dig executed on backup server which has IP 192.168.2.22 doesn't work.

dig @192.168.2.2 www.mydomain.com # works locally but not on backup server

Both servers are connected to same switch so there are no limits in between. This worked until yesterday when USB key was connected to the server and two module were installed using yum: libmcrypt-2.5.8-4.el5.centos.x86_64 and php-mcrypt-5.1.6-15.el5.centos.1.x86_64. In /var/log/messages I see some logs that I am not familiar with:

Mar 21 18:34:06 centos hald: mounted /dev/sdc1 on behalf of uid 0
Mar 21 18:38:55 centos kernel: ip_tables: (C) 2000-2006 Netfilter Core Team
Mar 21 18:38:55 centos kernel: Netfilter messages via NETLINK v0.30.
Mar 21 18:38:55 centos kernel: ip_conntrack version 2.4 (8192 buckets, 65536 max) - 304 bytes per conntrack
Mar 21 18:38:55 centos kernel: ip6_tables: (C) 2000-2006 Netfilter Core Team
Mar 21 18:38:55 centos kernel: ip6_tables: (C) 2000-2006 Netfilter Core Team
Mar 21 18:43:08 centos kernel: Removing netfilter NETLINK layer.
Mar 21 18:43:08 centos kernel: ip_tables: (C) 2000-2006 Netfilter Core Team

I enabled debug logging in Bind but when I try to query it from backup server there is no sign of connection.

This is the netstat -a output:

tcp        0      0 192.168.2.2:53              0.0.0.0:*                   LISTEN
tcp        0      0 127.0.0.1:53                0.0.0.0:*                   LISTEN
udp        0      0 0.0.0.0:53                  0.0.0.0:*
udp        0      0 192.168.2.2:53              0.0.0.0:*
udp        0      0 127.0.0.1:53                0.0.0.0:*

And part of named.conf

options {
    directory "/var/named";
    query-source address * port 53;
};

controls {
    inet * allow { localhost; } keys { rndckey; };
};

Any help would be appreciated.

share|improve this question
1  
netfilter is the linux firewall, you can check if anything is blocking with "iptables -L" Looking at your netstat output your bind daemon is indeed listening on the normal ip. i suggest checking out the firewall. –  Flash Mar 22 '12 at 8:27
    
Thank you a lot! After stopping iptables service it started to work properly. –  MSF Mar 22 '12 at 8:37

2 Answers 2

up vote 2 down vote accepted

You have something listening on UDP port 53 of 192.168.2.2. Check that you are allowing access to it via your firewall.

iptables -L INPUT -v -n | grep 53

or iptables -L RH-Firewall-1 -v -n | grep 53

Will produce output similar to this

 138K   15M ACCEPT   udp  --  *    *     0.0.0.0/0     0.0.0.0/0       udp dpt:53
  265 13572 ACCEPT   tcp  --  *    *     0.0.0.0/0     0.0.0.0/0       tcp dpt:53

if you are allowing connections. If you are not allowing connections you can do so with

iptables -I INPUT -p udp -m udp --dport 53 -j ACCEPT
iptables -I INPUT -p tcp -m tcp --dport 53 -j ACCEPT

If this works then save your configuration with

service iptables save

Which will write the current state to /etc/sysconfig/iptables whic is what is loaded when iptables starts.

share|improve this answer

netfilter is the linux firewall, you can check if anything is blocking with "iptables -L" Looking at your netstat output your bind daemon is indeed listening on the normal ip. i suggest checking out the firewall.

share|improve this answer
    
Cant believe the first correct answer gets downvoted :-( –  Flash Mar 22 '12 at 9:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.