I've got a Bind 9 DNS server sitting behind a NAT firewall, assume the Internet facing IP is 22.214.171.124
There are no restrictions on outgoing traffic, and port 53 (TCP/UDP) is forwarded from 126.96.36.199 to the internal DNS server (10.0.0.1). There are no IP Tables rules on either the VPS or the internal Bind 9 server.
From a remote Linux VPS located elsewhere on the internet, nslookup works fine
# nslookup foo.example.com 188.8.131.52 Server: 184.108.40.206 Address: 220.127.116.11#53 Name: foo.example.com Addresss: 18.104.22.168
However, when using the
host command on the remote VPS, I receive the following output:
# host foo.example.com 22.214.171.124 ;; reply from unexpected source: 126.96.36.199#13731, expected 188.8.131.52#53 ;; reply from unexpected source: 184.108.40.206#13731, expected 220.127.116.11#53 ;; connection timed out; no servers could be reached.
From the VPS, I can establish a connection (using telnet) to 18.104.22.168:53
From the internal DNS server (10.0.0.1), the host command appears to be fine:
# host foo.example.com 127.0.0.1 Using domain server: Name: 127.0.0.1 Address: 127.0.0.1#53 Aliases: foo.example.com has address 22.214.171.124
Any suggestions as to why the host command on my VPS is complaining about the reply coming back from another port, and what can I do to fix this?
From a windows host external to the network
>nslookup foo.example.com 126.96.36.199 DNS request timeout timeout was 2 seconds Server: UnKnown Address: 188.8.131.52 DNS request timed out. timeout was 2 seconds DNS request timed out. timeout was 2 seconds DNS request timed out. timeout was 2 seconds DNS request timed out. timeout was 2 seconds *** Request to UnKnown timed-out
This is a default install of bind from Ubuntu 12.04 LTS, with around 11 zones configured.
$ named -v BIND 9.8.1-P1
TCP Dump (filtered) from internal DNS server
20:36:29.175701 IP pc.external.com.57226 > dns.example.com.domain: 1+ PTR? 184.108.40.206.in-addr.arpa. (45) 20:36:29.175948 IP dns.example.com.domain > pc.external.com.57226: 1 Refused- 0/0/0 (45) 20:36:31.179786 IP pc.external.com.57227 > dns.example.com.domain: 2+[|domain] 20:36:31.179960 IP dns.example.com.domain > pc.external.com.57227: 2 Refused-[|domain] 20:36:33.180653 IP pc.external.com.57228 > dns.example.com.domain: 3+[|domain] 20:36:33.180906 IP dns.example.com.domain > pc.external.com.57228: 3 Refused-[|domain] 20:36:35.185182 IP pc.external.com.57229 > dns.example.com.domain: 4+ A? foo.example.com. (45) 20:36:35.185362 IP dns.example.com.domain > pc.external.com.57229: 4*- 1/1/1 (95) 20:36:37.182844 IP pc.external.com.57230 > dns.example.com.domain: 5+ AAAA? foo.example.com. (45) 20:36:37.182991 IP dns.example.com.domain > pc.external.com.57230: 5*- 0/1/0 (119)
TCP Dump from client during query
21:24:52.054374 IP pc.external.com.43845 > dns.example.com.53: 6142+ A? foo.example.com. (45) 21:24:52.104694 IP dns.example.com.29242 > pc.external.com.43845: UDP, length 95