Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Currently I have a dnsmasq server (192.168.0.53) answering with local IP addresses for queries to a public domain. Facing internet there is an old (really old) bind server, master for example.com. So if I have a public host like www.example.com in my DMZ that resolves to public IP address my dnsmasq answers queries from my LAN with a local IP (let's say 192.168.0.1).

To replace that old bind server with a new one with Views (so I can remove the dnsmasq) I'm configuring a new virtual machine under VMware ESXi to work as a (for now) caching name server (192.168.0.54). I've installed CentOS 6.4 minimal and bind-chroot. I haven't yet configured my zone. Just configured bind to act as a recursive resolver for my LAN.

Somehow when I ask to this new bind server from my LAN for the IP of www.example.com it answers the private IP instead the public one. The new bind server forwards queries to google public nameservers.

This is my named.conf:


 options {
        listen-on port 53 { any; };
        //listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        allow-query     { localhost;192.168.0.0/16; };
        #allow-query-cache     {  localhost;192.168.0.0/16; };
        recursion no;


        forwarders {
                8.8.8.8;
                8.8.4.4;
};
        dnssec-validation yes;
        dnssec-lookaside auto;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.iscdlv.key";

        managed-keys-directory "/var/named/dynamic";
};


include "/etc/named.root.key";


view "internal" {

        match-clients    {
                                  127.0.0.1;
                                  192.168.0.0/16;
                                };
        recursion yes;

        zone "." IN {
                type hint;
                file "/var/named/named.ca";
        };

        include "/etc/named.rfc1912.zones";

        zone "example.local" {
                type forward;
                forwarders {192.168.0.100; }; //This is a Domain Controller
                forward only;
};
};

include "/etc/rndc.key";

controls {
        inet 127.0.0.1 allow { localhost; }
        keys { rndc-key; };
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

This is a query from my box:


$ dig @192.168.0.54 www.example.com A

; <<>> DiG 9.8.1-P1 <<>> @192.168.0.54 www.example.com A
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 35310
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 13, ADDITIONAL: 0

;; QUESTION SECTION:
;www.example.com.           IN      A

;; ANSWER SECTION:
www.example.com.    0       IN      A       192.168.0.1

;; AUTHORITY SECTION:
.                       13146   IN      NS      f.root-servers.net.
.                       13146   IN      NS      b.root-servers.net.
.                       13146   IN      NS      i.root-servers.net.
.                       13146   IN      NS      d.root-servers.net.
.                       13146   IN      NS      a.root-servers.net.
.                       13146   IN      NS      c.root-servers.net.
.                       13146   IN      NS      l.root-servers.net.
.                       13146   IN      NS      e.root-servers.net.
.                       13146   IN      NS      j.root-servers.net.
.                       13146   IN      NS      h.root-servers.net.
.                       13146   IN      NS      k.root-servers.net.
.                       13146   IN      NS      m.root-servers.net.
.                       13146   IN      NS      g.root-servers.net.

;; Query time: 500 msec
;; SERVER: 192.168.0.54#53(192.168.0.54)
;; WHEN: Wed May 22 11:29:31 2013
;; MSG SIZE  rcvd: 264

This a tcpdump on the network interface of 192.168.0.54 with a query from my box (192.168.10.10):


11:36:01.159104 IP 192.168.10.10.45688 > 192.168.0.54.53: 9804+ A? www.example.com. (37)
11:36:01.162925 IP 192.168.0.54.3816 > 8.8.4.4.53: 22027+% [1au] NS? . (28)
11:36:01.163036 IP 192.168.0.54.63322 > 8.8.4.4.53: 48919+% [1au] A? www.example.com. (48)
11:36:01.214789 IP 8.8.4.4.53 > 192.168.0.54.3816: 22027$ 14/0/1 NS a.root-servers.net., NS b.root-servers.net., NS c.root-servers.net., NS d.root-servers.net., NS e.root-servers.net., NS f.root-servers.net., NS g.root-servers.net., NS h.root-servers.net., NS i.root-servers.net., NS j.root-servers.net., NS k.root-servers.net., NS l.root-servers.net., NS m.root-servers.net., RRSIG (397)
11:36:01.215732 IP 192.168.0.54.62584 > 8.8.8.8.53: 48702+% [1au] DNSKEY? . (28)
11:36:01.266236 IP 8.8.8.8.53 > 192.168.0.54.62584: 48702$ 3/0/1 DNSKEY, DNSKEY, RRSIG (736)
**11:36:01.424362 IP 8.8.4.4.53 > 192.168.0.54.63322: 48919 1/0/1 A 192.168.0.1 (64)**
11:36:01.425598 IP 192.168.0.54.56414 > 8.8.8.8.53: 47901+% [1au] DS? ar. (31)
11:36:01.596089 IP 8.8.8.8.53 > 192.168.0.54.56414: 47901 0/4/1 (449)
11:36:01.598347 IP 192.168.0.54.41809 > 8.8.8.8.53: 17779+% [1au] Type32769? www.example.com.dlv.isc.org. (60)
11:36:01.975834 IP 8.8.8.8.53 > 192.168.0.54.41809: 17779 NXDomain 0/6/1 (773)
11:36:01.976435 IP 192.168.0.54.47062 > 8.8.4.4.53: 16447+% [1au] DNSKEY? dlv.isc.org. (40)
11:36:02.027054 IP 8.8.4.4.53 > 192.168.0.54.47062: 16447$ 4/0/1 DNSKEY, DNSKEY, RRSIG, RRSIG (936)
11:36:02.032544 IP 192.168.0.54.33350 > 8.8.4.4.53: 64699+% [1au] Type32769? ar.dlv.isc.org. (43)
11:36:02.032699 IP 192.168.0.54.37531 > 8.8.4.4.53: 38655+% [1au] NS? . (28)
11:36:02.083609 IP 8.8.4.4.53 > 192.168.0.54.33350: 64699 0/4/1 (498)
11:36:02.084777 IP 8.8.4.4.53 > 192.168.0.54.37531: 38655$ 14/0/1 NS a.root-servers.net., NS b.root-servers.net., NS c.root-servers.net., NS d.root-servers.net., NS e.root-servers.net., NS f.root-servers.net., NS g.root-servers.net., NS h.root-servers.net., NS i.root-servers.net., NS j.root-servers.net., NS k.root-servers.net., NS l.root-servers.net., NS m.root-servers.net., RRSIG (397)
**11:36:02.085051 IP 192.168.0.54.53 > 192.168.10.10.45688: 9804 1/13/0 A 192.168.0.1 (264)**

What I can't understand is how/why tcpdump shows the answer from 8.8.4.4 with the local IP (192.168.0.1).

192.168.0.54 is also integrated to the Active Directory domain (for administrators authentication and authorization) using SSSD.

share|improve this question
    
What happens when you query Google's nameservers directly? @8.8.4.4 –  Nathan C May 22 '13 at 15:11
    
<code> $ dig \@8.8.4.4 www.example.com A ; <<>> DiG 9.8.1-P1 <<>> \@8.8.4.4 www.example.com A ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56929 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;www.example.com. IN A ;; ANSWER SECTION: www.example.com. 0 IN A 192.168.0.1 ;; Query time: 324 msec ;; SERVER: 8.8.4.4#53(8.8.4.4) ;; WHEN: Wed May 22 12:21:00 2013 ;; MSG SIZE rcvd: 53 </code> –  Peter von Nostrand May 22 '13 at 15:26
    
It looks like your DNS server announced the internal IP to the Internet rather than your external. Give your "new" server proper records with views and it should resolve (no pun intended) itself. –  Nathan C May 22 '13 at 15:28
    
thx, but if I query any public nameserver from the outside I get the correct IP –  Peter von Nostrand May 22 '13 at 15:30
    
That is...interesting. I'll let someone else who's more informed with DNS and such answer this question. –  Nathan C May 22 '13 at 15:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.