Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite

I have a linux server with a bind daemon running on it. Until yesterday all worked like a charm and then suddendly it stopped to.
Because the named-daemon was still running and dns queries within my lan are still working I guessed, that the router/firewall would probably be the erroneous part.
So I looked into the error log of my zyxel prestige 662H-61 and saw an error, that too many nat connections were open. I restarted my router and increased the maximal number of connections for the nat.
But when i do a nslookup now, I get the following output

;; reply from unexpected source: 62.202.20.14#10095, expected 62.202.20.14#53
;; reply from unexpected source: 62.202.20.14#10095, expected 62.202.20.14#53
;; reply from unexpected source: 62.202.20.14#10095, expected 62.202.20.14#53
;; connection timed out; no servers could be reached

The logs of the named service are showing, that the request has been processed by the bind daemon.

Does anybody know what this means/what I have to change to get it working again?

Thanks a lot!

share|improve this question
2  
I'm afraid we'll need to know a little more about your network to understand this and help. Does your router send outside requests for DNS to this bind server? (Or did it previously?) Might be DNAT and that could explain the error messages. – adric Oct 4 '09 at 17:45
i've a router which forwards all calls via nat to a server within the network.A firewall rule on the router ensures, that only the "good" ports are forwarded. On the server machine a dns-server is running.It has some entries for the domains managed by this server.This dns-server is used by all computers in the network. The error occurs when i try to fetch a dns-entry laying on this bind-server,but only if i do the call from outside the lan. do you need any further information? – Sämy Oct 5 '09 at 17:01
please let us know what part of your network that device (62.202.20.14) is. – Alnitak Oct 6 '09 at 13:22
62.202.20.14 is my wan ip address on which my dns server is listening at port 53. (NAT) – Sämy Oct 7 '09 at 13:03
any ideas? do you need some further information? it is very unpleasant... :s – Sämy Oct 20 '09 at 19:53

migrated from stackoverflow.com Oct 4 '09 at 15:01

4 Answers

up vote 1 down vote

You DNS Server exepcting that PORT of reply should be 53, and it locked in this port. You should tweak named.conf for accepting dynamical(for this connection is 10095) range of ports.

share|improve this answer
up vote 0 down vote

Was there something changed on the/a Firewall? Do you have TCPDUMP installed on that server, maybe you could run a tcpdump -n port 53 to see what packets are coming back.

Let me know the response of that so we can see what the problem might be.

share|improve this answer
No, I have not changed anything at all (except that maximal number of allowed connections). I did a tcpdump on the server now and got that output: 17:11:51.394128 IP 62.202.20.14.12453 > 192.168.1.4.53: 53818+ A? gorrion.ch. (28) 17:11:51.394482 IP 192.168.1.4.53 > 62.202.20.14.12453: 53818*- On the client I got the same output as above. If I do a nslookup from the outside of my lan I get only the following output: ;; connection timed out; no servers could be reached – Sämy Oct 5 '09 at 17:02
up vote 0 down vote

Have you tried using a different forwarding DNS server (like opendns) just for testing purpose?

share|improve this answer
For which reason? I have a problem to get a dns-entry laying on the server i'm talking to. The forwarders are not used in this case. (Btw. resolving any external domainname within the lan is no problem -> the forwarders are working properly) – Sämy Oct 5 '09 at 18:40
up vote 0 down vote

Seems like something (like a p2p software...) is exhausting all ports. The responses from the unexpected source look like there were stale connections that got processed by the DNS.

What software do you have running that might be exhausting your resources?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.