0

I'm having trouble with setting up reverse DNS.

I own the mentioned public IP addresses.

After making changes to named.conf (added zone "1.198.193.in-addr.arpa" )

options {
        directory "/var/cache/bind";

        auth-nxdomain no;    # conform to RFC1035

        listen-on { 193.198.1.6; };
        listen-on-v6 { "none"; };

        recursion no;

        allow-transfer { 193.198.1.9; };
        also-notify { 193.198.1.9; };
};

controls {
        inet 127.0.0.1 allow { localhost; };
};

zone "gkr.hr" {
        type master;
        file "/etc/bind/zones/gkr.hr.db";
};

zone "gkri.hr" {
        type master;
        file "/etc/bind/zones/gkri.hr.db";
};


zone "1.198.193.in-addr.arpa" in {
        type master;
        file "/etc/bind/193.198.1.gkri.rev";
        allow-transfer {
                193.198.1.9;
        };
        allow-query { any; };

};

and creating a new .rev file

Content of the /etc/bind/193.198.1.gkri.rev

$TTL 1D

@       SOA     a.ns.gkr.hr. admin.gkr.hr. (

        2016091201 ; Serial
        10800      ; Refresh
        3600       ; Retry
        2419200    ; Expire
        14400)     ; Minimum

@       NS      a.ns.gkr.hr.
@       NS      b.ns.gkr.hr.

11      PTR     mail.gkri.hr.

And after this configuration when I run:

root@a:/home/admin# nslookup 193.198.1.11

I get

;; Got SERVFAIL reply from 161.53.123.3, trying next server
;; Got SERVFAIL reply from 161.53.160.3, trying next server
;; connection timed out; no servers could be reached

but when I run

root@a:/home/admin# nslookup mail.gkri.hr

mail.gkri.hr is on 193.198.1.11

Server:     161.53.123.3
Address:    161.53.123.3#53

Non-authoritative answer:
Name:   mail.gkri.hr
Address: 193.198.1.11

Also some other valuable info

root@a:/home/admin# named-checkzone 1.198.193.in-addr.arpa /etc/bind/193.198.1.gkri.rev

zone 1.198.193.in-addr.arpa/IN: loaded serial 2016091201
OK
root@a:/home/admin# named-checkconf -z
zone gkr.hr/IN: loaded serial 2016091201
zone gkri.hr/IN: loaded serial 2016091203
zone 11.1.198.193.in-addr.arpa/IN: loaded serial 2016091201

root@a:/home/admin# host -t any 11.1.198.193.in-addr.arpa a.ns.gkr.hr

Using domain server:
Name: a.ns.gkr.hr
Address: 193.198.1.6#53
Aliases: 

11.1.198.193.in-addr.arpa has SOA record a.ns.gkr.hr. admin.gkr.hr. 2016091201 10800 3600 2419200 14400
11.1.198.193.in-addr.arpa name server a.ns.gkr.hr.
11.1.198.193.in-addr.arpa name server b.ns.gkr.hr.

When running dig I get

root@a:/etc/bind# dig -x 193.198.1.11

; <<>> DiG 9.7.3 <<>> -x 193.198.1.11
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 11421
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;11.1.198.193.in-addr.arpa. IN  PTR

;; ANSWER SECTION:
11.1.198.193.in-addr.arpa. 14400 IN CNAME   11.0/27.1.198.193.in-addr.arpa.

;; Query time: 33 msec
;; SERVER: 161.53.123.3#53(161.53.123.3)
;; WHEN: Tue Sep 13 11:56:47 2016
;; MSG SIZE  rcvd: 65

root@a:/home/admin# dig -x 193.198.1.11 +trace

      ; <<>> DiG 9.7.3 <<>> -x 193.198.1.11 +trace
        ;; global options: +cmd
        .           3599800 IN  NS  e.root-servers.net.
        .           3599800 IN  NS  k.root-servers.net.
        .           3599800 IN  NS  j.root-servers.net.
        .           3599800 IN  NS  i.root-servers.net.
        .           3599800 IN  NS  c.root-servers.net.
        .           3599800 IN  NS  m.root-servers.net.
        .           3599800 IN  NS  b.root-servers.net.
        .           3599800 IN  NS  l.root-servers.net.
        .           3599800 IN  NS  a.root-servers.net.
        .           3599800 IN  NS  f.root-servers.net.
        .           3599800 IN  NS  g.root-servers.net.
        .           3599800 IN  NS  d.root-servers.net.
        .           3599800 IN  NS  h.root-servers.net.
        ;; Received 241 bytes from 161.53.123.3#53(161.53.123.3) in 15 ms

        in-addr.arpa.       172800  IN  NS  e.in-addr-servers.arpa.
        in-addr.arpa.       172800  IN  NS  f.in-addr-servers.arpa.
        in-addr.arpa.       172800  IN  NS  d.in-addr-servers.arpa.
        in-addr.arpa.       172800  IN  NS  c.in-addr-servers.arpa.
        in-addr.arpa.       172800  IN  NS  b.in-addr-servers.arpa.
        in-addr.arpa.       172800  IN  NS  a.in-addr-servers.arpa.
        ;; Received 419 bytes from 198.41.0.4#53(a.root-servers.net) in 35 ms

        193.in-addr.arpa.   86400   IN  NS  tinnie.arin.net.
        193.in-addr.arpa.   86400   IN  NS  pri.authdns.ripe.net.
        193.in-addr.arpa.   86400   IN  NS  sns-pb.isc.org.
        193.in-addr.arpa.   86400   IN  NS  sec3.apnic.net.
        ;; Received 156 bytes from 193.0.9.1#53(f.in-addr-servers.arpa) in 30 ms

        198.193.in-addr.arpa.   172800  IN  NS  dns1.carnet.hr.
        198.193.in-addr.arpa.   172800  IN  NS  dns2.carnet.hr.
        198.193.in-addr.arpa.   172800  IN  NS  ns.ripe.net.
        ;; Received 159 bytes from 202.12.28.140#53(sec3.apnic.net) in 238 ms

11.1.198.193.in-addr.arpa. 14400 IN CNAME   11.0/27.1.198.193.in-addr.arpa.
0/27.1.198.193.in-addr.arpa. 14400 IN   NS  ns.ri.carnet.hr.
0/27.1.198.193.in-addr.arpa. 14400 IN   NS  ns.gkri.hr.
;; Received 116 bytes from 161.53.160.2#53(dns2.carnet.hr) in 3 ms

Here is my sys log after /etc/init.d/bind9 restart

root@a:/var/log# cat /var/log/syslog | grep named

Sep 13 10:12:37 a named[934]: received control channel command 'stop -p'
Sep 13 10:12:37 a named[934]: shutting down: flushing changes
Sep 13 10:12:37 a named[934]: stopping command channel on 127.0.0.1#953
Sep 13 10:12:37 a named[934]: no longer listening on 193.198.1.6#53
Sep 13 10:12:37 a named[934]: exiting
Sep 13 10:12:38 a named[1187]: starting BIND 9.7.3 -4 -u bind
Sep 13 10:12:38 a named[1187]: built with '--prefix=/usr' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--sysconfdir=/etc/bind' '--localstatedir=/var' '--enable-threads' '--enable-largefile' '--with-libtool' '--enable-shared' '--enable-static' '--with-openssl=/usr' '--with-gssapi=/usr' '--with-gnu-ld' '--with-dlz-postgres=no' '--with-dlz-mysql=no' '--with-dlz-bdb=yes' '--with-dlz-filesystem=yes' '--with-dlz-ldap=yes' '--with-dlz-stub=yes' '--with-geoip=/usr' '--enable-ipv6' 'CFLAGS=-fno-strict-aliasing -DDIG_SIGCHASE -O2' 'LDFLAGS=' 'CPPFLAGS='
Sep 13 10:12:38 a named[1187]: adjusted limit on open files from 1024 to 1048576
Sep 13 10:12:38 a named[1187]: found 1 CPU, using 1 worker thread
Sep 13 10:12:38 a named[1187]: using up to 4096 sockets
Sep 13 10:12:38 a named[1187]: loading configuration from '/etc/bind/named.conf'
Sep 13 10:12:38 a named[1187]: using default UDP/IPv4 port range: [1024, 65535]
Sep 13 10:12:38 a named[1187]: using default UDP/IPv6 port range: [1024, 65535]
Sep 13 10:12:38 a named[1187]: no IPv6 interfaces found
Sep 13 10:12:38 a named[1187]: listening on IPv4 interface eth0, 193.198.1.6#53
Sep 13 10:12:38 a named[1187]: generating session key for dynamic DNS
Sep 13 10:12:38 a named[1187]: set up managed keys zone for view _default, file 'managed-keys.bind'
Sep 13 10:12:38 a named[1187]: command channel listening on 127.0.0.1#953
Sep 13 10:12:38 a named[1187]: zone 11.1.198.193.in-addr.arpa/IN: loaded serial 2016091201
Sep 13 10:12:38 a named[1187]: zone gkr.hr/IN: loaded serial 2016091201
Sep 13 10:12:38 a named[1187]: zone gkri.hr/IN: loaded serial 2016091203
Sep 13 10:12:38 a named[1187]: managed-keys-zone ./IN: loading from master file managed-keys.bind failed: file not found
Sep 13 10:12:38 a named[1187]: managed-keys-zone ./IN: loaded serial 0
Sep 13 10:12:38 a named[1187]: running
Sep 13 10:12:38 a named[1187]: zone 11.1.198.193.in-addr.arpa/IN: sending notifies (serial 2016091201)
Sep 13 10:12:38 a named[1187]: zone gkr.hr/IN: sending notifies (serial 2016091201)
Sep 13 10:12:38 a named[1187]: zone gkri.hr/IN: sending notifies (serial 2016091203)

Anybody got a clue what is wrong?

Could it be DNSSEC key information for Bind 9 ?

*mentioned in syslog (managed-keys.bind)

4
  • zone "11.1.198.193.in-addr.arpa" in { <<< should remove the first 11. Sep 13, 2016 at 11:24
  • I've changed it to 0/27.1.198.193.in-addr.arpa since I have that range of IP address. I'm still getting root@a:/etc/bind# nslookup 193.198.1.11 ;; Got SERVFAIL reply from 161.53.123.3, trying next server ;; Got SERVFAIL reply from 161.53.160.3, trying next server ;; connection timed out; no servers could be reached
    – Rene
    Sep 13, 2016 at 11:46
  • I said remove it: zone "1.198.... Sep 13, 2016 at 11:50
  • Ok, I just did, after bind restart, I'm still getting SERVFAIL reply
    – Rene
    Sep 13, 2016 at 11:52

1 Answer 1

1

Your zone is "0/27.1.198.193.in-addr.arpa", so change your zone in named.conf to:

zone "0/27.1.198.193.in-addr.arpa" in {

Restart BIND.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .