2

I am trying to configure a DNS for an Ubuntu server. Initially I had problems pinging the server or doing any kind of dig. The relevant info up to that point is visible below under "Old Issues". Through much assistance I have gotten the DNS to respond to a ping request via its IP, and most importantly it is now acknowledging the dig -x 127.0.0.1 command.

These prior issues came about due to an error in my name server syntax in the Forward Zone File (eg. db.example.com.).

Currently the issue remains that the server can not be called by the example.com. I can only assume that this is a problem with my reference to the recursive DNS server, however I am unsure of how to fix this. All help is appreciated.

Old Issues
As per requested, below are the results for various ping requests, digs, and what is entered into bind named.config prior to any suggestions.

"ping example.com" times out and outputs:

ping: unknown host example.com

"ping 1.2.3.4" (net ip) outputs:

10 packets transmitted, 10 received, 0% packet loss, time 8999ms
rtt min/avg/max/mdev = 0.688/0.960/3.221/0.754 ms

"ping 1.2.3.4" (local ip) outputs:

PING 192.168.1.68 (192.168.1.68) 56(84) bytes of data.
^C
--- 192.168.1.68 ping statistics ---
21 packets transmitted, 0 received, 100% packet loss, time 19999ms

"ping 4.2.2.2" outputs:

5 packets transmitted, 5 received, 0% packet loss, time 4006ms
rtt min/avg/max/mdev = 32.742/33.081/33.544/0.411 ms

bind named.conf file:

include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";

resolv.conf file:
version 1

nameserver 127.0.0.1
nameserver 4.2.2.2

version 2

search example.com
nameserver 192.168.1.1
nameserver 68.238.64.12

nslookup google.com

Server:         192.168.1.1
Address:        192.168.1.1#53

Non-authoritative answer:
Name:   google.com
Address: 74.125.45.100
Name:   google.com
Address: 74.125.53.100
Name:   google.com
Address: 74.125.67.100

New Issues

dig -x 127.0.0.1 this line seems to be of concern, shouldn't these 0's be 1's?

;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

cat /etc/bind/named.conf.options

tail -n 100 /var/log/syslog

cat /var/log/syslog | grep bind

named.conf.local

zone "example.com"{
        type master;
        file "/etc/bind/db.example.com";
};

zone "1.168.192.in-addr.arpa" {
        type master;
        file "/etc/bind/db.233";
};
3
  • OK, the new information is useful, but it's still unclear which machines are reporting which problem? You're asking 127.0.0.1 to be recursive, but is this also the recursive server you're using (per my original response). Frankly, I'm still none the wiser about your overall network architecture.
    – Alnitak
    Nov 20, 2009 at 8:40
  • i definitely do not want the server to be recursive. is this because of the 127.0.0.1 in the resolv.conf file?
    – storm
    Nov 20, 2009 at 20:07
  • well, if your own server (localhost?) is only authoritative then your resolv.conf should point to your ISPs recursive server, and not 127.0.0.1.
    – Alnitak
    Nov 20, 2009 at 20:43

4 Answers 4

1
  1. Check you network is UP and running
  2. Check you routing and if default rote is installed ( netstat -rn )
  3. Check internet connection by pinging 4.2.2.2 ( ping 4.2.2.2 )
  4. Check your dns configs ( cat /etc/resolv.conf )
  5. Check that name resolution works with other DNS server (nslookup google.com 4.2.2.2)
  6. You can use nameserver 4.2.2.2 in your /etc/resolv.conf , if you want just name resolution working aka pinging any site by name.
  7. Share your bind named.conf, by the way, it must work out of the box as caching server.
33
  • After trying netstat -rn I found that I lacked a 127.0.0.1 destination and many of the gateways are 0.0.0.0 rather than *. Is this a problem?
    – storm
    Nov 19, 2009 at 19:32
  • Have you pinged 4.2.2.2?
    – TiFFolk
    Nov 19, 2009 at 19:41
  • ping 4.2.2.2 was sucessful. I'll put the output in an edit above.
    – storm
    Nov 19, 2009 at 19:44
  • so now show your /etc/resolv.conf and add there nameserver 127.0.0.1
    – TiFFolk
    Nov 19, 2009 at 20:50
  • resolv.conf has been added above as well as nameserver.
    – storm
    Nov 19, 2009 at 21:35
3

You need to clarify for us what particular DNS function this server is supposed to be doing - in particular, is it:

  1. recursive - offering global DNS lookups for your LAN
  2. authoritative - serving data for a zone that you run
  3. both - possible, but strongly recommended against for security reasons

EDIT now confirmed as authoritative.

Given the reported problems with ping it's likely that you've got an underlying network problem to solve first before we start worrying about the DNS server config, though. Your original question is unclear though - you appear to be reporting three separate problems:

  1. ping example.com times out
  2. ping 1.2.3.4 says "no host"
  3. the DNS Server returns SERVFAIL

(1) and (2) don't make sense as reported - if anything I'd expect the errors to be the other way around. Please supply (redacted) examples of the output of those two commands.

Once that's resolved, we can start to address (3) - the SERVFAIL error normally indicates misconfiguration rather than access control problems. However I see that it's taking 4 seconds to produce that response - SERVFAIL can also indicate failure to reach an upstream DNS server which would be consistent with you having network problems.

8
  • It will be an authoritative dns. The network issue seems possible. I am currently running tests on the server at a dynamic IP before sending it to a colo facility. The dns was hosted until about 3 days ago, but the new IP should have updated by now.
    – storm
    Nov 19, 2009 at 7:00
  • When you say "the server", do you mean the DNS server, an application server, or some box that's doing both?
    – Alnitak
    Nov 19, 2009 at 7:43
  • It's both a DNS and an application server. I understand that it is best to separate these, but that will have to wait for greater resources. Also, I forgot to mention that "named-checkzone" came out "ok". So I assume that the forward and reverse zone files are not the culprit.
    – storm
    Nov 19, 2009 at 7:55
  • please supply the ping output logs per my edit above
    – Alnitak
    Nov 19, 2009 at 7:57
  • "ping example.com" outputs - "ping: unknown host example.com". "ping @1.2.3.4" (local ip) outputs - "ping: unknown host @1.2.3.4". "ping @1.2.3.4" (net ip) outputs - "ping: unknown host @1.2.3.4" My method of obtaining a forwarding IP for my ISP's DNS may have been in error. I understood that I could use any DNS that is owned by my provider. Is there a more concise method? thank you for the extensive assistance.
    – storm
    Nov 19, 2009 at 8:25
0

try putting a "recursion yes;" in your named.conf - this will allow your server to give you dns records out of it's control.

This should be in your "options" section. I would also create an ACL limiting access to this feature.

acl homenet { 192.168.0.0/24; 127.0.0.0/8; };

options {
  recursion yes;
  allow-recursion { homenet; };
}
4
  • updated the answer to include where to include the recursion option. Also removed the allow-clients as it is a "view" option that I use - instead use the allow-recursion option as I've put in the answer.
    – Eddy
    Nov 19, 2009 at 15:04
  • placing "recursion yes;" in named.conf results in a failed restart of bind9. however I have placed the above code into named.conf.options and successfully restarted bind9.
    – storm
    Nov 19, 2009 at 20:53
  • I see your able to resolve domains outside of your control now so the recursion is working but it seems that you are configuring a local domain example.com that is not working. I would guess a configuration issue in the zone file - if you "tail -f /var/log/messages" and restart the nameserver do you get any error messages?
    – Eddy
    Nov 19, 2009 at 23:10
  • "tail -f /var/log/messages" gave the same output before and after the restart. after the restart I was still unable to ping example.com by its name and dig still results in "no servers could be reached". Were you thinking of a different error test?
    – storm
    Nov 20, 2009 at 0:01
0

"a DNS"? DNS is a protocol. This is like saying "I'd like an HTTP."

Could you describe whether you want a DNS authoritative server, secondary server, client, caching server, private root, DNSsec, etc?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .