-1

I created a virtual configuration in VirtualBox for practice but can't get it to work. I have an Ubuntu 14.04 Server as a server and Xubuntu 16.04 as a client. Server has one network interface as a bridge (192.168.1.192) and another in a local network (192.168.56.101), client only one interface in a local network(192.168.56.200). I am trying to set up bind in a DNS forwarder configuration, but the client won't connect to the server.
Server configuration:
-iptables

*filter
:INPUT DROP [1824:109808]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [776:81374]
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -p icmp -j ACCEPT
-A FORWARD -p udp -m multiport --ports 53 -j ACCEPT
-A FORWARD -p tcp -m multiport --ports 53,80,8080,443,110,25,21 -j ACCEPT
COMMIT
# Completed on Mon Feb  6 19:29:11 2017
# Generated by iptables-save v1.4.21 on Mon Feb  6 19:29:11 2017
*nat
:PREROUTING ACCEPT [1983:119530]
:INPUT ACCEPT [2:144]
:OUTPUT ACCEPT [19:1244]
:POSTROUTING ACCEPT [19:1244]
-A POSTROUTING -s 192.168.56.0/24 -j MASQUERADE
COMMIT

/etc/bind/named.conf

// This is the primary configuration file for the BIND DNS server named.
//
// Please read /usr/share/doc/bind9/README.Debian.gz for information on the 
// structure of BIND configuration files in Debian, *BEFORE* you customize 
// this configuration file.
//
// If you are just adding zones, please do that in /etc/bind/named.conf.local

include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";
# Use with the following in named.conf, adjusting the allow list as needed:
 key "rndc-key" {
    algorithm hmac-md5;
    secret "PuLMSMi7CDsY1tG9qGSQBQ==";
 };
# 
 controls {
    inet 127.0.0.1 port 953
        allow { 127.0.0.1; } keys { "rndc-key"; };
 };
# End of named.conf

/etc/bind/rndc.conf

#Start of rndc.conf
key "rndc-key" {
    algorithm hmac-md5;
    secret "PuLMSMi7CDsY1tG9qGSQBQ==";
};

options {
    default-key "rndc-key";
    default-server 127.0.0.1;
    default-port 953;
};
# End of rndc.conf

/etc/bind/named.conf.options

acl goodclients {
        192.168.56.0/24;
        localhost;
        localnets;
};

options {
    directory "/var/cache/bind";

    recursion yes;
    allow-query { goodclients; };
    // If there is a firewall between you and nameservers you want
    // to talk to, you may need to fix the firewall to allow multiple
    // ports to talk.  See http://www.kb.cert.org/vuls/id/800113

    // If your ISP provided one or more IP addresses for stable 
    // nameservers, you probably want to use them as forwarders.  
    // Uncomment the following block, and insert the addresses replacing 
    // the all-0's placeholder.

    forwarders {
    8.8.8.8;
    8.8.4.4;
    };
    forward only;
    listen-on port 53 { 192.168.56.101; };

    //========================================================================
    // If BIND logs error messages about the root key being expired,
    // you will need to update your keys.  See https://www.isc.org/bind-keys
    //========================================================================
    dnssec-enable yes;
    dnssec-validation yes;

    auth-nxdomain no;    # conform to RFC1035
    listen-on-v6 { any; };
};

/etc/resolv.conf

# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 8.8.8.8

The bind seems to work fine

sudo service bind9 restart 
 * Stopping domain name service... bind9                                                                                 WARNING: key file (/etc/bind/rndc.key) exists, but using default configuration file (/etc/bind/rndc.conf)
waiting for pid 1046 to die
                                                                                                                  [ OK ]
 * Starting domain name service... bind9                                                                          [ OK ] 

But named does not, in fact named isn't found at all

sudo service named status
named: unrecognized service

Client config

/etc/resolv.conf

# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN

I have tried adding 192.168.56.101 (server's interface on the inside network) to resolv.conf, nothing happened.

/etc/network/interfaces

# interfaces(5) file used by ifup(8) and ifdown(8)
auto lo
iface lo inet loopback
auto enp0s3
iface enp0s3 inet static
    address 192.168.56.200
    netmask 255.255.255.0
    broadcast 192.168.56.255
    network 192.168.56.0
    gateway 192.168.56.101

/etc/hosts

127.0.0.1   localhost
127.0.1.1   xubuntu-VirtualBox

# The following lines are desirable for IPv6 capable hosts
::1     ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

Investigation

ping 8.8.8.8

PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=40 time=148 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=40 time=105 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=40 time=78.9 ms
64 bytes from 8.8.8.8: icmp_seq=4 ttl=40 time=79.2 ms
^C
--- 8.8.8.8 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3004ms
rtt min/avg/max/mdev = 78.928/102.951/148.389/28.314 ms

Ping to the outside world works

telnet 8.8.8.8 53
Trying 8.8.8.8...
Connected to 8.8.8.8.
Escape character is '^]'.
Connection closed by foreign host.

As well as telnet.

ping 192.168.56.101
PING 192.168.56.101 (192.168.56.101) 56(84) bytes of data.
64 bytes from 192.168.56.101: icmp_seq=1 ttl=64 time=0.735 ms
64 bytes from 192.168.56.101: icmp_seq=2 ttl=64 time=0.492 ms
64 bytes from 192.168.56.101: icmp_seq=3 ttl=64 time=0.483 ms
64 bytes from 192.168.56.101: icmp_seq=4 ttl=64 time=0.610 ms
64 bytes from 192.168.56.101: icmp_seq=5 ttl=64 time=0.357 ms
^C
--- 192.168.56.101 ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 3997ms
rtt min/avg/max/mdev = 0.357/0.535/0.735/0.129 ms

Ping to the inside server interface suceeds.

telnet 192.168.56.101 53
Trying 192.168.56.101...
telnet: Unable to connect to remote host: Connection timed out

However the telnet doesn't

netstat -anp | grep '53'
(No info could be read for "-p": geteuid()=1000 but you should be root.)
tcp        0      0 192.168.56.101:53       0.0.0.0:*               LISTEN      -               
tcp        0      0 127.0.0.1:953           0.0.0.0:*               LISTEN      -               
tcp6       0      0 :::53                   :::*                    LISTEN      -               
udp        0      0 192.168.56.101:53       0.0.0.0:*                           -               
udp6       0      0 ::1:53908               ::1:48239               ESTABLISHED -               
udp6       0      0 :::53                   :::*                                -               
udp6       0      0 ::1:48239               ::1:53908               ESTABLISHED -

But the server is listening on this port.

I enabled forwarding in the firewall, set up forwarding in named.conf, disabled ufw on both ends. What else can go awry?

UPDATE: Edited the firewall rules to:

# Generated by iptables-save v1.4.21 on Tue Feb  7 21:04:56 2017
*nat
:PREROUTING ACCEPT [1:60]
:INPUT ACCEPT [1:60]
:OUTPUT ACCEPT [6:435]
:POSTROUTING ACCEPT [6:435]
-A POSTROUTING -s 192.168.56.0/24 -j MASQUERADE
COMMIT
# Completed on Tue Feb  7 21:04:56 2017
# Generated by iptables-save v1.4.21 on Tue Feb  7 21:04:56 2017
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [123:14050]
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m multiport --ports 53 -j ACCEPT
-A INPUT -p udp -m multiport --ports 53 -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -p icmp -j ACCEPT
-A FORWARD -p tcp -m multiport --ports 80,8080,443,110,25,21 -j ACCEPT
COMMIT
# Completed on Tue Feb  7 21:04:56 2017

Telnet connects now, however DNS still doesn't.

dig google.com

; <<>> DiG 9.10.3-P4-Ubuntu <<>> google.com
;; global options: +cmd
;; connection timed out; no servers could be reached

Elaboration: firewall and bind are hosted on the same server.

  • Shouldn't the firewall rule(s) for this be in the INPUT chain? Am I misunderstanding where this is running? – Håkan Lindqvist Feb 7 '17 at 18:10
  • I'm not sure how this should be configured for the forwarding DNS. In the example I've looked up only the DNS rules in the FORWARD chain were present. However, this kinda explains why the telnet wouldn't work... I'm not sure, should the firewall accept on the port 53 both on the INPUT and FORWARD chains? – Silent Inky Feb 7 '17 at 18:44
  • Is the service running on the same machine where the firewall rules are from? If so, the packets are directed at that host, not being forwarded. – Håkan Lindqvist Feb 7 '17 at 18:46
  • Edited the firewall rules, see updated post. – Silent Inky Feb 7 '17 at 19:11
  • Please elaborate on "Telnet connects now, however DNS still doesn't". (dig output?) – Håkan Lindqvist Feb 7 '17 at 19:13
1

The problem with the configuration was twofold:

First, the forwarding server's iptables should be configured to direct incoming DNS requests to the INPUT chain, because otherwise they could not be accepted and processed by bind.

-A INPUT -p tcp -m multiport --ports 53 -j ACCEPT
-A INPUT -p udp -m multiport --ports 53 -j ACCEPT

Secondly, the client's configuration was lacking a dns-nameserver entry in the /etc/network/interfaces file, where it should be if the interface is configured as static.

iface enp0s3 inet static
    address 192.168.56.200
    netmask 255.255.255.0
    broadcast 192.168.56.255
    network 192.168.56.0
    gateway 192.168.56.101
    dns-nameservers 192.168.56.101

If the network interface is configured as a dynamic one, one should edit /etc/dhcp/dhclient.conf and add the following line to it.

prepend domain-name-servers x.x.x.x, y.y.y.y;

Where x.x.x.x and y.y.y.y are the addresses of DNS servers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.