I have an internet connection with a static ip from my ISP. I do have mail servers and webservers hosted from it. What i would like to achieve is run couple of nameservers by getting another static ip from my ISP. I have forwarded TCP and UDP ports from my local IP address and the internet connection is being managed by pfsense. The DNS resolver and forwarder service has been disabled.

I tried to setup a nameserver by NAT and forwarded PORT 53 for udp & tcp traffic. But still when i try to query a record for a zone on my nameserver using dig externally or internally , i get an error "no servers could be reached". Is there any guide or information that would help me to setup the nameservers behind NAT or help me solve this issue?

My ISP has confirmed that they do not have blocks or filters in place. I have also confirmed that no ports are being blocked or filtered from my end too. The name of the nameserver is ns1.sitehosters.in.


auto eth1
iface eth1 inet static


options {
directory "/var/cache/bind";
dnssec-validation auto;
auth-nxdomain no;
listen-on-v6 { any; };

Named.conf.local file on ns1

nano /etc/bind/named.conf.local
zone "sitehosters.in" {
type master;
allow-transfer {none;};

Netstat output from below:

tcp 0 0 . LISTEN 1156/named 
tcp 0 0 localhost:domain . LISTEN 1156/named 
tcp 0 0 localhost:953 . LISTEN 1156/named 
udp 0 0 . 1156/named 
udp 0 0 localhost:domain . 1156/named


No name servers found at child.

No name servers could be found at the child. 
This usually means that the child is not configured to answer queries about the zone.

Please find some screenshots of my router config which might help you to point me in the right direction. I use pfsense on a PC which is managing all the internet connection and firewall.

When using packet capture on my wan port in pfsense, i get

19:05:02.660753 IP xx.xx.xx.xx.13747 > UDP, length 27
19:05:02.669900 IP > xx.xx.xx.xx.13747: UDP, length 509
19:05:02.670409 IP xx.xx.xx.xx.63621 > UDP, length 44
19:05:02.694125 IP xx.xx.xx.xx.34919 > UDP, length 27
19:05:02.704487 IP > xx.xx.xx.xx.34919: UDP, length 509
19:05:02.705580 IP xx.xx.xx.xx.11687 > UDP, length 44
19:05:02.741893 IP > xx.xx.xx.xx.11687: UDP, length 208
19:05:02.741919 IP > xx.xx.xx.xx.63621: UDP, length 208

19:13:39.682095 IP > xx.xx.xx.xx.53: tcp 0
19:13:39.682355 IP xx.xx.xx.xx.53 > tcp 0
19:13:39.893583 IP > xx.xx.xx.xx: tcp 0
19:13:39.894893 IP > xx.xx.xx.xx.53: tcp 34
19:13:39.895023 IP xx.xx.xx.xx.53 > tcp 0
19:13:39.895353 IP xx.xx.xx.xx.53 > tcp 155
19:13:40.100199 IP > xx.xx.xx.xx.53: tcp 0
19:13:40.100220 IP > xx.xx.xx.xx.53: tcp 0

The report at intodns.com says

DNS servers responded   ERROR: One or more of your nameservers did not respond:
The ones that did not respond are: xx.xx.xx.xx
  • Comments are not for extended discussion; this conversation has been moved to chat. – EEAA Jun 22 '17 at 4:34

If you want to run a nameserver that is the authority for an Intenet zone then it will need to be properly addressed with an public IP.

If you must put a name server behind a NAT, then the NAT device must incorporate an appropriate Application Layer Gateway (ALG). Although many NAT devices will incorporate an ALG suitable for NATing the client IP address I don't know if any of them are built to NAT SOA records etc.

If you only have /32 public addresses then you might be able to port-forward through your outer router and then push that through a second NAT device to restore the original destination IP address. Off the top of my head this should work but I haven't thought it through at length.

I haven't looked at yopu configs in detail but notice that you've got defined as name server. Unless you want to restrict your name server to authoritative-only then you'd have that set to

On reflection NATing twice shouldn't be necessary. The DNS server may need to have an interface on it with the public IP address though, you can probably achieve that with a secondary IP on an interface.

  • I have tried putting too. But that does not help....pfsense is capable of ALG as far as i know. This all makes point if i say any packet hitting my DNS server LAN. But packet tracer at pfsense do not show any packets arriving to my DNS Server from WAN. – mindflame Jun 19 '17 at 14:36
  • Using is not meant to help Internet hosts get DNS from you but will force your own DNS server host to use its own DNS server software. These are two separate functions. Some of the comments above to your question are helpful. You need to know whether the nameserver resolves authoritative information at all and the "dig @" that @BrandonXavier describes does this. If you don't get a response to that then you need to turn on query-logging in BIND to check that the query has reached the nameserver software. – marctxk Jun 20 '17 at 13:25
  • I gave dig @ sitehosters.in SOA a shot. Its giving me the SOA, NS and A records.... – mindflame Jun 20 '17 at 14:06
  • Next thing is to try that from your LAN using dig @ ... – marctxk Jun 20 '17 at 14:30
  • It also gives me SOA, NS and A records. But running dig @ sitehosters.in SOA gives me no servers could be reached... – mindflame Jun 20 '17 at 14:35

I figured it out. The ISP had a filter on port 53 even though it was open. Got to change the ISP as they cant remove the block. Thanks all for the time spend solving the issue

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.