On 5/20/2012 10:07 AM, Saif Ahmed wrote:
Hi,
I have configured authuritive only DNS,
It's respond well internally
But not answer the public quires,
options {
directory "/etc/named";
// version statement - inhibited for security
// (avoids hacking any known weaknesses)
version "not currently available";
// allows notifies only from master
allow-notify {172.20.10.10; };
// disables all zone transfer requests
allow-transfer{"none"; };
allow-query { any; };
query-source address * port 53;
recursion no;
pid-file "/var/run/named/named.pid";
below the tcpdump "udp port 53" result
17:05:03.913856 IP (tos 0x0, ttl 106, id 6612, offset 0, flags [none], proto
UDP (17), length 52)
peach.dnsstuff.com.pmsm-webrctl> 192.168.30.100.domain: [udp sum ok] 1+
A? com.iq. (24)
17:05:03.914396 IP (tos 0x0, ttl 64, id 28758, offset 0, flags [DF], proto
UDP (17), length 73)
Waiting for your advise;
OK, so you got an incoming query for com.iq/a from peach.dnsstuff.com.
Was the outgoing response packet also in your capture? What did it look
like? It should have been a NODATA response (NOERROR, 0 answers, an SOA
record in the Authority Section for negative caching), or possibly just
a root-zone referral, depending what authoritative zones are configured
in the instance.
If you don't see an outgoing response packet, check for any "blackhole"s
defined in your config. If that's not the cause, then check the network
configuration of your box. Maybe the response is going out the wrong
interface.
By the way, you should not port-limit your query source address. That
makes it easier for malicious people to forge DNS responses back to you.
- Kevin
_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe
from this list
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
