Re: queer dns access problem


It sounds like it is a networking issue. If it didn't have the correct
gateway it makes sense that you would be able to access everything locally
on your subnet, but when it comes time to get out of your subnet it
wouldn't know the route to get there. Other possibilities are your
firewall/router just doesn't allow your IP outbound or there is a NAT
mis-configuration. Does your server require a static 1-to-1 NAT or should
it fall into a pool?

The following is why I don't think its a firewall issue.

server a.com is broken.
server b.com is not.
If I change the name and IP address of a.com to match b.com, remove b.com
from the network, and reboot a.com (as b.com), it still has the same DNS
problem. If the firewall was looking to reject a.com traffic, why won't it
work when it is set up like b.com?

Is it possible that this is some bizarre SELinux problem? Perhaps the
resolv.conf or nsswitch.conf file has the wrong context, or something?
I've seen nothing in the logs that would inicate that, but who knows. I'm
not at work right now, so I can't check it until tomorrow. This is the
most bizarre problem I've ever encountered.






----- "Bill Tangren" <bjt@xxxxxxxxxxxxx> wrote:
Earlier you said you could ssh out of the broken box. Can you ssh
to the
same segment or to a remote network? Can you log in to the box
twice and
start a packet capture while you attempt a dns lookup? This might
show us
if it is related to firewalling or routing.


If by the same segment, you mean within the same 10.1.5.x domain, I
can
ssh if I use the IP number to the same segment (there are errors, but
it
ultimately succeeds), but I cannot ssh out of the segment, with or
without
IP number. Also, I can ssh into the broken box from within the
segment.



Ian

----- "Bill Tangren" <bjt@xxxxxxxxxxxxx> wrote:
On Dec 13, 2007 8:02 AM, Bill Tangren <bjt@xxxxxxxxxxxxx> wrote:


OK. Is the /8 netmask a cut and paste error too?

No, it is correct.


Your trouble could be a routing issue: 10.1.5.58/8 and
10.1.1.46/8 are
on the same subnet as far as the network layer is concerned
so
there
is
no reason to go to the default route. Thats why I asked for
a
traceroute too -- or mtr if you have it installed and it will
work.

# mtr -rnc 10 DNS.SERVER.IP.ADDRESS

What netmask is the firewall using for the interface?


When the network guy comes in this afternoon, I'll ask. This
still
doesn't
explain why it works for one machine, but not the other, when
both
are
set
the same.

I am assuming you've done the usual stuff

double checked /etc/resolv.conf

checked /etc/nsswitch.conf


Did these two.


Pinged the default gateway.


Ping is shut off on the gateway. I'll ask the firewall guy to turn
it
on
long enough to test this.

Checked the network cabling back to the switch.

Yes, other computers work just fine with this cabling.


Checked the patch cable.


Patch cable? What is that?

ifconfig to make sure the interface is actually up.


yep.

ethtool to check that speed and duplex are as expected.


Didn't think to do this. Will try it on Monday.

Can't think of anything else offhand.


Thanks for the help.

--
Stephen Carville






--
redhat-list mailing list
unsubscribe mailto:redhat-list-request@xxxxxxxxxx?subject=unsubscribe
https://www.redhat.com/mailman/listinfo/redhat-list

Relevant Pages

  • Re: How expand domain subnet?
    ... But if my LAN was going to contain less than 200 Ethernet nodes, ... subnet would reduce the number of possible clients to 62. ... Add a new segment. ... and VPN clients (managed by PIX firewall). ...
    (microsoft.public.windows.server.networking)
  • Re: Routing and Remote Access - Please Help
    ... when it got to the firewall, where would it go?, no where. ... It makes sense that the gateway 192.168.2.1 won't exist to the ... my gateway for clients on subnet A are ... that subnet and ISA firewall. ...
    (microsoft.public.windows.server.networking)
  • Re: How expand domain subnet?
    ... subnet would reduce the number of possible clients to 62. ... Add a new segment. ... and VPN clients (managed by PIX firewall). ...
    (microsoft.public.windows.server.networking)
  • Re: [fw-wiz] Firewall routing thought...
    ... Aaahhhh, if they are on the same subnet, why is the gateway involved at ... >> If one has firewall A with external ip on the same subnet as firewall B. ... >> How common is the practice of adding static routes on firewall A for The ...
    (Firewall-Wizards)
  • Re: firewall ??
    ... > servers I have to use and the Default Gateway. ... > network to access the net while providing a secure environment. ... > firewall with Internet connection sharing that acts as a new default ... You will need to subnet your class B. You can setup a firewall ...
    (Fedora)