dns queries...

From: Chris H. (nas_at_HELLOWORLDnasland.nu)
Date: 01/17/04 

Date: Sat, 17 Jan 2004 13:15:48 -0500

i've recently upgraded my internal server hardware, and restored all server
configs from backup. dns, however, being the only problem so far. i'm
running bind9 and all internal queries are working as they should, but
external queries are getting stopped somewhere along the path to my box and
i've tried everything i can think of.

after ssh'ing to a remote box i've ran nmap which is reporting the port to
be open (not filtered). likewise, if i telnet my.dns.server 53 it connects,
however running both iptraf and named -g -d 3 is showing no real
connection. under iptraf if i telnet my.dns.server 53 it shows traffic on
port 53, however doing that externally produces nothing almost like its
firewalled. same thing with named -g -d 3, if i run an nslookup host.foo it
shows the lan box connecting, requesting the dns entry and then returning
it. doing that from an external box produces nothing...almost like its
firewalled.

so obviously the first idea was if its port forwarded correctly and that the
config properlly allows incoming external connections. the ip was changed
since it was a major hardware upgrade and is physically in a new case i
felt i should change the ip and give it a new name. on the router i changed
the ip for port 53 forwarding, and updated both my internal ip listing
db.192.168.1 and my IN NS entry to point to the new ip.

secondly, there is absolutely no firewall running on the internal server at
this time. so thats out. however, could it be possible that the port be
open, non-filtered, and my isp has all of the sudden stopped allowing dns
queries from external hosts somehow, but still allowing telnet to connect
to that very port?

telnet to port 53, as i said is showing connected to foo when i run it from
an external box, but also as i said it doesnt seem to be fully connecting
when i look at iptraf. its almost like its half opening the connection.
this being the most likely cause of not being able to get dns queries from
an external host.

so the question is...is this a configuration problem i have missed, or is it
likely the isp has screwed something up overnight and i am sol?

thanks. 

-- 
Chris H.
http://www.nasland.nu

Relevant Pages

  • Re: Inbound email problem
    ... Could it be that Qwest is blocking port 25 traffic? ... It sounds like they are not matching in DNS. ... Do you have exchange server antispam or connection filtering enabled? ...
    (microsoft.public.windows.server.sbs)
  • Re: fc3, sendmail, dovecot: cannot receive from outside
    ... The details of that connection are in the ... That has nothing to do with any DNS ... > will find their way to the LAN hosts with private block IPs? ... ID Public Port Private Port TCP/UDP Private Address ...
    (Fedora)
  • Re: blocking RFC 793 ports 1024-49151
    ... not much you can do about UDP, but for TCP just block all packets with the ... SYN bit set, except on the DNS, ftp and http ports. ... a TCP connection cannot be formed. ... The port numbers are chosen by the kernel, and as far as I know ...
    (comp.os.linux.security)
  • Re: blocking RFC 793 ports 1024-49151
    ... not much you can do about UDP, but for TCP just block all packets with the ... SYN bit set, except on the DNS, ftp and http ports. ... a TCP connection cannot be formed. ... The port numbers are chosen by the kernel, and as far as I know ...
    (comp.security.firewalls)
  • Re: blocking RFC 793 ports 1024-49151
    ... not much you can do about UDP, but for TCP just block all packets with the ... SYN bit set, except on the DNS, ftp and http ports. ... a TCP connection cannot be formed. ... The port numbers are chosen by the kernel, and as far as I know ...
    (comp.security.unix)
Loading