Configuratie server DNS

Va salut,

am incercat sa configurez un domeniu folosind Zpanel pe CentOS 6.4 i686

Am deshis portul 53(udp si tcp), http://www.yougetsig...ols/open-ports/ raporteaza portul ca fiind deschis.

Totusi  http://www.intodns.com spune ca:
ERROR: One or more of your nameservers did not respond:

Serverul este in spatele unui router insa IP-ul lui este pus in DMZ.

/etc/resolv.conf
; generated by /sbin/dhclient-script
nameserver 192.168.2.1

/etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
127.0.0.1 autoreply.nume.server
127.0.0.1 nume.server

Orice sfat este binevenit.

Edited by zangaby, 03 June 2013 - 11:43.

Verifica din servicul iptables daca portul 53 este deschis si tcp si udp.

iptables -nvL

iptables -nvL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target	 prot opt in	 out	 source			   destination
	0	 0 ACCEPT	 udp  --  *	  *	   0.0.0.0/0			0.0.0.0/0		   state NEW udp dpt:53
	0	 0 ACCEPT	 tcp  --  *	  *	   0.0.0.0/0			0.0.0.0/0		   state NEW tcp dpt:53

Verifica daca ai serviciul pornit

[[email protected] ~]# /etc/init.d/named status
version: 9.8.2rc1-RedHat-9.8.2-0.17.rc1.el6_4.4
CPUs found: 4
worker threads: 4
number of zones: 24
debug level: 0
xfers running: 0
xfers deferred: 0
soa queries in progress: 0
query logging is OFF
recursive clients: 0/0/1000
tcp clients: 0/100
server is up and running
named (pid  29351) is running...

apoi fa o interogare la serviciul de DNS
[root@XXXXX ~]# host google.com 127.0.0.1

/etc/init.d/named status
WARNING: key file (/etc/rndc.key) exists, but using default configuration file (/etc/rndc.conf)
rndc: get config key list: not found
named (pid  1276) is running...


[root@srv /]# host google.com 127.0.0.1
Using domain server:
Name: 127.0.0.1
Address: 127.0.0.1#53
Aliases:
google.com has address 173.194.70.101
google.com has address 173.194.70.100
google.com has address 173.194.70.113
google.com has address 173.194.70.102
google.com has address 173.194.70.138
google.com has address 173.194.70.139
google.com has IPv6 address 2a00:1450:4001:c02::8b
google.com mail is handled by 30 alt2.aspmx.l.google.com.
google.com mail is handled by 50 alt4.aspmx.l.google.com.
google.com mail is handled by 40 alt3.aspmx.l.google.com.
google.com mail is handled by 20 alt1.aspmx.l.google.com.
google.com mail is handled by 10 aspmx.l.google.com.

request, on 03 iunie 2013 - 11:52, said:

request, on 03 iunie 2013 - 12:16, said:

Daca un port apare open => serviciul care asculta e pornit ce ai zis mai sus in cele 2 posturi e redundant. In ordinea in care l-ai pus pe om sa verifice. Si BIND rezolva cereri venite pe bucla locala de aici si mesajul ala pe care il primeste. Toata problema e din /etc/named.conf ce trebuie editat si permise query-uri de la 0/0 adica de la oricine si sa configureze BIND-ul ala sa nu fie folosit de altii ca si cache adica la interogari altele decat cele legate de domeniul lui sa nu raspunda.

Va multumesc pentru raspusuri.

momentan named.conf arata asa:


options {
    listen-on port 53 { any; };
    directory    "/var/named";
    dump-file    "/var/named/data/cache_dump.db";
    statistics-file "/var/named/data/named_stats.txt";
    memstatistics-file "/var/named/data/named_mem_stats.txt";
    allow-query { any; };
    recursion yes;
    dnssec-enable yes;
    dnssec-validation yes;
    dnssec-lookaside auto;
    /* Path to ISC DLV key */
    bindkeys-file "/etc/named.iscdlv.key";
};
logging {
    channel default_debug {
    file "data/named.run";
    severity dynamic;
    };
};
zone "." IN {
    type hint;
    file "named.ca";
};
include "/etc/named.rfc1912.zones";
include "/etc/zpanel/configs/bind/etc/named.conf";

host whatever $eth+ unde $eth+ este IPul pus pe interfata dinspre internet, in cazul tau cred ca este 192.168.2.1 daca vad bine. Daca ai posibilitatea sa verifici si din alta parte, alta locatie fa un telnet pe IPul direct conectat pe port 53 vezi daca te conectezi. Si iptables vad ca permiti doar conexiuni NEW eventual permite si cele ESTABLISHED si RELATED sau permiti tot traficul pe port 53/tcp si 53/udp.

IPul de pe interfata de retea este 192.168.2.107.

host whatever 192.168.2.107
Using domain server:
Name: 192.168.2.107
Address: 192.168.2.107#53
Aliases:
Host whatever not found: 3(NXDOMAIN)

Am pus acum in /etc/resolv.conf nameserverele de la google
; generated by /sbin/dhclient-script
nameserver 8.8.8.8
nameserver 8.8.4.4

Sincer sa fiu m-am inspirat de aici:
http://ostechnix.wor...ic-linux-6-3-3/
pentru portul 53.

Edited by zangaby, 03 June 2013 - 13:51.

host google.com 192.168.2.107 acel whatever la mine inseamna un domeniu, orice domeniu sau IP. Ai zis ca esti in spatele unui router fa telnet $IP_WAN 53 si vezi daca iti zice ceva sau nu. Da-mi PM cu IPul de pe WAN de la router sau spune-l aici sa verificam si din alta parte daca BINDul este accesibil din alta locatie / alt IP in afara de localhost.

telnet 89.xxx.xxx.xx 53
Trying 89.xxx.xxx.xx...
Connected to 89.xxx.xxx.xx.
Escape character is '^]'.

Ai PM cu IP-ul.

Edited by zangaby, 03 June 2013 - 21:34.

Ai raspuns pe PM.

Rezumat:

Quote

Nu e bine acel filtered acolo. DNSul face cererile pe UDP daca nu primeste raspuns incearca si pe tcp insa la tine da timed out.

Multumesc pentru raspuns.

Am inlocuit in iptables, acum arata asa:

Host is up (0.0033s latency).
PORT   STATE SERVICE
53/tcp open  domain
53/udp open  domain

Tot nu raspunde din afara. Verifica log-urile si vezi ce apare acolo. Ceva blocheaza query-urile undeva.

Quote

In messages ultimele mesaje sunt:

Jun 3 21:47:09 srv named[8999]: client 192.168.2.107#36418: RFC 1918 response from Internet for 101.2.168.192.in-addr.arpa
Jun 3 21:55:12 srv named[8999]: client 192.168.2.107#53545: RFC 1918 response from Internet for 107.2.168.192.in-addr.arpa
Jun 3 21:55:12 srv rpc.statd[1315]: nsm_parse_reply: can't decode RPC reply
Jun 3 21:55:13 srv rpc.statd[1315]: nsm_parse_reply: can't decode RPC reply

Edited by zangaby, 03 June 2013 - 22:16.

Uitate si in celelalte fisiere din /var/named/chroot/dev/log/ si vezi ce se zice pe acolo. Parca m-am mai lovit de o problema asemanatoare doar ca nu mai tin minte cand si cum s-a rezolvat. Si nu am nici masina de la munca pornita sa arunc o privire pe ea sa vad daca nu cumva acolo a fost problema. Sau a fost aceiasi problema pe un PCLinuxOS ce il am pe un laptop. numai stiu exact. Incerc sa imi amintesc ce am facut atunci.

Chroot nu e activat iar in /var/named/data/named.run nu vad mare lucru:

<mesaj de incarcare a zonei>
client 192.168.2.107#37305: RFC 1918 response from Internet for 101.2.168.192.in																						-addr.arpa
error (connection refused) resolving 'ns5.thepiratebay.sh/A/IN': 194.71.107.1#53

UPDATE:
Se pare ca problema este totusi in afara, am folosit http://nmap.online-domain-tools.com/ si cu iptables oprit arata:

Host is up (0.015s latency).
PORT STATE SERVICE
53/tcp open domain
53/udp open|filtered domain
Nmap done: 1 IP address (1 host up) scanned in 0.44 seconds