DNS forwarding not working properly?

ARMSTRONG, KENNETH

unread,

Mar 26, 2009, 10:58:41 AM3/26/09

to

This is a multi-part message in MIME format.

--===============7850507358485985467==
Content-class: urn:content-classes:message
Content-Type: multipart/alternative;
boundary="----_=_NextPart_001_01C9AE23.5B6D2058"

This is a multi-part message in MIME format.

------_=_NextPart_001_01C9AE23.5B6D2058
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

OK, I've been trying my hardest to figure this out.

I have BIND9 installed and set up as a slave to one of our Domain
Controllers (so we can at least still get DNS if it were to go down). It
works fine for transferring the zone file of our domain down, and from
the server running BIND I can resolve hostnames of our local network
machines along with outside names such as google.com (using nslookup,
yeah I know it sucks).

However, when I set up one of my Windows XP clients to use the new
server for DNS, it can resolve local machine names fine when I run
nslookup against it, but it gives me "Query refused" when trying to
resolve an outside DNS name.

I ran nslookup against the ISP's DNS IP's and can resolve the outside
hostnames just fine, but for some reason I can't resolve them against
the new DNS server.

I have not made any modifications to /etc/bind/named.conf. Instead, I
have put my configurations in /etc/bind/named.conf.local (since that is
what the named.conf file says to do).

Here is my /etc/bind/named.conf.local file (protected of course):

Code:

zone "OURDOMAIN.COM" {
type slave;
masters {
192.168.1.22;
192.168.1.23;
};
file "OURDOMAIN.COM.db";
allow-transfer {
any;
};
allow-query {
any;
};
};
=20
zone "192.168.in-addr.arpa" {
type slave;
masters {
192.168.1.22;
192.168.1.23;
};
file "192.168.in-addr.arpa.db";
allow-transfer {
any;
};
allow-query {
any;
};
};

And my /etc/bind/named.conf.options:

Code:

options {
directory "/var/cache/bind";
=20
forwarders {
216.12.0.20;
216.12.48.23;
};
=20
auth-nxdomain no;
listen-on-v6 { any; };
};

Again, this only seems to affect outside clients, I can run queries on
nslookup just fine on the DNS server itself.

Any help would be greatly appreciated.

=20

Kenny

------_=_NextPart_001_01C9AE23.5B6D2058
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

OK, I've been trying my hardest to figure this out. 
 
I have BIND9 installed and set up as a slave to one of our Domain =
Controllers
(so we can at least still get DNS if it were to go down). It works fine =
for
transferring the zone file of our domain down, and from the server =
running BIND
I can resolve hostnames of our local network machines along with outside =
names
such as google.com (using nslookup, yeah I know it sucks). 
 
However, when I set up one of my Windows XP clients to use the new =
server for
DNS, it can resolve local machine names fine when I run nslookup against =
it,
but it gives me "Query refused" when trying to resolve an =
outside DNS
name. 
 
I ran nslookup against the ISP's DNS IP's and can resolve the outside =
hostnames
just fine, but for some reason I can't resolve them against the new DNS =
server. 
 
I have not made any modifications to /etc/bind/named.conf. Instead, I =
have put
my configurations in /etc/bind/named.conf.local (since that is what the
named.conf file says to do). 
 
Here is my /etc/bind/named.conf.local file (protected of =
course):<o:p></o:p>

Code:<o:p></o:p>

And my
/etc/bind/named.conf.options:<o:p></o:p>

Code:<o:p></o:p>

Again, this only seems to affect outside clients, I can run =
queries on
nslookup just fine on the DNS server itself. 
 
Any help would be greatly appreciated.<o:p></o:p></p=
>

<o:p> </o:p>

Kenny<o:p></o:p>

</div>

</body>

</html>

------_=_NextPart_001_01C9AE23.5B6D2058--

--===============7850507358485985467==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
bind-users mailing list
bind-...@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
--===============7850507358485985467==--

Jonathan Petersson

unread,

Mar 26, 2009, 11:32:57 AM3/26/09

to

You need to enable recursion in options.

/Jonathan

2009/3/26 ARMSTRONG, KENNETH <KARMS...@botetourtva.us>:

> OK, I've been trying my hardest to figure this out.
>
> I have BIND9 installed and set up as a slave to one of our Domain
> Controllers (so we can at least still get DNS if it were to go down). It
> works fine for transferring the zone file of our domain down, and from the
> server running BIND I can resolve hostnames of our local network machines

> along with outside names such as google.com (using nslookup, yeah I know =

it
> sucks).
>
> However, when I set up one of my Windows XP clients to use the new server

> for DNS, it can resolve local machine names fine when I run nslookup agai=
nst

> it, but it gives me "Query refused" when trying to resolve an outside DNS
> name.
>
> I ran nslookup against the ISP's DNS IP's and can resolve the outside
> hostnames just fine, but for some reason I can't resolve them against the
> new DNS server.
>
> I have not made any modifications to /etc/bind/named.conf. Instead, I have

> put my configurations in /etc/bind/named.conf.local (since that is what t=
he

> named.conf file says to do).
>
> Here is my /etc/bind/named.conf.local file (protected of course):
>
> Code:
>
> zone "OURDOMAIN.COM" {
>

> =A0=A0=A0=A0=A0=A0 type slave;
>
> =A0=A0=A0=A0=A0=A0 masters {
>
> =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 192.168.1.22;
>
> =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 192.168.1.23;
>
> =A0=A0=A0=A0=A0=A0 };
>
> =A0=A0=A0=A0=A0 =A0file "OURDOMAIN.COM.db";
>
> =A0=A0=A0=A0=A0=A0 allow-transfer {
>
> =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 any;
>
> =A0=A0=A0=A0=A0=A0 };
>
> =A0=A0=A0=A0=A0=A0 allow-query {
>
> =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 any;
>
> =A0=A0=A0=A0=A0=A0 };
>
> };
>
>
>
> zone "192.168.in-addr.arpa" {
>
> =A0=A0=A0=A0=A0=A0 type slave;
>
> =A0=A0=A0=A0=A0=A0 masters {
>
> =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 192.168.1.22;
>
> =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 192.168.1.23;
>
> =A0=A0=A0=A0=A0=A0 };
>
> =A0=A0=A0=A0=A0=A0 file "192.168.in-addr.arpa.db";
>
> =A0=A0=A0=A0=A0=A0 allow-transfer {
>
> =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 any;
>
> =A0=A0=A0=A0=A0=A0 };
>
> =A0=A0=A0=A0=A0=A0 allow-query {
>
> =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 any;
>
> =A0=A0=A0=A0=A0=A0 };

>
> };
>
> And my /etc/bind/named.conf.options:
>
> Code:
>
> options {
>

> =A0=A0=A0=A0=A0=A0=A0 directory "/var/cache/bind";
>
>
>
> =A0=A0=A0=A0=A0=A0=A0 forwarders {
>
> =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 216.12.0.20;
>
> =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 216.12.48.23;
>
> =A0=A0=A0=A0=A0=A0=A0 };
>
>
>
> =A0=A0=A0=A0=A0=A0=A0 auth-nxdomain no;
>
> =A0=A0=A0=A0=A0=A0=A0 listen-on-v6 { any; };

>
> };
>
> Again, this only seems to affect outside clients, I can run queries on
> nslookup just fine on the DNS server itself.
>
> Any help would be greatly appreciated.
>
>
>

> Kenny

ARMSTRONG, KENNETH

unread,

Mar 26, 2009, 12:11:52 PM3/26/09

to

Thanks, I gave that a go and now when I run a query I get "No response from=
server" when running nslookup. I tried restarting bind and now I get the =
"rndc: connect failed: 127.0.0.1#953: connection refused" error. I then tr=
ied running rndc-confgen, and added the following to rndc.conf:

key "rndc-key" {
algorithm hmac-md5;
secret "stuff here";
};

options {
default-key "rndc-key";
default-server 127.0.0.1;
default-port 953;
};

And created rndc.conf file with the following:

key "rndc-key" {
algorithm hmac-md5;
secret "stuff here";
};

But I still get the connection failed error as above when I try to restart =
bind.

Jeremy C. Reed

unread,

Mar 26, 2009, 12:44:15 PM3/26/09

to

On Thu, 26 Mar 2009, ARMSTRONG, KENNETH wrote:

> Thanks, I gave that a go and now when I run a query I get "No response

> from server" when running nslookup. I tried restarting bind and now I
> get the "rndc: connect failed: 127.0.0.1#953: connection refused" error.
> I then tried running rndc-confgen, and added the following to rndc.conf:

Is your named even running?

Check your logs.

Run named-checkconf.

ARMSTRONG, KENNETH

unread,

Mar 26, 2009, 12:50:40 PM3/26/09

to

Aha!

Thanks, checking the config showed that I had messed up my syntax at the
recursion statement. I corrected that and was able to start bind, and
now I can run nslookup on my XP clients to resolve other domains!
Thanks to all for your help!!

Kenny

-----Original Message-----
From: Jeremy C. Reed [mailto:Jerem...@isc.org]
Sent: Thursday, March 26, 2009 12:44 PM
To: ARMSTRONG, KENNETH
Cc: bind-...@lists.isc.org