Dotaz: funkce nameserveru zavisla od ISP

[denzita]

Zdravim vsechny,

prosim o radu... mam nastaveny BIND 9.2.3 (Suse 9.1)pro domenu II. radu;

Kdyz server prihlasim u jednoho poskytovatele ISP (ADSL telekom.at staticka) tak nameserver funguje a odpovida na DNS dotazy z internetu:

napr: nslookup

> server neco.nekde

host.bla.domena.cz

vraci zaznam_ip pro host, a vse je ok...

pokud server pripojim na jiny ISP (kabel chello.sk dynamicka) tak mi vraci pouze timeout na DNS dotazy z internetu!!!. A pritom na pozadavek transferu zony reaguje (nslookup ls -h bla.domena.cz);

Kdyz sleduju UDP/TCP pakety na port 53 tak pri DNS dotazu na zonu vubec nic zvenku nedojde; Helpdesk od chello.sk mi tvrdi, ze port 53 v zadnem smeru neblokuji na FW...

Je chyba v konceptu? Neni snad funkcni rozdil mezi dynam. a stat. adresou z hlediska sluzby na portu 53...?

Neprikladam zatim zadne conf. protoze u jednoho ISP nameserver funguje ok...

diky, Denzita

Motto: Delvita

Odpovědi

[Michal Kubeček]

Jak vypadá ta konfigurace, používáte forwarders nebo se ptáte na všechno sám? Není u toho druhého připojení problém v tom, že vám DHCP klient přepíše resolv.conf?

[denzita]

forwarders nejsou nastavene, ze domeny jsou zatim jen virtualni - neregistrovane.

na resolv.conf se zamerim, a dam sem zitra (patek) update i s config's... az prevezu server z vidne do bratislavy....

zatim dik, d.

[denzita]

Upravil jsem parametr aby DHCP klient neprepisoval resolv.conf a pridal jsem frowarders na nameservery ISP; ale nepomohlo; pro vnitrni sit mi NAMED odpovida spravne, ale z internetu mam stale timeout. A se snortem nevidim zadne UDP/TCP packety na p.53.

Nejvic me mate, ze ostatni sluzby (ssh,ftp,http) funguji i pro internet a navic server reaguje na transfer zony (nslookup ls -h).

Diky moc, jestli Vas neco napadne. Configurace je takova:

/etc/named.conf
options {
  directory "/var/lib/named";
  allow-query { any; };
  allow-transfer { any; };
  auth-nxdomain yes;
  forward first;
  forwarders {
  217.23.240.134;
  217.23.240.135; };
  };
zone "localhost" in {
  type master;
  file "localhost.zone";
};
zone "0.0.127.in-addr.arpa" in{
  type master;
  file "localhost.rev";
};
zone "8.140.10.in-addr.arpa" in{
  type master;
  file "8.140.10.in-addr.arpa.zone";
   notify no;
};
zone "comverse.int" in{
  type master;
  file "comverse.int.zone";
   notify no;
};


cat comverse.int.zone
-----------------------------------------------------
$TTL 86400
@               IN SOA localhost. comverse.int. (
                              10 ; Serial
                         604800 ; Refresh
                          86400 ; Retry
                        2419200 ; Expire
                         604800 ) ; Minimum
@               IN NS gunts.comverse.int.
gunts.comverse.int.       A     10.140.8.53
53.8.140.10.in-addr.arpa. PTR   gunts.comverse.int.
host1                     CNAME gunts.comverse.int.
host2                     CNAME gunts.comverse.int.

cat 8.140.10.in-addr.arpa.zone
-----------------------------------------------------
$TTL 86400
@               IN SOA localhost. comverse.int. (
                              10 ; Serial
                         604800 ; Refresh
                          86400 ; Retry
                        2419200 ; Expire
                         604800 ) ; Minimum
@               IN NS gunts.comverse.int.
53 IN PTR gunts.comverse.int.


cat /etc/resolv.conf   // telekom AT, fix adr. kde server funguje
-----------------------------------------------------
nameserver 195.3.96.67
nameserver 195.3.96.68
search telekom.at

test:
------------------------------------------------------
D:\#nslookup -timeout=5
Default Server:  il-tlv-gc01.comverse.com
Address:  10.115.243.30

# server 80.120.176.54
Default Server:  [80.120.176.54]
Address:  80.120.176.54

# host1.comverse.int
Server:  [80.120.176.54]
Address:  80.120.176.54

Name:    gunts.comverse.int
Address:  10.140.8.53
Aliases:  host1.comverse.int

# host2.comverse.int
Server:  [80.120.176.54]
Address:  80.120.176.54

Name:    gunts.comverse.int
Address:  10.140.8.53
Aliases:  host2.comverse.int

# set d2
# ls -h comverse.int
[[80.120.176.54]]
Received AXFR message:  questions=1, answers=7

cat /etc/resolv.conf     // rucni nastaveni u ISP chello.sk 
- vraci mi timeout z internetu
-----------------------------------------------------
nameserver 192.168.1.104
nameserver 217.23.240.134
nameserver 217.23.240.135

test:
-----------------------------------------------------
C:\#nslookup -timeout=5
Default Server:  at-vie-bdc.comverse.com
Address:  10.140.8.40

# server 217.23.253.149
Default Server:  chello217023253149.chello.sk
Address:  217.23.253.149

# host1.comverse.int
Server:  chello217023253149.chello.sk
Address:  217.23.253.149

DNS request timed out.
    timeout was 5 seconds.
DNS request timed out.
    timeout was 5 seconds.
*** Request to chello217023253149.chello.sk timed-out
# host2.comverse.int
Server:  chello217023253149.chello.sk
Address:  217.23.253.149

DNS request timed out.
    timeout was 5 seconds.
DNS request timed out.
    timeout was 5 seconds.
*** Request to chello217023253149.chello.sk timed-out
#
# ls -h comverse.int
[chello217023253149.chello.sk]
#

konec prispevku

[tomas84]

Nemáte špatně nastavený firewall? Mně na té adrese chello217023253149.chello.sk nejede DNS, web ani SSH...

[denzita]

Mate pravdu, mezi tim mi totiz zmenili adresu. Mel jsem radsi uvest link z DynDNS.org: muller.ath.cx.

FW mam off, momentalne bezi pouze sluzby dns,ssh.

A takhle spravne mi to odpovida, kdyz z vnitrni site simuluju pristup k nameserveru z internetu. Timeout to vraci jen a jen pro dns query z internetu.

k zblazneni... D.

D:\>nslookup
Default Server:  UnKnown
Address:  192.168.1.1
> server muller.ath.cx
Default Server:  muller.ath.cx
Address:  217.23.250.167

> host1.comverse.int
Server:  muller.ath.cx
Address:  217.23.250.167

Name:    gunts.comverse.int
Address:  10.140.8.53
Aliases:  host1.comverse.int

[tomas84]

Zdá se, že DNS server funguje, ale pouze na TCP portu. Na UDP to bude někde dropnuté a nebo špatně routované.

tomas@notas:~$ dig +tcp @muller.ath.cx comverse.com

; <<>> DiG 9.3.1 <<>> +tcp @muller.ath.cx comverse.com
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8912
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 4

;; QUESTION SECTION:
;comverse.com.                  IN      A

;; ANSWER SECTION:
comverse.com.           3600    IN      A       63.64.185.200

;; AUTHORITY SECTION:
comverse.com.           86400   IN      NS      ns3.comverse.com.
comverse.com.           86400   IN      NS      ns4.comverse.com.
comverse.com.           86400   IN      NS      ns1.comverse.com.
comverse.com.           86400   IN      NS      ns2.comverse.com.

;; ADDITIONAL SECTION:
ns1.comverse.com.       69021   IN      A       63.64.185.114
ns2.comverse.com.       172695  IN      A       63.64.185.115
ns3.comverse.com.       172697  IN      A       192.118.49.2
ns4.comverse.com.       172697  IN      A       192.118.49.3

;; Query time: 1608 msec
;; SERVER: 217.23.250.167#53(217.23.250.167)
;; WHEN: Sun Aug 14 20:07:22 2005
;; MSG SIZE  rcvd: 182

[denzita]

zkuste to prosim jeste pro comverse.int na NS muller.ath.cx ; protoze comverse.com je komercni portal z israele.

diky D*

[tomas84]

Tohle nemá na komunikaci se serverem vliv. UDP pořád zablokované, TCP funguje

[denzita]

Tak mi chello sk potvrdil ze mi blokuji UDP na p.53. Po te co mi 14dni tvrdili ze tam zadny FW neni. Tim se so vysvetluje a ja dekuju vsem zucastnenym za radu/pomoc. Diky D.