XP DNS requests

XP DNS requests

[Wyburn, Marc Anil]

This problem has go tme stumped!!!!  I have netfilter setup (v 1.2.8.13) on a Fedora Core 1 box.  It seems to be working fine except that I it is dropping DNS requesets from XP clients.  Win2K and NT clients work fine.  If I do an NSlookup on the XP box it resolves names fine.  If I try to connect ot the pages it will connect once or twice but then iptables starts dropping all the DNS requests on their way out.  Heres a syslog entry.

Jun	14	10:00:31	fw	kernel:	IN=eth1	OUT=	eth0 SRC=192.168.0.19 DST=***.***.***.*** LEN=61	TOS=0x00 PREC=0x00 TTL=127 ID=26601 PROTO=UDP SPT=1029 DPT=53 LEN=41	

I don't think that iptables is the problem since every other PC works fine.  I've even looked at the packets in Ethereal but can't work out why this is happening. Has anyone else come across this??

Cheers for any help Marc.

Re: XP DNS requests (nfcan: addressed to exclusive sender for this address)

[Jim Laurino]

On 2004.06.14 09:25, Wyburn Marc Anil  - Marc.Wyburn@gb. 
unisys.com wrote:

> This problem has got me stumped!!!!  I have netfilter
> setup (v 1.2.8.13) on a Fedora Core 1 box.  It seems to  
> be working fine except that I it is dropping DNS  
> requesets from XP clients.  Win2K and NT clients work  
> fine.  If I do an NSlookup on the XP box it resolves  
> names fine.  If I try to connect it will connect once
> or twice but then iptables starts dropping all the DNS  
> requests on their way out.
> Heres a syslog entry.
> 
> Jun 14 10:00:31 fw kernel: IN=eth1 OUT=eth0
> SRC=192.168.0.19 DST=***.***.***.***
> LEN=61 TOS=0x00 PREC=0x00 TTL=127 ID=26601
> PROTO=UDP SPT=1029 DPT=53 LEN=41	
>
Well, it seems that you are logging it.
Why do you think iptables is not the source
of the log message you showed above?

If you are logging this from iptables,
then you could add something like:
... -j LOG --log-prefix "IPT DNS REJ "
to confirm the rule involved.

Perhaps knowing the rule involved would
provide some insight?

You could also look at the counts, using:
  iptables -L -nvx
to see if you can identify the rule that way.

I think I had an XP related problem that
resulted from being very fussy about dns
connections. I think XP uses a varying high
source port, like the 1029 your log shows,
and I think that may be unusual.

Is it possible that you have rules that
might block upd source ports in this range?

Jim

Re: XP DNS requests

[Chris Brenton]

On Mon, 2004-06-14 at 09:25, Wyburn, Marc Anil wrote:
>
> Jun	14	10:00:31	fw	kernel:	IN=eth1	OUT=	eth0 SRC=192.168.0.19 DST=***.***.***.*** LEN=61	TOS=0x00 PREC=0x00 TTL=127 ID=26601 PROTO=UDP SPT=1029 DPT=53 LEN=41	

You didn't specify what rule is logging this traffic. Is it your default
drop rule or something earlier?

Try this on the XP box the next time queries start to fail:

ipconfig /flushdns

If you now start working fine, your DNS is just running slow and XP is
caching negative entries. Make the following reg key change:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters

DWORD: MaxNegativeCacheTtl
Value: 0

Reboot and you should be all set.

HTH,
Chris