DNS question

DNS question

[Reed Wiedower]

I'm having some trouble with DNS queries making it through the filters...if
I allow connections out to use udp port 53, that should allow clients inside
the firewall to query external dns servers for information, correct? Do I
need to open any other ports? (Of course, I have "related, established"
open, so I assume the DNS server response will work properly). Am I missing
somthing?

end of line,

Reed


reed wiedower
reed.wiedower@peyser.com
peyser.com
202.638.3730x115

Re: DNS question

[Maciej Soltysiak]

> I'm having some trouble with DNS queries making it through the filters...if
> I allow connections out to use udp port 53, that should allow clients inside
> the firewall to query external dns servers for information, correct? Do I
> need to open any other ports? (Of course, I have "related, established"
> open, so I assume the DNS server response will work properly). Am I missing
> somthing?
If a dns query via udp fails (or it has over 512 bytes, and the Trunacated
bit set), the resolver is obligated to commit the query via tcp.

In order to have dns queries working with external DNS servers, the
clients must be able to send tcp and udp with dport 53 to the servers,
and the replies must get back, e.g. using the state mechanism.

If you have a DNS server in your network and want to allow dns queries to
your server you need to allow both tcp and udp with dport 53 to your DNS.

Also, TCP is used for zone transfers.

If you fail to solve your problem, try tcpdumping the traffic on the
firewall, you will know what is being send, what is being block.

Regards,
Maciej Soltysiak

DNS question

[John Black]

I'm trying to setup DNS for domain.  Is there a mailing list or some really good
documentation online on setting up DNS with only one static ip address?


thanks
John



http://www.arbbs.net/

Re: DNS question

[Antony Stone]

On Monday 01 March 2004 7:46 pm, John Black wrote:

> I'm trying to setup DNS for domain.  Is there a mailing list or some really
> good documentation online on setting up DNS with only one static ip
> address?

What is special about having only one IP address?

Obviously if you have only one server you don't get any resiliency / 
redundancy, but presumably you either don't mind, or else you're getting 
someone else to act as secondary for you?

Maybe it's me, but I'm not sure I understand your problem.

Regards,

Antony.

-- 
"Note: Windows 98, Windows 98SE and Windows 95 are not affected by [MS
Blaster].   However, these products are no longer supported.   Users of these
products are strongly encouraged to upgrade to later versions."

(which *are* affected by MS Blaster...)

http://www.microsoft.com/security/security_bulletins/ms03-026.asp

                                                     Please reply to the list;
                                                           please don't CC me.

RE: DNS question

[Daniel Chemko]

John Black wrote:
> I'm trying to setup DNS for domain.  Is there a mailing list or some
> really good documentation online on setting up DNS with only one
> static ip address?  

Try www.isc.org if you use bind. That's all I needed to set up a quite
complex DNS setup from 0 knowledge. I guess the Oreilly book helped as
well.

Re: DNS question

[John Black]

> What is special about having only one IP address?
i have a private subnet at work with only one static ip address.  which they
are authoritative over the subnet.


> Obviously if you have only one server you don't get any resiliency /
> redundancy, but presumably you either don't mind, or else you're getting
> someone else to act as secondary for you?
I have an internal mail, ftp, and web server that I want to grant access to,
from the outside world.


the problem is I'm trying to setup a nonauthoritative dns server.  And I
have never setup a dns server before


thanks for everyone's help

john

dns question

[Peter Marshall]

I am sure this is a stupid question ...but I will ask anyway.  Should I be
allowing my dns server (in my dmz) connect to root servers ?   At the moment
it is being bloced, and the only thing it can connect to is my ISP's DNS
server.  Basically, my dns server serves requests for servers in my dmz for
my internal users.  If it can't find the hit, it passs the request on to my
ISP's ... I am trying to clean up my firewall logs, and noticed that the DNS
server is always trying to query root servers.  I was just not sure if this
should be allowed.  If it is not, (and I suspect there is no need to) Is
there a way to make my DNS server stop quering the root servers ?

PS  DNS is a rh9 box running bind.


Thanks,
Peter

Re: dns question

[Jason Opperisano]

On Thu, 2004-11-18 at 07:32, Peter Marshall wrote:
> I am sure this is a stupid question ...but I will ask anyway.  Should I be
> allowing my dns server (in my dmz) connect to root servers ?   At the moment
> it is being bloced, and the only thing it can connect to is my ISP's DNS
> server.  Basically, my dns server serves requests for servers in my dmz for
> my internal users.  If it can't find the hit, it passs the request on to my
> ISP's ... I am trying to clean up my firewall logs, and noticed that the DNS
> server is always trying to query root servers.  I was just not sure if this
> should be allowed.  If it is not, (and I suspect there is no need to) Is
> there a way to make my DNS server stop quering the root servers ?
> 
> PS  DNS is a rh9 box running bind.

if your bind configuration specifies:

        forwarders {
                x.x.x.x;
                x.x.x.x;
                // 24.25.4.107;
                // 24.25.4.108;
                4.2.2.2;
                4.2.2.1;
                4.2.2.3;
        };
--
"My cat's breath smells like cat food."
	--The Simpsons

Re: dns question

[a.ledvinka]

and see also "forward only;" and "forward first;"

> if your bind configuration specifies:
> 
>         forwarders {
>                 x.x.x.x;
>                 x.x.x.x;
>                 // 24.25.4.107;
>                 // 24.25.4.108;
>                 4.2.2.2;
>                 4.2.2.1;
>                 4.2.2.3;
>         };

Re: dns question

[Jason Opperisano]

On Thu, 2004-11-18 at 07:32, Peter Marshall wrote:
> I am sure this is a stupid question ...but I will ask anyway.  Should I be
> allowing my dns server (in my dmz) connect to root servers ?   At the moment
> it is being bloced, and the only thing it can connect to is my ISP's DNS
> server.  Basically, my dns server serves requests for servers in my dmz for
> my internal users.  If it can't find the hit, it passs the request on to my
> ISP's ... I am trying to clean up my firewall logs, and noticed that the DNS
> server is always trying to query root servers.  I was just not sure if this
> should be allowed.  If it is not, (and I suspect there is no need to) Is
> there a way to make my DNS server stop quering the root servers ?
> 
> PS  DNS is a rh9 box running bind.

oops...apparently CTRL+ENTER sends a message in evolution before you're
done typing--sorry about that last message...

if you're specifying:

        forwarders {
                x.x.x.x;
                x.x.x.x;
        };
        forward only;

then your DNS server should not be falling back to the root servers if
your ISP's servers don't have the answer.  the drawback is--if your
ISP's servers don't have the answer--your clients will get a negative
response, which usually isn't what you want.

i normally specify:

        forwarders {
                x.x.x.x;
                x.x.x.x;
        };
        forward first;

and in that case--you need to allow the DNS server out to any IP on port
53, not just to the root servers (the root servers do not provide
recursion).

-j

--
"Dear Baby, Welcome to Dumpsville. Population: You"
	--The Simpsons

Re: dns question

[Peter Marshall]

No .. but I do have the following at the end of my named.conf file .... the
db.cache file has all of the root servers.   I just was not sure if it would
cause problems just removing that section as it was in all of the examples I
read.

zone "." {
       type hint;
       file "/etc/named/db.cache";
       };


----- Original Message ----- 
From: "Jason Opperisano" <opie@817west.com>
To: "Peter Marshall" <peter.marshall@caris.com>
Cc: "netfilter" <netfilter@lists.netfilter.org>
Sent: Thursday, November 18, 2004 9:44 AM
Subject: Re: dns question


On Thu, 2004-11-18 at 07:32, Peter Marshall wrote:
> I am sure this is a stupid question ...but I will ask anyway.  Should I be
> allowing my dns server (in my dmz) connect to root servers ?   At the
moment
> it is being bloced, and the only thing it can connect to is my ISP's DNS
> server.  Basically, my dns server serves requests for servers in my dmz
for
> my internal users.  If it can't find the hit, it passs the request on to
my
> ISP's ... I am trying to clean up my firewall logs, and noticed that the
DNS
> server is always trying to query root servers.  I was just not sure if
this
> should be allowed.  If it is not, (and I suspect there is no need to) Is
> there a way to make my DNS server stop quering the root servers ?
>
> PS  DNS is a rh9 box running bind.

if your bind configuration specifies:

        forwarders {
                x.x.x.x;
                x.x.x.x;
                // 24.25.4.107;
                // 24.25.4.108;
                4.2.2.2;
                4.2.2.1;
                4.2.2.3;
        };
--
"My cat's breath smells like cat food."
--The Simpsons