[Shorewall-users] Perplexing DNS issue

Homer Parker
Sat, 28 Dec 2002 07:04:00 -0000

--:bjskmVC=.GDE3fq
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

	Ok... I''ve searched the mailing list archives, and the website...
Tried
all kinds of stuff, and yet I still have problems getting my DNS server to
update... It''s secondary for some domains, primary for others... Does a
great job of filling the logfiles with errors :( Here''s a sample:

Dec 28 00:52:12 firewall kernel: Shorewall:all2all:REJECT:IN=eth2
OUTMAC=00:60:08:3e:85:bd:00:90:27:1d:63:71:08:00 SRC=192.168.2.1
DST=64.216.105.3 LEN=55 TOS=0x10 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP
SPT=50738 DPT=53 LEN=35
Dec 28 00:52:12 firewall kernel: Shorewall:all2all:REJECT:IN=eth2
OUTMAC=00:60:08:3e:85:bd:00:90:27:1d:63:71:08:00 SRC=192.168.2.1
DST=64.216.105.3 LEN=55 TOS=0x10 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP
SPT=50738 DPT=53 LEN=35

	That is just as DNS restarts.. The DNS server is in the DMZ, and is setup
using views.. Here''s the pertinant parts of rules:

DNAT    net             dmz:192.168.2.1 udp     domain  - 64.216.105.3
DNAT    net             dmz:192.168.2.1 tcp     domain  - 64.216.105.3
DNAT    net             dmz:192.168.2.1 udp     953
DNAT    net             dmz:192.168.2.1 tcp     953

ACCEPT  dmz:192.168.2.1 net     udp     domain
ACCEPT  dmz:192.168.2.1 net     tcp     domain
ACCEPT  dmz:192.168.2.1 net     udp     953
ACCEPT  dmz:192.168.2.1 net     tcp     953
ACCEPT  dmz:192.168.2.1 net     udp     -       domain
ACCEPT  dmz:192.168.2.1 net     tcp     -       domain
ACCEPT  dmz:192.168.2.1 net     udp     -       953
ACCEPT  dmz:192.168.2.1 net     tcp     -       953

ACCEPT  loc             dmz:192.168.2.1 udp     domain
ACCEPT  kids            dmz:192.168.2.1 udp     domain
ACCEPT  fw              dmz:192.168.2.1 udp     domain
ACCEPT  loc             dmz:192.168.2.1 tcp     domain
ACCEPT  kids            dmz:192.168.2.1 tcp     domain
ACCEPT  fw              dmz:192.168.2.1 tcp     domain

	I''m sure there''s some extra stuff, and know there''s
an error (why else
would the logs say that), but I''ve tried several things... DNS lookups
work fine local and remote, it''s just the updates to
primaries/secondaries
that seem to be the issue.. This is a Bering 1.0 firewall, not 100% sure
of the Shorewall version, don''t remember if I''ve applied the
update to it
yet or not...

---
Homer Parker                  /"\ ASCII Ribbon Campaign
                              \ / No HTML/RTF in email
http://www.homershut.net       x  No Word docs in email
telnet://bbs.homershut.net    / \ Respect for open standards

This e-mail message is 100% Microsoft free!

WARNING: THIS ACCOUNT BELONGS TO A RABID
ANTI-SPAMMER NET-NAZI DOT-COMMUNIST!!


--:bjskmVC=.GDE3fq
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQE+DUzjrgrN227HZ+8RAtvGAKCeX6Nn6KWsU7FYC9ZUJL94VObVDACeK/VM
LhG3+TU+FlmWvW0p7k4Xk0Y=Se2H
-----END PGP SIGNATURE-----

--:bjskmVC=.GDE3fq--