[Shorewall-users] Perplexing DNS issue

Tom Eastep
Sat, 28 Dec 2002 15:01:15 -0000

--On Saturday, December 28, 2002 01:04:00 AM -0600 Homer Parker
<hparker@homershut.net> wrote:

> 	Ok... I''ve searched the mailing list archives, and the website...
Tried
> all kinds of stuff, and yet I still have problems getting my DNS server to
> update... It''s secondary for some domains, primary for others...
Does a
> great job of filling the logfiles with errors :( Here''s a sample:
>
> Dec 28 00:52:12 firewall kernel: Shorewall:all2all:REJECT:IN=eth2 OUT>
MAC=00:60:08:3e:85:bd:00:90:27:1d:63:71:08:00 SRC=192.168.2.1
> DST=64.216.105.3 LEN=55 TOS=0x10 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP
> SPT=50738 DPT=53 LEN=35
> Dec 28 00:52:12 firewall kernel: Shorewall:all2all:REJECT:IN=eth2 OUT>
MAC=00:60:08:3e:85:bd:00:90:27:1d:63:71:08:00 SRC=192.168.2.1
> DST=64.216.105.3 LEN=55 TOS=0x10 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP
> SPT=50738 DPT=53 LEN=35

Those appear to be outbound queries -- looks to me like you have a
misconfigured ''named'' that it trying to talk to itself (it is
trying to
query 65.216.105.3 which is its own external address).

>
> 	That is just as DNS restarts.. The DNS server is in the DMZ, and is setup
> using views..

Does 127.0.0.0/8 map to the ''internal'' view? How about
192.168.2.1?

 Here''s the pertinant parts of rules:
>
> DNAT    net             dmz:192.168.2.1 udp     domain  - 64.216.105.3
> DNAT    net             dmz:192.168.2.1 tcp     domain  - 64.216.105.3
> DNAT    net             dmz:192.168.2.1 udp     953
> DNAT    net             dmz:192.168.2.1 tcp     953
>
> ACCEPT  dmz:192.168.2.1 net     udp     domain
> ACCEPT  dmz:192.168.2.1 net     tcp     domain
> ACCEPT  dmz:192.168.2.1 net     udp     953
> ACCEPT  dmz:192.168.2.1 net     tcp     953

> ACCEPT  dmz:192.168.2.1 net     udp     -       domain
> ACCEPT  dmz:192.168.2.1 net     tcp     -       domain

The two above are superfluous.

> ACCEPT  dmz:192.168.2.1 net     udp     -       953
> ACCEPT  dmz:192.168.2.1 net     tcp     -       953
>
> ACCEPT  loc             dmz:192.168.2.1 udp     domain
> ACCEPT  kids            dmz:192.168.2.1 udp     domain
> ACCEPT  fw              dmz:192.168.2.1 udp     domain
> ACCEPT  loc             dmz:192.168.2.1 tcp     domain
> ACCEPT  kids            dmz:192.168.2.1 tcp     domain
> ACCEPT  fw              dmz:192.168.2.1 tcp     domain
>
> 	I''m sure there''s some extra stuff, and know
there''s an error (why else
> would the logs say that), but I''ve tried several things... DNS
lookups
> work fine local and remote, it''s just the updates to
primaries/secondaries
> that seem to be the issue.. This is a Bering 1.0 firewall, not 100% sure
> of the Shorewall version, don''t remember if I''ve applied
the update to it
> yet or not...
>

I don''t see anything wrong with your ruleset other than what
I''ve noted
above.

-Tom
--
Tom Eastep   \ Shorewall - iptables made easy
Shoreline,    \ http://shorewall.sf.net
Washington USA \ teastep@shorewall.net