[Shorewall-users] Perplexing DNS issue

Homer Parker
Sat, 28 Dec 2002 20:06:19 -0000

--=.tGeuU0(6n5K:PM
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

On Sat, 28 Dec 2002 09:31:40 -0600 "Cowles, Steve"
<Steve@SteveCowles.com>
wrote....

> Since your DNS server is located in your DMZ (masq''d), these are
> probably outbound "notifies", but in this case, to the firewall
> interface (SOA). I see the same thing here when I restart named at my
> end. But these messages stop in a few minutes.
>
> FWIW: Cricket Liu (one of the authors of DNS/BIND) explained why named
> must notify itself at startup in a post I read on the dns newsgroups.
> Since your system is masq''d, there is not much you can do about
this
> short of changing the SOA to point to a masq''d IP address in your
> external view. :-( I have learned to just ignore these messages. The
> notifies to my secondary DNS server still work fine.

	That clears it all up, thanks! I will forget they exist ;)


> Is there a reason you are allowing the named control channel (953) from
> the internet??? I hope your named.conf file has an ACL defined to only
> allow systems from your masq''d LAN to control named (rdnc). Like
> 192.168.2.0/24 127.0.0.1

	Have removed the lines... It was part of my (futile) attempt to figure
out what was going on...

---
Homer Parker                  /"\ ASCII Ribbon Campaign
                              \ / No HTML/RTF in email
http://www.homershut.net       x  No Word docs in email
telnet://bbs.homershut.net    / \ Respect for open standards

This e-mail message is 100% Microsoft free!

WARNING: THIS ACCOUNT BELONGS TO A RABID
ANTI-SPAMMER NET-NAZI DOT-COMMUNIST!!


--=.tGeuU0(6n5K:PM
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQE+DgQ+rgrN227HZ+8RAnd5AJ9z4Vkv8Wz5s56unW0yaaiA5V8IlACeLRSK
xWIA4Cvzz9i+zlNZhtwYUeI=Xk19
-----END PGP SIGNATURE-----

--=.tGeuU0(6n5K:PM--