[Shorewall-users] Perplexing DNS issue

Homer Parker
Sat, 28 Dec 2002 19:28:54 -0000

--=.7AKKPDJ5U4ms7y
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

On Sat, 28 Dec 2002 07:01:15 -0800 Tom Eastep <teastep@shorewall.net>
wrote....

> > Dec 28 00:52:12 firewall kernel: Shorewall:all2all:REJECT:IN=eth2
OUT> > MAC=00:60:08:3e:85:bd:00:90:27:1d:63:71:08:00 SRC=192.168.2.1
> > DST=64.216.105.3 LEN=55 TOS=0x10 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP
> > SPT=50738 DPT=53 LEN=35
> > Dec 28 00:52:12 firewall kernel: Shorewall:all2all:REJECT:IN=eth2
OUT> > MAC=00:60:08:3e:85:bd:00:90:27:1d:63:71:08:00 SRC=192.168.2.1
> > DST=64.216.105.3 LEN=55 TOS=0x10 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP
> > SPT=50738 DPT=53 LEN=35
>
> Those appear to be outbound queries -- looks to me like you have a
> misconfigured ''named'' that it trying to talk to itself
(it is trying to
> query 65.216.105.3 which is its own external address).

	Ok, I''ll accept that... The way I see it, it''s going to think
i needs to
talk to 64.216.105.3, because it is 192.168.2.1... I have added "notify
no" to all of the zones except the couple I''m authoritative for...
I have
got all of the rDNS functioning properly for all the IP blocks, and yet it
still does that... I''ll have to root throught the Bind doc''s
and try to
figure out a fix for this..

> >
> > 	That is just as DNS restarts.. The DNS server is in the DMZ, and
> > 	is setup
> > using views..
>
> Does 127.0.0.0/8 map to the ''internal'' view? How about
192.168.2.1?

	Yes.. All three blocks and local...



> > ACCEPT  dmz:192.168.2.1 net     udp     -       domain
> > ACCEPT  dmz:192.168.2.1 net     tcp     -       domain
>
> The two above are superfluous.

	Will remove...

> I don''t see anything wrong with your ruleset other than what
I''ve noted
> above.

	Thanks!

---
Homer Parker                  /"\ ASCII Ribbon Campaign
                              \ / No HTML/RTF in email
http://www.homershut.net       x  No Word docs in email
telnet://bbs.homershut.net    / \ Respect for open standards

This e-mail message is 100% Microsoft free!

WARNING: THIS ACCOUNT BELONGS TO A RABID
ANTI-SPAMMER NET-NAZI DOT-COMMUNIST!!


--=.7AKKPDJ5U4ms7y
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQE+Dft4rgrN227HZ+8RAuAoAJ9Q19slSrFSbQedbSh7/3dGCdoTCQCfWy+N
pdDMRJMtGD77RtqhYFryxvw=IZOX
-----END PGP SIGNATURE-----

--=.7AKKPDJ5U4ms7y--