[Shorewall-users] Perplexing DNS issue

Cowles, Steve
Sat, 28 Dec 2002 15:31:40 -0000

> -----Original Message-----
> From: Tom Eastep
> Sent: Saturday, December 28, 2002 9:01 AM
> Subject: Re: [Shorewall-users] Perplexing DNS issue
>
> --On Saturday, December 28, 2002 01:04:00 AM -0600 Homer Parker
> <hparker@homershut.net> wrote:
>
> > 	Ok... I''ve searched the mailing list archives, and the
> > website... Tried all kinds of stuff, and yet I still have
> > problems getting my DNS server to update... It''s secondary
> > for some domains, primary for others... Does a great job of
> > filling the logfiles with errors :( Here''s a sample:
> >
> > Dec 28 00:52:12 firewall kernel: Shorewall:all2all:REJECT:IN=eth2
OUT> > MAC=00:60:08:3e:85:bd:00:90:27:1d:63:71:08:00 SRC=192.168.2.1
> > DST=64.216.105.3 LEN=55 TOS=0x10 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP
> > SPT=50738 DPT=53 LEN=35 Dec 28 00:52:12 firewall kernel:
> > Shorewall:all2all:REJECT:IN=eth2 OUT> >
MAC=00:60:08:3e:85:bd:00:90:27:1d:63:71:08:00 SRC=192.168.2.1
> > DST=64.216.105.3 LEN=55 TOS=0x10 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP
> > SPT=50738 DPT=53 LEN=35
>
> Those appear to be outbound queries -- looks to me like you have a
> misconfigured ''named'' that it trying to talk to itself
(it is
> trying to query 65.216.105.3 which is its own external address).

Since your DNS server is located in your DMZ (masq''d), these are
probably
outbound "notifies", but in this case, to the firewall interface
(SOA). I
see the same thing here when I restart named at my end. But these messages
stop in a few minutes.

FWIW: Cricket Liu (one of the authors of DNS/BIND) explained why named must
notify itself at startup in a post I read on the dns newsgroups. Since your
system is masq''d, there is not much you can do about this short of
changing
the SOA to point to a masq''d IP address in your external view. :-( I
have
learned to just ignore these messages. The notifies to my secondary DNS
server still work fine.

>
> >
> > 	That is just as DNS restarts.. The DNS server is in the
> > DMZ, and is setup using views..
>
> Does 127.0.0.0/8 map to the ''internal'' view? How about
192.168.2.1?
>
>  Here''s the pertinant parts of rules:
> >
> > DNAT    net             dmz:192.168.2.1 udp     domain  -
> 64.216.105.3
> > DNAT    net             dmz:192.168.2.1 tcp     domain  -
> 64.216.105.3
> > DNAT    net             dmz:192.168.2.1 udp     953
> > DNAT    net             dmz:192.168.2.1 tcp     953

Is there a reason you are allowing the named control channel (953) from the
internet??? I hope your named.conf file has an ACL defined to only allow
systems from your masq''d LAN to control named (rdnc). Like
192.168.2.0/24
127.0.0.1

Steve Cowles