0

I have set up my ubuntu 18.04 server as a cache-only forwarding DNS server:

cat named.conf.options 

options {
        directory "/var/cache/bind";

        recursion yes;
        allow-query { 0.0.0.0; 127.0.0.1;};

        forwarders {
                8.8.8.8;
                8.8.4.4;
        };  
        forward only;

        dnssec-enable yes;
        dnssec-validation yes;

        auth-nxdomain no;    # conform to RFC1035
        listen-on-v6 { any; };
};

Firewall setup on a server :

ufw status
Status: active

To                         Action      From
--                         ------      ----
Apache                     ALLOW       Anywhere                  
Bind9                      ALLOW       Anywhere                  
22/tcp                     ALLOW       Anywhere                  
OpenSSH                    ALLOW       Anywhere                  
Apache (v6)                ALLOW       Anywhere (v6)             
Bind9 (v6)                 ALLOW       Anywhere (v6)             
22/tcp (v6)                ALLOW       Anywhere (v6) 

Output of journalctl :

journalctl -u bind9 -f


Feb 08 13:16:14 ns3247177 named[2707]: client @0x7f61f8101100 90.248.149.235#43049 (ssl.gstatic.com): query (cache) 'ssl.gstatic.com/A/IN' denied
Feb 08 13:16:14 ns3247177 named[2707]: client @0x7f61f810f890 90.248.149.235#43049 (ssl.gstatic.com): query (cache) 'ssl.gstatic.com/AAAA/IN' denied
Feb 08 13:16:14 ns3247177 named[2707]: client @0x7f61f810f890 90.248.149.235#43049 (ssl.gstatic.com): query (cache) 'ssl.gstatic.com/A/IN' denied
Feb 08 13:16:14 ns3247177 named[2707]: client @0x7f61f811e020 90.248.149.235#43049 (ssl.gstatic.com): query (cache) 'ssl.gstatic.com/AAAA/IN' denied
Feb 08 13:16:14 ns3247177 named[2707]: client @0x7f61f811e020 90.248.149.235#50650 (ssl.gstatic.com.broadband): query (cache) 'ssl.gstatic.com.broadband/A/IN' denied
Feb 08 13:16:14 ns3247177 named[2707]: client @0x7f61f810f890 90.248.149.235#50650 (ssl.gstatic.com.broadband): query (cache) 'ssl.gstatic.com.broadband/AAAA/IN' denied
Feb 08 13:16:14 ns3247177 named[2707]: client @0x7f61f810f890 90.248.149.235#50650 (ssl.gstatic.com.broadband): query (cache) 'ssl.gstatic.com.broadband/A/IN' denied
Feb 08 13:16:14 ns3247177 named[2707]: client @0x7f61f8101100 90.248.149.235#50650 (ssl.gstatic.com.broadband): query (cache) 'ssl.gstatic.com.broadband/AAAA/IN' denied
Feb 08 13:16:14 ns3247177 named[2707]: client @0x7f61f811e020 90.248.149.235#45883 (ssl.gstatic.com): query (cache) 'ssl.gstatic.com/AAAA/IN' denied
Feb 08 13:16:14 ns3247177 named[2707]: client @0x7f61f8101100 90.248.149.235#45883 (ssl.gstatic.com): query (cache) 'ssl.gstatic.com/A/IN' denied
Feb 08 13:16:14 ns3247177 named[2707]: client @0x7f61f8101100 90.248.149.235#45883 (ssl.gstatic.com): query (cache) 'ssl.gstatic.com/A/IN' denied
Feb 08 13:16:14 ns3247177 named[2707]: client @0x7f61f811e020 90.248.149.235#45883 (ssl.gstatic.com): query (cache) 'ssl.gstatic.com/AAAA/IN' denied
Feb 08 13:16:14 ns3247177 named[2707]: client @0x7f61f8101100 90.248.149.235#51677 (ssl.gstatic.com.broadband): query (cache) 'ssl.gstatic.com.broadband/AAAA/IN' denied
Feb 08 13:16:14 ns3247177 named[2707]: client @0x7f61f811e020 90.248.149.235#51677 (ssl.gstatic.com.broadband): query (cache) 'ssl.gstatic.com.broadband/A/IN' denied
Feb 08 13:16:14 ns3247177 named[2707]: client @0x7f61f811e020 90.248.149.235#51677 (ssl.gstatic.com.broadband): query (cache) 'ssl.gstatic.com.broadband/A/IN' denied
Feb 08 13:16:14 ns3247177 named[2707]: client @0x7f61f8101100 90.248.149.235#51677 (ssl.gstatic.com.broadband): query (cache) 'ssl.gstatic.com.broadband/AAAA/IN' denied

Setup on my home laptop (ubuntu 18.04) :

 cat /etc/resolv.conf 
 nameserver 164.132.173.129 
 #nameserver 127.0.0.53
 options edns0
 search broadband              

I change between nameservers by commenting out each and trying dig and ping commands. And when I try to use the server where I installed bind9, ping command doesn't work :

dig google.com

; <<>> DiG 9.11.3-1ubuntu1.11-Ubuntu <<>> google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 38769
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: ab489ac00252b38c3427db005e3eb469c1411fa2c18cecdf (good)
;; QUESTION SECTION:
;google.com.            IN  A

;; Query time: 16 msec
;; SERVER: 164.132.173.129#53(164.132.173.129)
;; WHEN: Sat Feb 08 13:15:21 GMT 2020
;; MSG SIZE  rcvd: 67

This is the output of ping :

ping -c 5 google.com
ping: google.com: Name or service not known

Can anyone tell me why my DNS server doesn't work as suppose to ?

1

You are missing "90.248.149.235;" in allow-query

and you problably also need

allow-recursion{90.248.149.235;};

BTW: you can use "dig google.com @164.132.173.129" without changing resolv.conf

  • this worked ! Thank you. But what if I want this DNS server to be able to work for everyone ? That's why I put 0.0.0.0 in allow-query I thought it will cover all ip addresses. Thank you for that dig command thingy, this looks useful. – Tomas.R Feb 9 at 10:59
  • I think then you have to use "any;" – Virsacer Feb 9 at 13:24
  • you are right again Mr.Virsacer, "any;" worked. Thank you. – Tomas.R Feb 9 at 17:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.