2

I have an internet connection with a static ip from my ISP. I do have mail servers and webservers hosted from it. What i would like to achieve is run couple of nameservers by getting another static ip from my ISP. I have forwarded TCP and UDP ports from my local IP address and the internet connection is being managed by pfsense. The DNS resolver and forwarder service has been disabled.

I tried to setup a nameserver by NAT and forwarded PORT 53 for udp & tcp traffic. But still when i try to query a record for a zone on my nameserver using dig externally or internally , i get an error "no servers could be reached". Is there any guide or information that would help me to setup the nameservers behind NAT or help me solve this issue?

My ISP has confirmed that they do not have blocks or filters in place. I have also confirmed that no ports are being blocked or filtered from my end too. The name of the nameserver is ns1.sitehosters.in.

Network configuration on ns1:

auto eth1
iface eth1 inet static
address 192.168.1.12 
netmask 255.255.255.0 
gateway 192.168.1.1(PFSENSE) 
dns-nameservers 8.8.8.8

/etc/bind/named/conf.options:

options {
directory "/var/cache/bind";
dnssec-validation auto;
auth-nxdomain no;
listen-on-v6 { any; };
};

named.conf.local file on ns1:

nano /etc/bind/named.conf.local
zone "sitehosters.in" {
type master;
allow-transfer {none;};
file"/etc/bind/pri.sitehosters.in"
};

netstat output:

tcp 0 0 192.168.1.36:domain . LISTEN 1156/named 
tcp 0 0 localhost:domain . LISTEN 1156/named 
tcp 0 0 localhost:953 . LISTEN 1156/named 
udp 0 0 192.168.1.36:domain . 1156/named 
udp 0 0 localhost:domain . 1156/named

DNSCHECK at PINGDOM

No name servers found at child.

No name servers could be found at the child. 
This usually means that the child is not configured to answer queries about the zone.

Please find some screenshots of my router config which might help you to point me in the right direction. I use pfsense on a PC which is managing all the internet connection and firewall.

  • NAT Rule for DNS

  • Firewall Rules from Pfsense

  • You forgot the screenshots. – muru Jun 19 '17 at 10:49
  • @muru sorry my bad. its done. – mindflame Jun 19 '17 at 11:16
0

I have the same configuration with the same setup as you have.I have pfSense firewall configured.I have webserver using ISPconfig , I too tried long with a NAT configuration.Then I failed, because in the NAT incoming protocol you cannot set any protocol as like in normal rules (In Pfsense).

The source protocol should be all (not supported in pfSense NAT Rule).

enter image description here

So, Let me give you suggestion how I did in my environment.Give direct public IP to the webs server.Create a VPN Server in the pfSense and created a user for it.Configure the VPN in the webserver and connected it to your local network.Then configure auto VPN connection if the server restarts.

I strongly recommend you this method.

If you have any queries please get back to me.

  • Thanks for your helping hand. But can u give me some suggestion on how it can be done. Moreover my ISP has given me a PPPOE connection which requires a NAT to work because it requires authentication to get connected. – mindflame Jun 19 '17 at 14:40
  • I got it, your in a PPOE connection.I suggest you buy a new static IP or else try this method, in NAT rules.Source * and source port * designation WAN address NAT to Webserver local host to port *.The star symbol denotes any.But there is a problem in this rule too.The firewall is not been in public accessible in 80 port or 443.This method is a little risk. Although you have enabled this, how will you access this from outside?Are you going to configure DDNS? I have 5 IPs on my ISP, I have added Virtual IP into the firewall.Are you broadband or lease line. – Sathiya Moorthy Karan Jun 20 '17 at 5:02
  • It is a broadband line. I understand the complications of this method. I have resort to almost every method. I only have two ips for now. But it all makes sense only if packets are hitting my firewall from my ISP. I see no packets incoming... – mindflame Jun 20 '17 at 5:18
0

I figured it out. The ISP had a filter on port 53 even though it was open. Got to change the ISP as they cant remove the block. Thanks all for the time spend solving the issue

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.