You might need to explicitly allow queries from clients in the options section in named.conf:
example:
allow-query {
::;
127.0.0.1;
10.0.0.0/8;
192.168.0.0/24;
};
or just allow anyone:
allow-query { any };
Of course it would be safer to restrict queries to your clients only.
Sorry your thread was sitting, I just joined and maybe I can help.
From the error this is a recursion setting, your inside server is trying to do look ups and being denied (which you knew) I think it might be related to changes in the named.conf noted here:
2206. [security] "allow-query-cache" and "allow-recursion" now
cross inherit from each other.
If allow-query-cache is not set in named.conf then
allow-recursion is used if set, otherwise allow-query
is used if set, otherwise the default (localnets;
localhost is used.
If allow-recursion is not set in named.conf then
allow-query-cache is used if set, otherwise allow-query
is used if set, otherwise the default (localnets;
localhost is used.
Are you using allow-recursion? or allow-query-source, are you using any sort of match clients or anything like that? (a snip of the named.conf would help).
Quote:
Originally Posted by robsonde
so we had bind 9.3.0...
we upgraded to 9.5.0 patch 1
we kept the exact same named.conf
now we have a problem that some DMZ server cant do lookups from our DNS slave anymore.
in the named.log we see things like this:
note I have removed out IP addresses, the IP was an external facing IP.
the question is...
what changed???
why is bind behaving is a new way?
I am very new to DNS and bind so be easy on me :-)
Hi all,
I've a litte problem to get rollerd running and signing my zones if the ZSK of my zones are near expiring or expired.
rollerd is running but do nothing
startet with:
/usr/bin/perl /usr/sbin/rollerd -rrfile /etc/bind/all.rollrec -directory /etc/bind -logfile /dev/stdout
... (1 Reply)
I am having a bit of trouble getting my CENTOS 6.5 DNS server to work correctly in our testlab environment. Lab network is 10.8.0.0/24 in which we all access from 10.7.0.0.0/24 && 10.0.0.0/24. Here are my configs:
options {
listen-on port 53 { 127.0.0.1; 10.8.0.19;};
#listen-on-v6 port 53 {... (2 Replies)
I have configured a Bind9 DNS on a X4270 machine with Solaris10
I am excuting some repformance tests with DNSPERF tool and maximun CPU usage is 23%. I have seen with
prstat -L -p PID
that named process usses only 2 of the 8 available CPU at the same time although threads for all CPUs exist.... (2 Replies)
Hi Guys,
Just wanted to seek your assistance on an issue encountered with one of our client DNS server query. we have 2 sets of DNS servers.. internal and external. For Internal to reach the external DNS server (DMZ) it has to go through 2 FWs.
Current settings:
- FW rules for Internal... (3 Replies)
Hi all
Long time no speak, I hope you are all well.
Im looking at a DNS issue here and reckon Igot a AD / DNS server issue elsewhere but need to rule out the configuration of my two server's first.
IVe got the nameserver enteries in /etc/resolv.conf and dns in the /etc/nsswitch.conf
... (2 Replies)
Hello guys, can anyone help me with the below error I'm getting from bind9? I'm trying to make bind read all the zone info from openldap, I have already created the schema and I've put some info into the ldap. I have also tried to google the error with no success.
I'm aware there is an problem... (1 Reply)
Hi again guys,
It seems this is a global thing affecting all the DNS bind versions prior to July 28 2008. I have my work cut out for me very soon, I see at least a handful of servers in my list that either need to patching or upgrading.
How many of you guys are affected? Anybody successfully... (4 Replies)
Hello all,
I've a very strange thing hapenning in my Sys, I've configured the IP, DNS eveything for my internat connection, but Im only able to browse Redhat.com websites.
I cant open anyother site!!! :eek:
Im sure the internet is configured 'coz it displays the list of avail updates for... (11 Replies)
Just recently we have been having some dns issues. Some websites won't work i.e. (www.msn.com, aimexpress.aim.com...) I have manually put A records in my named.db file and in the hosts file to try to get it to work but still they do not work. I have looked up updating my named.ca file for the... (1 Reply)