PDA

View Full Version : Can somebody help me getting Bind to work on Centos 5?


treeman
13th August 2009, 07:27
I have set up bind on a centos 5 box on my network to act as a dns for my domain.
Bind is installed and starting ok.

This is my setup:

WAN "mywanip" -> ROUTER -> NAT:53 -> Centos 5 "192.168.0.28"
When i use online port checking tools it shows as connection successfull on port 53 WAN ip so I am assuming there is no problem there.

Domain.com -> Nameserver = "mywanip"

when I "ping" Domain.com I get reply from "mywanip"

when I "host" Domian.com I get :
Domain.com has address "mywanip"
Host Domain.com not found: 3(NXDOMAIN)
Host Domain.com not found: 3(NXDOMAIN)

when I "host" Domian.com from Centos5 box I get:
Domain.com has address "mywanip"
Host Domain.com not found: 2(SERVFAIL)
Host Domain.com not found: 2(SERVFAIL)

I am still new to Bind so I am guessing its my zone files that are not right, altho I have experimented with a few configurations that I found in tutorials but this is the furthest I can get.

Here is a copy of my named.conf and zone files:

//
// Sample named.conf BIND DNS server 'named' configuration file
// for the Red Hat BIND distribution.
//
// See the BIND Administrator's Reference Manual (ARM) for details, in:
// file:///usr/share/doc/bind-*/arm/Bv9ARM.html
// Also see the BIND Configuration GUI : /usr/bin/system-config-bind and
// its manual.
//

options
{
// Those options should be used carefully because they disable port
// randomization
query-source port 53;
// query-source-v6 port 53;

// Put files that named is allowed to write in the data/ directory:
directory "/var/named"; // the default
dump-file "data/cache_dump.db";
statistics-file "data/named_stats.txt";
memstatistics-file "data/named_mem_stats.txt";
#added
# listen-on port 53 { All; };

#added

};
logging
{
/* If you want to enable debugging, eg. using the 'rndc trace' command,
* named will try to write the 'named.run' file in the $directory (/var/named).
* By default, SELinux policy does not allow named to modify the /var/named directory,
* so put the default debug log file in data/ :
*/
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
//
// All BIND 9 zones are in a "view", which allow different zones to be served
// to different types of client addresses, and for options to be set for groups
// of zones.
//
// By default, if named.conf contains no "view" clauses, all zones are in the
//
// By default, if named.conf contains no "view" clauses, all zones are in the
// "default" view, which matches all clients.
//
// If named.conf contains any "view" clause, then all zones MUST be in a view;
// so it is recommended to start off using views to avoid having to restructure
// your configuration files in the future.
//
view "localhost_resolver"
{
/* This view sets up named to be a localhost resolver ( caching only nameserver ).
* If all you want is a caching-only nameserver, then you need only define this view:
*/
match-clients { localhost; };
match-destinations { localhost; };
recursion yes;
# all views must contain the root hints zone:
include "/etc/named.root.hints";

/* these are zones that contain definitions for all the localhost

/* these are zones that contain definitions for all the localhost
* names and addresses, as recommended in RFC1912 - these names should
* ONLY be served to localhost clients:
*/
include "/etc/named.rfc1912.zones";
};
view "internal"
{
/* This view will contain zones you want to serve only to "internal" clients
that connect via your directly attached LAN interfaces - "localnets" .
*/
match-clients { localnets; };
match-destinations { localnets; };
recursion yes;
// all views must contain the root hints zone:
include "/etc/named.root.hints";

// include "named.rfc1912.zones";
// you should not serve your rfc1912 names to non-localhost clients.

// These are your "authoritative" internal zones, and would probably
// also be included in the "localhost_resolver" view above :

zone "my.internal.zone" {

zone "my.internal.zone" {
type master;
file "de.com.zone";
};
zone "my.slave.internal.zone" {
type slave;
file "slaves/my.slave.internal.zone.db";
masters { /* put master nameserver IPs here */ 127.0.0.1; } ;
// put slave zones in the slaves/ directory so named can update them
};
zone "my.ddns.internal.zone" {
type master;
allow-update { key ddns_key; };
file "slaves/my.ddns.internal.zone.db";
// put dynamically updateable zones in the slaves/ directory so named can update them
};
};
key ddns_key
{
algorithm hmac-md5;
secret "PGKgJj2I9NVUSvcglyiAol8uy82rAIVZ0o0DPtgghucybko523 LaUHba4tMA";
};
secret "PGKgJj2I9NVUSvcglyiAol8uy82rAIVZ0o0DPtgghucybko523 LaUHba4tMA";
};
view "external"
{
/* This view will contain zones you want to serve only to "external" clients
* that have addresses that are not on your directly attached LAN interface subnets:
*/
match-clients { any; };
match-destinations { any; };

recursion no;
// you'd probably want to deny recursion to external clients, so you don't
// end up providing free DNS service to all takers

// all views must contain the root hints zone:
include "/etc/named.root.hints";

// These are your "authoritative" external zones, and would probably
// contain entries for just your web and mail servers:

zone "de.external.com.zone" {
type master;
file "de.external.com.zone";
type master;
file "de.external.com.zone";
};
};




de.com.zone
@ in soa localhost. root 1 3H 15M 1W 1D
ns localhost.

domain.com IN NS ns1.domain.com.
domain.com IN NS ns2.domain.com.
ns1 IN A 127.0.0.1
ns2 IN A 127.0.0.1

domain.com.com. IN A 192.168.0.28
localhost.domain.com. IN A 192.168.0.28
test.domain.com. IN A 192.168.0.39
web.domain.com. IN CNAME "some external link"
www IN CNAME domain.com.




de.external.com.zone
@ in soa "mywanip". root 1 3H 15M 1W 1D
ns "mywanip".

domain.com IN NS ns1.domain.com.
domain.com IN NS ns2.domain.com.
ns1 IN A "mywanip"
ns2 IN A "mywanip"
domain.com. IN A "mywanip"
localhost.domain.com. IN A "mywanip"
test.domain.com. IN A "mywanip"
web.domain. IN CNAME "someexternallink"
www IN CNAME domain.




Any tips or observations would be helpfull, thank you

falko
14th August 2009, 11:31
domain.com IN NS ns1.domain.com.
domain.com IN NS ns2.domain.com.
must be
domain.com. IN NS ns1.domain.com.
domain.com. IN NS ns2.domain.com.

Did you check your zone on www.intodns.com ?

treeman
14th August 2009, 15:49
I tried that but still same result. I got the following errors from the dns report

NS records from your nameservers NS records got from your nameservers listed at the parent NS are:
Oups! I could not get any nameservers from your nameservers (the ones listed at the parent server). Please verify that they are not lame nameservers and are configured properly.

Mismatched NS records WARNING: One or more of your nameservers did not return any of your NS records.

Multiple Nameservers ERROR: Looks like you have less than 2 nameservers. According to RFC2182 section 5 you must have at least 3 nameservers, and no more than 7. Having 2 nameservers is also ok by me.

Nameservers are lame ERROR: looks like you have lame nameservers. The following nameservers are lame:
wanip

Missing nameservers reported by your nameservers You should already know that your NS records at your nameservers are missing, so here it is again:

mydomain.com.


SOA record No valid SOA record came back!

WWW A Record ERROR: I could not get any A records for mydomain.com!

(I only do a cache request, if you recently added a WWW A record, it might not show up here.)

Is there anything else to look at except named.conf and zone files?

treeman
14th August 2009, 19:36
It just occoured to me that my port 80 is being blocked by my isp. But I am not trying to host a web page, just testing and learning DNS, would the ns record get blocked by the port 80 block? Port 53 is not blocked and forwarded through my router to correct internal IP

Update: I tried with the centos 5 box off and i got

;; connection timed out; no servers could be reached
;; connection timed out; no servers could be reached

With the centos 5 box on i got

Host domain.com not found: 3(NXDOMAIN)
Host domain.com not found: 3(NXDOMAIN)

So i guess its getting through just the zone file not working properly

falko
15th August 2009, 13:10
If you want to host the domain.com zone on ns1.domain.com and ns2.domain.com, you also need a glue record: http://en.wikipedia.org/wiki/Domain_Name_System#Circular_dependencies_and_glue_ records

treeman
17th August 2009, 01:52
Is there any way to do it without setting a glue record? I just want to set up a simple basic dns that will work with my domain.

I went through alot of guides for bind on centos and none mentioned glue records

falko
17th August 2009, 14:30
If you don't want to create a glue record, you must host the domain.com zone on name servers that don't use domain.com in their hostname (i.e., instead of ns1.domain.com and ns2.domain.com use ns1.example.com and ns2.example.com).

treeman
20th August 2009, 07:20
sorry but I am not sure what to use for "example" in ns1.example

falko
21st August 2009, 15:57
Any domain other than domain.com.

treeman
27th August 2009, 01:37
Hi, thanx for trying to help, I am still stuck so I must be doing something wrong with the basics or my whole understanding of dns. So i got myself a book apress - pro dns and bind and im going to start from scratch, thanx for your help

falko
27th August 2009, 13:02
This article might help as well: http://www.howtoforge.com/traditional_dns_howto :)

treeman
28th August 2009, 11:48
Thanks for the post, the guide is really good and the easiest to understand from what I have found so far. Really good on the details, so after reading it a few times I was so confident ill get it going I started from scratch and now I am stuck in the same place:(

I must be missing something that I failed to see, this is what I have done from the very beginning:

1. Registered a domain at dynadot.com
2. Set the name servers linked to my domain as:
ns1.domain.com -> wan ip
ns2.domain.com -> wan ip
domain.com -> wan ip
just for the sake of it i put in domain.com wont hurt right?

3. After doing this and waiting for the records to update when i type in host domain.com or ns1.domain.com I get my wan ip back, this is good I presume now the domain knows where to look for the dns server.

4. Install bind use system-config-bind to get all my config files in right places.
5. Start bind to make sure its running - OK
6.. Edit localdomain.zone and localhost.zone, didn't edit nothing in named.conf or change zone file names, I hope this is ok just for testing
7. Make sure my wan ip port 53 is nat to internal dns server port 53, this looks to be working ad online tools tell me port 53 is open.
8. So now in my mind this is the picture I have when a query is made to my domain
user contacts domain, domain says this is the dns server and gives user ns1.domain.com or domain.com since I put them all in step 2. User is redirected to those addresses which both resolve to my wan ip. User queries my wanip on port 53 and talks to bind. So bind should now read out my zone files and translate what is set in them to the user?
But when i type in www.domain.com it does not work, when i try host domain.com I get either
Host domain.com not found: 2(SERVFAIL)
or
connection timed out; no servers could be reached

Im lost, I must of missed something in my setup, I know you mentioned glue records but I want to keep it as simple as possible, I tried a few different possiblities for ns but nothing. sorry to be annoying

treeman
29th August 2009, 08:15
Im such a jackass lol

As simple as it was the problem was my external zone in named.conf was not the same as my nameserver at my domain so naturally no nameserver could be contacted and soa record retreived. Right now I am getting a almost perfect report from http://www.intodns.com just a few minor thing associated with using single ip etc.

Well i guess it was that plain that nobody mentioned it in any guide and I simply missed it, hope this can save somebody alot of pain and long nights, thanx Falco for giving me support