n8bounds
July 13th, 2009, 06:03 PM
Hello community!
I'm running Version: 1:9.4.2.dfsg.P2-2ubuntu0.1 of bind9 installed on Ubuntu 8.04.2 with kernel 2.6.24-24-server (x86_64).
Everything has been going fine (this is a mail/name server) but I neglected to setup a reverse lookup zone when I configured all this. Named answers properly to all queries for the 6 public zones for which it is master, but refuses to answer (it thinks its not authoritative) for the in-addr.arpa zone I recently added.
I've never used in-addr.arpa zones before, so I must be missing something.
We have the following subnet delegated to us by our ISP: 12.145.82.128/28
Now, as I understand it, this should translate to: 128/28.82.145.12.in-addr.arpa. (or 128-28.82.145.12.in-addr.arpa.) This is what I based my configurations on. Below are the relevant files:
root@mail:~# cat /etc/bind/named.conf
include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
and...
root@mail:~# cat /etc/bind/named.conf.options
options {
directory "/var/cache/bind";
query-source address * port 53;
allow-transfer { none; };
auth-nxdomain no; # conform to RFC1035
listen-on-v6 { any; };
};
logging {
category lame-servers {null; };
//category edns-disabled { null; };
};
and...
root@mail:~# cat /etc/bind/named.conf.local
acl "slaves" { 192.168.2.29; 192.168.5.29; 192.168.1.29;
192.168.6.10; 192.168.7.10; 192.168.9.10;
199.191.128.105; 199.191.128.106; 12.127.16.69;
12.127.16.70; 12.145.82.142; 192.168.101.11;
};
include "/etc/bind/named.conf.local.int";
include "/etc/bind/named.conf.local.ext";
and...
root@mail:~# cat /etc/bind/named.conf.local.ext
view "external" {
match-clients { "any"; };
recursion no;
zone "epescarriers.com" IN {
type master;
notify yes;
file "db.epescarriers.com";
allow-update { none; };
allow-transfer { "slaves"; };
};
zone "epestransport.com" IN {
type master;
notify yes;
file "db.domains";
allow-update { none; };
allow-transfer { "slaves"; };
};
zone "epeslogistics.com" IN {
type master;
notify yes;
file "db.domains";
allow-update { none; };
allow-transfer { "slaves"; };
};
zone "epesexpress.com" IN {
type master;
notify yes;
file "db.domains";
allow-update { none; };
allow-transfer { "slaves"; };
};
zone "tsexpress.com" IN {
type master;
notify yes;
file "db.domains";
allow-update { none; };
allow-transfer { "slaves"; };
};
zone "epesfms.com" IN {
type master;
notify yes;
file "db.domains";
allow-update { none; };
allow-transfer { "slaves"; };
};
//zone "128/28.82.145.12.in-addr.arpa" IN {
//zone "82.145.12.IN-ADDR.ARPA" IN {
//zone "82.145.12.in-addr.arpa." IN { //sort of works
zone "128-28.82.145.12.IN-ADDR.ARPA" IN {
type master;
notify yes;
allow-update { none; };
allow-transfer { "slaves"; };
file "db.ext.ptr";
};
};
and...
root@mail:~# cat /etc/bind/named.conf.local.int
view "internal" {
match-clients { 192.168.0.0/23; 192.168.2.0/24; 192.168.5.0/24;
192.168.6.0/24; 192.168.7.0/24; 192.168.6.0/24;
192.168.7.0/24; 192.168.9.0/24;
};
allow-recursion { 192.168.0.0/16; 192.168.101.0/24; 127.0.0.1; };
zone "epescarriers.com" {
type master;
notify yes;
file "db.int.epescarriers.com";
allow-update { none; };
allow-transfer { "slaves"; };
};
zone "epescarriers.lan" {
type master;
notify yes;
file "db.int.epescarriers.lan";
allow-update { none; };
allow-transfer { "slaves"; };
};
zone "epesfms.com" {
type master;
notify yes;
file "db.int.epesfms.com";
allow-update { none; };
allow-transfer { "slaves"; };
};
zone "epeslogistics.com" {
type master;
notify yes;
file "db.int.epeslogistics.com";
allow-update { none; };
allow-transfer { "slaves"; };
};
zone "epestransport.com" {
type master;
notify yes;
file "db.int.epestransport.com";
allow-update { none; };
allow-transfer { "slaves"; };
};
zone "tsexpress.com" {
type master;
notify yes;
file "db.int.tsexpress.com";
allow-update { none; };
allow-transfer { "slaves"; };
};
//built-ins
zone "10.IN-ADDR.ARPA" {
type master;
file "empty";
};
zone "16.172.IN-ADDR.ARPA" {
type master;
file "empty";
};
zone "168.192.IN-ADDR.ARPA" {
type master;
file "empty";
};
zone "localhost" {
type master;
file "/etc/bind/db.local";
};
zone "127.in-addr.arpa" {
type master;
file "/etc/bind/db.127";
};
zone "0.in-addr.arpa" {
type master;
file "/etc/bind/db.0";
};
zone "255.in-addr.arpa" {
type master;
file "/etc/bind/db.255";
};
zone "." {
type hint;
file "/etc/bind/db.root";
};
};
and, finally, the zone file in question itself...
$TTL 3D
;$ORIGIN 128/28.82.145.12.in-addr.arpa.
$ORIGIN 128-28.82.145.12.IN-ADDR.ARPA.
@ IN SOA ns.epescarriers.com. postmaster.epescarriers.com. (
2009071315 ; serial
4H ; refresh
2H ; retry
4W ; expire
1D ) ; minimum
NS dbru.br.ns.els-gms.att.net.
NS dmtu.mt.ns.els-gms.att.net.
NS ns.epescarriers.com.
129 IN CNAME mail.epescarriers.com.
130 IN PTR mail-mx01.epescarriers.com.
131 IN PTR mail.epescarriers.com.
132 IN PTR mail-mx02.epescarriers.com.
When I try to query like this (from outside)...
root@poweredge:~# dig @ns.epescarriers.com -x 12.145.82.132
; <<>> DiG 9.5.1-P2 <<>> @ns.epescarriers.com -x 12.145.82.132
; (1 server found)
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 51905
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available
;; QUESTION SECTION:
;132.82.145.12.in-addr.arpa. IN PTR
;; Query time: 40 msec
;; SERVER: 12.145.82.132#53(12.145.82.132)
;; WHEN: Mon Jul 13 17:58:38 2009
;; MSG SIZE rcvd: 44
This appears in the syslog...
Jul 13 17:58:38 mail named[18772]: client 65.188.241.191#64026: view external: query (cache) '132.82.145.12.in-addr.arpa/PTR/IN' denied
When the slave servers attempt to load the zone, this appears in syslog...
Jul 13 16:18:45 mail named[12825]: zone 128-28.82.145.12.IN-ADDR.ARPA/IN/external: loaded serial 2009071314
Jul 13 16:18:45 mail named[12825]: zone 128-28.82.145.12.IN-ADDR.ARPA/IN/external: sending notifies (serial 2009071314)
Jul 13 16:22:32 mail named[12825]: client 199.191.128.106#36345: view external: query (cache) '128/28.82.145.12.in-addr.arpa/SOA/IN' denied
Jul 13 16:22:32 mail named[12825]: client 199.191.128.106#50767: view external: bad zone transfer request: '128/28.82.145.12.in-addr.arpa/IN': non-authoritative zone (NOTAUTH)
...any ideas?
Thanks!
I'm running Version: 1:9.4.2.dfsg.P2-2ubuntu0.1 of bind9 installed on Ubuntu 8.04.2 with kernel 2.6.24-24-server (x86_64).
Everything has been going fine (this is a mail/name server) but I neglected to setup a reverse lookup zone when I configured all this. Named answers properly to all queries for the 6 public zones for which it is master, but refuses to answer (it thinks its not authoritative) for the in-addr.arpa zone I recently added.
I've never used in-addr.arpa zones before, so I must be missing something.
We have the following subnet delegated to us by our ISP: 12.145.82.128/28
Now, as I understand it, this should translate to: 128/28.82.145.12.in-addr.arpa. (or 128-28.82.145.12.in-addr.arpa.) This is what I based my configurations on. Below are the relevant files:
root@mail:~# cat /etc/bind/named.conf
include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
and...
root@mail:~# cat /etc/bind/named.conf.options
options {
directory "/var/cache/bind";
query-source address * port 53;
allow-transfer { none; };
auth-nxdomain no; # conform to RFC1035
listen-on-v6 { any; };
};
logging {
category lame-servers {null; };
//category edns-disabled { null; };
};
and...
root@mail:~# cat /etc/bind/named.conf.local
acl "slaves" { 192.168.2.29; 192.168.5.29; 192.168.1.29;
192.168.6.10; 192.168.7.10; 192.168.9.10;
199.191.128.105; 199.191.128.106; 12.127.16.69;
12.127.16.70; 12.145.82.142; 192.168.101.11;
};
include "/etc/bind/named.conf.local.int";
include "/etc/bind/named.conf.local.ext";
and...
root@mail:~# cat /etc/bind/named.conf.local.ext
view "external" {
match-clients { "any"; };
recursion no;
zone "epescarriers.com" IN {
type master;
notify yes;
file "db.epescarriers.com";
allow-update { none; };
allow-transfer { "slaves"; };
};
zone "epestransport.com" IN {
type master;
notify yes;
file "db.domains";
allow-update { none; };
allow-transfer { "slaves"; };
};
zone "epeslogistics.com" IN {
type master;
notify yes;
file "db.domains";
allow-update { none; };
allow-transfer { "slaves"; };
};
zone "epesexpress.com" IN {
type master;
notify yes;
file "db.domains";
allow-update { none; };
allow-transfer { "slaves"; };
};
zone "tsexpress.com" IN {
type master;
notify yes;
file "db.domains";
allow-update { none; };
allow-transfer { "slaves"; };
};
zone "epesfms.com" IN {
type master;
notify yes;
file "db.domains";
allow-update { none; };
allow-transfer { "slaves"; };
};
//zone "128/28.82.145.12.in-addr.arpa" IN {
//zone "82.145.12.IN-ADDR.ARPA" IN {
//zone "82.145.12.in-addr.arpa." IN { //sort of works
zone "128-28.82.145.12.IN-ADDR.ARPA" IN {
type master;
notify yes;
allow-update { none; };
allow-transfer { "slaves"; };
file "db.ext.ptr";
};
};
and...
root@mail:~# cat /etc/bind/named.conf.local.int
view "internal" {
match-clients { 192.168.0.0/23; 192.168.2.0/24; 192.168.5.0/24;
192.168.6.0/24; 192.168.7.0/24; 192.168.6.0/24;
192.168.7.0/24; 192.168.9.0/24;
};
allow-recursion { 192.168.0.0/16; 192.168.101.0/24; 127.0.0.1; };
zone "epescarriers.com" {
type master;
notify yes;
file "db.int.epescarriers.com";
allow-update { none; };
allow-transfer { "slaves"; };
};
zone "epescarriers.lan" {
type master;
notify yes;
file "db.int.epescarriers.lan";
allow-update { none; };
allow-transfer { "slaves"; };
};
zone "epesfms.com" {
type master;
notify yes;
file "db.int.epesfms.com";
allow-update { none; };
allow-transfer { "slaves"; };
};
zone "epeslogistics.com" {
type master;
notify yes;
file "db.int.epeslogistics.com";
allow-update { none; };
allow-transfer { "slaves"; };
};
zone "epestransport.com" {
type master;
notify yes;
file "db.int.epestransport.com";
allow-update { none; };
allow-transfer { "slaves"; };
};
zone "tsexpress.com" {
type master;
notify yes;
file "db.int.tsexpress.com";
allow-update { none; };
allow-transfer { "slaves"; };
};
//built-ins
zone "10.IN-ADDR.ARPA" {
type master;
file "empty";
};
zone "16.172.IN-ADDR.ARPA" {
type master;
file "empty";
};
zone "168.192.IN-ADDR.ARPA" {
type master;
file "empty";
};
zone "localhost" {
type master;
file "/etc/bind/db.local";
};
zone "127.in-addr.arpa" {
type master;
file "/etc/bind/db.127";
};
zone "0.in-addr.arpa" {
type master;
file "/etc/bind/db.0";
};
zone "255.in-addr.arpa" {
type master;
file "/etc/bind/db.255";
};
zone "." {
type hint;
file "/etc/bind/db.root";
};
};
and, finally, the zone file in question itself...
$TTL 3D
;$ORIGIN 128/28.82.145.12.in-addr.arpa.
$ORIGIN 128-28.82.145.12.IN-ADDR.ARPA.
@ IN SOA ns.epescarriers.com. postmaster.epescarriers.com. (
2009071315 ; serial
4H ; refresh
2H ; retry
4W ; expire
1D ) ; minimum
NS dbru.br.ns.els-gms.att.net.
NS dmtu.mt.ns.els-gms.att.net.
NS ns.epescarriers.com.
129 IN CNAME mail.epescarriers.com.
130 IN PTR mail-mx01.epescarriers.com.
131 IN PTR mail.epescarriers.com.
132 IN PTR mail-mx02.epescarriers.com.
When I try to query like this (from outside)...
root@poweredge:~# dig @ns.epescarriers.com -x 12.145.82.132
; <<>> DiG 9.5.1-P2 <<>> @ns.epescarriers.com -x 12.145.82.132
; (1 server found)
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 51905
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available
;; QUESTION SECTION:
;132.82.145.12.in-addr.arpa. IN PTR
;; Query time: 40 msec
;; SERVER: 12.145.82.132#53(12.145.82.132)
;; WHEN: Mon Jul 13 17:58:38 2009
;; MSG SIZE rcvd: 44
This appears in the syslog...
Jul 13 17:58:38 mail named[18772]: client 65.188.241.191#64026: view external: query (cache) '132.82.145.12.in-addr.arpa/PTR/IN' denied
When the slave servers attempt to load the zone, this appears in syslog...
Jul 13 16:18:45 mail named[12825]: zone 128-28.82.145.12.IN-ADDR.ARPA/IN/external: loaded serial 2009071314
Jul 13 16:18:45 mail named[12825]: zone 128-28.82.145.12.IN-ADDR.ARPA/IN/external: sending notifies (serial 2009071314)
Jul 13 16:22:32 mail named[12825]: client 199.191.128.106#36345: view external: query (cache) '128/28.82.145.12.in-addr.arpa/SOA/IN' denied
Jul 13 16:22:32 mail named[12825]: client 199.191.128.106#50767: view external: bad zone transfer request: '128/28.82.145.12.in-addr.arpa/IN': non-authoritative zone (NOTAUTH)
...any ideas?
Thanks!