CentOS 7 (1503) - BIND9 new install not responding to external DNS requests

Question

I am trying to set up an authoritative BIND server and every time I run into the same problem on CentOS. I can run the dig command locally for zones on the server however when I run nslookup - serverip from cmd.exe i get no response.

The firewall is open on the server and bind shows nothing in /var/log/messeges or in /var/named/data/named.run

Here is my /etc/named.conf

options {
listen-on port 53 { 127.0.0.1; 172.16.100.1; 1.1.1.1; };
//listen-on-v6 port 53 { ::1; };
directory   "/var/named";
dump-file   "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query     { any; };
allow-transfer  { localhost; 172.16.100.67; };
recursion no;
dnssec-enable yes;
dnssec-validation yes;
dnssec-lookaside auto;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
managed-keys-directory "/var/named/dynamic";
pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
};
logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};
zone "." IN {
    type hint;
    file "named.ca";
};
include "/etc/named/zones.conf";
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

I have rebooted and disabled SELinux to eliminate it. I have checked the correct firewall settings are in place.

named-checkconf /etc/named.conf shows no errors and the service starts successfully, I can ping the server.

Thanks in advance!

Is your interface actually in the `public` firewalld zone? Use `firewall-cmd --get-active-zones` to check. — Michael Hampton, Aug 13 '15 at 22:44
Yes, all my servers are in the public zone including this one. by default. Does this ever change unless set by an admin? — ZZ9, Aug 13 '15 at 22:50
Not in CentOS/RHEL 7. But I could not safely assume an admin didn't change something. — Michael Hampton, Aug 13 '15 at 23:01
Fortunately or unfortunately I am the only admin for our 500 servers >. — ZZ9, Aug 13 '15 at 23:03

score 3 · Accepted Answer · answered Aug 13 '15 at 22:45

3

When you are testing this you are sending your queries to 172.16.100.66.

Your named.config specifies the following addresses: listen-on port 53 { 127.0.0.1; 172.16.100.67; 100.111.100.121; };

Ie, I would expect that named is not listening on the address that you are sending the queries to.

answered Aug 13 '15 at 22:45

Håkan Lindqvist

35,011
5
69
94

THANKS! I have no idea why I always put the wrong setting in there. Up until now I had resorted to running all my bind server on ubuntu because I didn't seem to have this issue on that OS. Strange. – ZZ9 Aug 13 '15 at 22:53
1

@AirCombat I'm not sure I understand what exactly you mean. `listen-on` will define which addresses that `named` binds to. Compare eg `netstat -plnut` output. – Håkan Lindqvist Aug 13 '15 at 22:53

CentOS 7 (1503) - BIND9 new install not responding to external DNS requests

1 Answers1