-1

I would like to setup a public DNS server that uses the server hosts file for certain domains, and then falls back on google's DNS for all other queries.

At such, I setup dnsmasq with the following minimal config:

no-resolv
server=8.8.4.4
server=8.8.8.8
interface=eth0
no-dhcp-interface=eth0
log-queries
log-dhcp

If I run nslookup mydomain.com 127.0.0.1 on the server, I get returned the correct IP address for mydomain.com from the server's hosts file.

However, if I were to replace 127.0.0.1 with the server's public IP, whether I run this command on the server or another host, I get the following error:

;; connection timed out; no servers could be reached

The server is an Amazon Linux EC2 instance with iptables turned off, and the server's firewall policy has tcp port 53 open for 0.0.0.0/0. eth0 is the only network connection for the server.

If I run netstat -vatn on the server, I can see that something is listening on tcp port 53 on 0.0.0.0:

Proto Recv-Q Send-Q Local Address               Foreign Address             State
tcp        0      0 0.0.0.0:53                  0.0.0.0:*                   LISTEN

I can see that port 53 is open on the server because I can successfully open a connection with telnet my-server-ip 53, but I never get any response back from the server on that connection.

This leads me to believe that perhaps my dnsmasq config might be missing something. Does anybody have any ideas?

Felix Mc
  • 103
  • 2
  • What do the security groups look like? Also, what are you trying to accomplish with this setup? It doesn't make any sense. – womble Aug 28 '15 at 02:57
  • @womble the purpose is to be able to do mobile testing on some dev environments that require manual DNS setup..on desktop you can just edit the hosts file to accomplish this, but on mobile since you can't do that, I would like to setup a DNS server that accomplishes the same thing and just point the mobile devices at the DNS server.. – Felix Mc Aug 28 '15 at 03:01
  • @womble here is a screenshot of the sole security group for the server: https://www.dropbox.com/s/x8vz49gso8es99w/Screenshot%202015-08-27%2020.59.23.png?dl=0 – Felix Mc Aug 28 '15 at 03:02

1 Answers1

1

DNS requires both UDP and TCP port 53, so just open 53/udp in your Security Group and it should start working.

EEAA
  • 109,363
  • 18
  • 175
  • 245