1

I'm testing out a BIND and DNSMASQ configuration on my VPS. When I run a program which submits a bunch of queries (around 10-20 per second) my DNS replies stop coming back for a random amount of time. If sending something like 3 queries per second, the queries do not appear to lockup.

For instance:

  • I can query for 45 seconds and be getting replies. Then all of a sudden for 5 seconds I don't get replies.
  • I can query for 15 seconds and get replies. Then all of a sudden for 10 seconds I don't see replies.

I tried to figure out what is happening by looking at the following:

  • memory usage
  • CPU usage
  • syslog entries from bind debug
  • watch IPTABLES packet streaming to see if iptables isn't able to handle processing so many packets at once.(I have iptables rules in place to restrict DNS requests to only come from my IP and block all other IP requests for any port)
  • tested BIND and DNSMASQ.

what I've seen:

  • BIND and DNSMASQ present the same issue.
  • memory usage appears OK, server isn't killing processes and restarting the processes.
  • CPU usage never goes above 0.7% for the entire system.
  • limiting binds cache size resulted in no noticeable difference.
  • when watching IPTABLES with the rules in place, I saw that IPTABLES incoming packets were streaming in OK when the DNS queries stopped replying and the DNS logs stopped rolling. But what I saw STOP in IPTABLES at the same time that the DNS logs stopped, was the packets to my specific IP in the IPTABLES rule was frozen, while overall incoming packets kept rolling AND my SSH terminal window kept updating obviously since I could see the packet count growing overall on incoming.
  • I then tested flushing all IPTABLES rules, confirmed the problem still occurs with iptables rules flushed. However when watching the incoming packet count, the overall count keeps growing just like when there was the rules in place.

I don't know still 100% if its iptables that's not able to process the incoming packets fast enough? (even with rules all flushed out?) (I'm thinking this is highly unlikely that 20~ or so DNS queries per second could cause iptables to hang up when processing packets)

What exactly could be causing this hangup? The following makes me very confused:

  • SSH terminal is totally fine on refreshing the console screen/taking commands while queries are hanged
  • other programs like top/htop continue to update as well while queries are hanged.
  • iptables overall incoming packets counter keeps rolling while independent rule for my IP's counter does not grow

I'm unable at the time to try to test sending queries from two IP's at once(I know that potentially, this whole problem could be my ISP/router is causing the hangup of DNS traffic im sending?). However I am sending from two different client computers on my network which route through one public IP. I also don't think that this is the likely issue.

Since BIND and DNSMASQ present the same issue with same type of configuration setup, i'm finding it hard to figure out where the problem lies, is it even a bind/dnsmasq issue or is it some sort of system packet processing issue?

I also tested pointing to googles DNS 8.8.8.8 and I had the same issue which makes me believe its something potentially with my ISP/router? Just very strange that such little traffic would cause my router/ISP to crap? Maybe googles dns blocks requests if they're coming in that fast?

Any thoughts?

my VPS is 1 CPU core, 256mb ram, 10gb ssd. system usage usually is around 130-160mb.

  • I'm having same problem....did you figure it out? The accepted answer did not work for me. – chovy Feb 28 '16 at 20:07
  • from what I remember, it's as I stated in the accepted answer comment I posted. saying that it must have been my ISP limiting my requests on my home computer or router. The other VPS to VPS dns query tests seemed to push through a ton more before any sort of hiccup. try testing from another server provider to your dns machine and see if it shows different results. – RCG Mar 1 '16 at 2:07
  • My problem may have been different. I had dns server with dnsmasq on server A and sniproxy on server B for a smart dns routing setup. I had set the server B dns server to use server A and this created an infinite loop. So queries took very long time when there were a lot. I changed Server B to just use Google DNS and now proxying DNS requests from server A worked fine. – chovy Mar 1 '16 at 20:58
  • why do you have two servers for a smart dns setup? one can do both dns and sniproxying. Also yes, you should be pointing to google or root servers, your dns server is meant for incoming requests not for sniproxy to lookup requests. – RCG Mar 2 '16 at 23:03
  • i do geo-targeting -- some hosts go through europe, some through usa, some through australia. etc. etc. etc. If you're happy all your proxying going through that one server (wherever its located) then no, you don't need more than one. – chovy Mar 5 '16 at 10:51
3

It could be rate limiting at the DNS forwarders you have selected (both your ISP's and Google's).

It could also be that connection tracking (stateful firewalling) in your router is causing tables to fill up so that new DNS requests can't be allocated an entry in the NAT table and hence can't be forwarded. However it looks like you're not using NAT, if you have a VPS?

iptables has no problem with extremely large numbers of packets. I've seen it used in an assymmetric routing setup with 4Gbit/s and more of traffic, with thousands of requests per second. Just make sure the conntrack table is large enough, I have net/nf_conntrack_max = 524288 in sysctl.conf.

It might help to configure your BIND as a recursive forwarder for your own IPs, so that you're not dependent on any external forwarders. You're then sending DNS requests to a wide range of DNS servers instead of just 2 or 3, which may help in the NAT.

  • I was able to run some tests with various VPS's today sending dns requests to the one dns VPS along with sending DNS requests from my home router. The other VPS's seemed to run pretty smooth and would only hiccup momentarily every once in a while but could process quite a few requests at once. While one IP would show frozen for a moment, others would continue to query just fine. I was able to also test sending queries from my home modem on two public IP's, when my home router with one public IP would freeze, the other PC directly connected to the switch getting another public IP was fine. – RCG Dec 30 '14 at 21:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.