1

I was wondering what I did wrong when setting up the DNS Server on RedHat. The DNS Server is to resolve names within an internal network only. Example: server1.test.net will resolve -> 172.16.32.100.. So on.

I currently am able to resolve the names within the server only, using the server to do a nslookup and it can resolve on 127.0.0.1, But using another machine on the same network, I get "No Response From Server" - Particularly from a windows machine.

Currently running it on VM before rolling it out.

On the Linux Firewall, I have allowed tcp/udp 53.


//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//

options {
    listen-on port 53 { 140.38.85.250; 127.0.0.1; };
    listen-on-v6 port 53 { none; };
    #listen-on-v6 port 53 { ::1; };
    directory   "/var/named";
    dump-file   "/var/named/data/cache_dump.db";
    statistics-file "/var/named/data/named_stats.txt";
    memstatistics-file "/var/named/data/named_mem_stats.txt";
    allow-query     { any; };

    /* 
     - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
     - If you are building a RECURSIVE (caching) DNS server, you need to enable 
       recursion. 
     - If your recursive DNS server has a public IP address, you MUST enable access 
       control to limit queries to your legitimate users. Failing to do so will
       cause your server to become part of large scale DNS amplification 
       attacks. Implementing BCP38 within your network would greatly
       reduce such attack surface 
    */
    recursion yes;

    dnssec-enable no;
    dnssec-validation no;
    dnssec-lookaside auto;

    /* Path to ISC DLV key */
    bindkeys-file "/etc/named.iscdlv.key";

    managed-keys-directory "/var/named/dynamic";

    pid-file "/run/named/named.pid";
    session-keyfile "/run/named/session.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
    type hint;
    file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

zone "sads.com" {
    type master;
    file "/var/named/sads.com.hosts";
    };

Edit 1: I did use webmin to configure the server as I couldn't really seem to follow properly editing and creating the files.

  • 2
    Provide the server configuration files (/etc/named.conf is the most important to have). – Arrow Jul 18 '17 at 5:59
  • 1
    Have you set up the listen-on command? (take a look here as one example of what to change.) – Arrow Jul 18 '17 at 6:03
  • ... and also do you have an allow-query directive? (Presuming this is bind9). – derobert Jul 18 '17 at 6:40
  • @Arrow I have updated it with the code, Sorry I'm still new to this DNS thing. Pretty ambitious about my vision that I have. – Thomas Jul 18 '17 at 12:47
  • @derobert Yep I do, Just updated the content of my question. Have a look., – Thomas Jul 18 '17 at 12:47
2

Some issues with your /etc/named.conf

There is no reason to avoid listenning on IPv6 ::1. That's the IPv6 equivalent of IPv4 127.0.0.1. Uncomment:

#listen-on-v6 port 53 { ::1; };

If the server is to:

to resolve names within an internal network only

You do not want to answer to any source IP only those in your internal network. Set (for example):

allow-query { 172.16.0.0/12; 192.168.196.0/24; localhost; };

Also, you do not need to have recursion active. If recursion were to be enabled, the server will be connecting to the internet to find and resolve external names (not only those in 172.16.x.x (a RFC 1918 Address)).

For simplicity just set:

recursion no

If you will need that this server resolve other internet names in the future, you will need to make an split horizon dns server (quite more complex).

There is no need to set dnssec (probably your local names do not use them).
But specially, there is no reason to enable DLV. It is an old solution before the root domain was DNSSEC signed. That happened around July of 2010. Just comment all the dnssec lines and the bindkeys line.

Now, you need to set an authoritative local domain. You may call it company.priv. or site.internal. or some other. Avoid the something.local. name as the Apple Bonjour system gives an specific use to such domain name.

I do not see anything that even remotly resembles that in the file you supplied.

It looks like you are following an old guide that doesn't even apply to a private local domain. Search for "setting a bind server as local domain authoritative" in the internet to find some help.

This link may be what you need.

To set a DNS server (specially a couple of authoritative servers) is not a 5 minutes job. It demmands some hours of work and test.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.