Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations John Tel on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

BIND - External Queries come back "query refused"

Status
Not open for further replies.

cyberspace

Technical User
Aug 19, 2005
968
GB
I have installed BIND ON SuSE 11.1 (PPC, on an IBM POWER Server) and in YaST I have an option of DNS Server under network services.

I have been through the wizard, configured forwarders etc, but whenever I do nslookup in Windows I get:

*** Can't find server name for address 192.168.1.98: Query refused
*** Default servers are not available
Default Server: UnKnown
Address: 192.168.1.98

How can I change this? Why is the default server "UnKnown"?

I can look up A records that I specify but if I try to look up say Google I get:

> google.com
Server: UnKnown
Address: 192.168.1.98

*** UnKnown can't find google.com: Query refused

I have noticed that if i manually change named.conf, it changes back when i restart named.

I have added the following via YaST and can be seen in named.conf:

acl allow-query { all; };
acl allow-recursion { any; };
acl allow-transfer { all; };

But I still can't get it working...

One thing to mention is that this is running on a hosted partition on an IBM server and within its own subnet with mask 255.255.255.248. The clients are in the same address range but with a 255.255.255.0 mask. They server is set to allow any requests...but could this be making a difference?

Also I couldn't find the logs so I told it to go to /home/myaccount/dns.log and log everything...but I can't see anything.

Also in YaST it says bind stats will write to /var/log/named.stats...but there is nothing in /var/log with that name

Rather confused here!!

Any help appreciated.

And if it's any use...here is named.conf (i've changed the zone name to "acme"):

suse:/var/lib/named/etc # cat named.conf
# Copyright (c) 2001-2004 SuSE Linux AG, Nuernberg, Germany.
# All rights reserved.
#
# Author: Frank Bodammer, Lars Mueller <lmuelle@suse.de>
#
# /etc/named.conf
#
# This is a sample configuration file for the name server BIND 9. It works as
# a caching only name server without modification.
#
# A sample configuration for setting up your own domain can be found in
# /usr/share/doc/packages/bind/sample-config.
#
# A description of all available options can be found in
# /usr/share/doc/packages/bind/misc/options.

options {

# The directory statement defines the name server's working directory

directory "/var/lib/named";

# Write dump and statistics file to the log subdirectory. The
# pathenames are relative to the chroot jail.

dump-file "/var/log/named_dump.db";
statistics-file "/var/log/named.stats";

# The forwarders record contains a list of servers to which queries
# should be forwarded. Enable this line and modify the IP address to
# your provider's name server. Up to three servers may be listed.

#forwarders { 192.0.2.1; 192.0.2.2; };

# Enable the next entry to prefer usage of the name server declared in
# the forwarders section.

#forward first;

# The listen-on record contains a list of local network interfaces to
# listen on. Optionally the port can be specified. Default is to
# listen on all interfaces found on your system. The default port is
# 53.

#listen-on port 53 { 127.0.0.1; };

# The listen-on-v6 record enables or disables listening on IPv6
# interfaces. Allowed values are 'any' and 'none' or a list of
# addresses.

listen-on-v6 { any; };

# The next three statements may be needed if a firewall stands between
# the local server and the internet.

#query-source address * port 53;
#transfer-source * port 53;
#notify-source * port 53;

# The allow-query record contains a list of networks or IP addresses
# to accept and deny queries from. The default is to allow queries
# from all hosts.

#allow-query { 127.0.0.1; };

# If notify is set to yes (default), notify messages are sent to other
# name servers when the the zone data is changed. Instead of setting
# a global 'notify' statement in the 'options' section, a separate
# 'notify' can be added to each zone definition.

notify yes;
include "/etc/named.d/forwarders.conf";
};

# To configure named's logging remove the leading '#' characters of the
# following examples.
#logging {
# # Log queries to a file limited to a size of 100 MB.
# channel query_logging {
# file "/var/log/named_querylog"
# versions 3 size 100M;
# print-time yes; // timestamp log entries
# };
# category queries {
# query_logging;
# };
#
# # Or log this kind alternatively to syslog.
# channel syslog_queries {
# syslog user;
# severity info;
# };
# category queries { syslog_queries; };
#
# # Log general name server errors to syslog.
# channel syslog_errors {
# syslog user;
# severity error;
# };
# category default { syslog_errors; };
#
# # Don't log lame server messages.
# category lame-servers { null; };
#};

# The following zone definitions don't need any modification. The first one
# is the definition of the root name servers. The second one defines
# localhost while the third defines the reverse lookup for localhost.

zone "." in {
type hint;
file "root.hint";
};

zone "localhost" in {
type master;
file "localhost.zone";
};

zone "0.0.127.in-addr.arpa" in {
type master;
file "127.0.0.zone";
};

# Include the meta include file generated by createNamedConfInclude. This
# includes all files as configured in NAMED_CONF_INCLUDE_FILES from
# /etc/sysconfig/named

include "/etc/named.conf.include";
logging {
category queries { log_file; };
channel log_file { file "/home/suse/dns.log" size 200M; };
category xfer-in { log_file; };
category xfer-out { log_file; };
category default { log_file; };
};
zone "acme.com" in {
allow-transfer { any; };
file "master/acme.com";
type master;
};
acl allow-query { all; };
acl allow-recursion { any; };
acl allow-transfer { all; };

# You can insert further zone records for your own domains below or create
# single files in /etc/named.d/ and add the file names to
# NAMED_CONF_INCLUDE_FILES.
# See /usr/share/doc/packages/bind/README.SUSE for more details.



'When all else fails.......read the manual'
 
It wasn't clear from your email, but are you able to use a terminal on the server running bind and successfully perform an nslookup? It sounds like you have a configuration issue on the Windows machine to where it either isn't getting the DNS server (ip address) from a DHCP or hasn't been set up. Hence you are getting server: unknown.
 
Thanks for the reply

From a terminal it works fine:

suse:/ # nslookup google.com
Server: 127.0.0.1
Address: 127.0.0.1#53

Non-authoritative answer:
Name: google.com
Address: 66.102.9.147
Name: google.com
Address: 66.102.9.99
Name: google.com
Address: 66.102.9.103
Name: google.com
Address: 66.102.9.104
Name: google.com
Address: 66.102.9.105

If I then stop named...it fails, as you would expect.

This is currently in testing so DNS hasn't been updated in the DHCP scope, however I have configured it manually on two machines

internal lookups work so I think it's safe to say that it is talking to the server to some degree

As a test I changed the IP address of the DNS server, and instead of "query refused" I now get "no response from server" so I think that the issue must be configuration within BIND

'When all else fails.......read the manual'
 
As a further update, I see the following in the syslog (now that I found the right place!) for each external DNS query:

Jan 5 13:04:59 suse named[18617]: client 192.168.1.224#1066: query: google.com.acme.com IN A +
Jan 5 13:04:59 suse named[18617]: client 192.168.1.224#1067: query: google.com IN A +
Jan 5 13:04:59 suse named[18617]: client 192.168.1.224#1067: query (cache) 'google.com/A/IN' denied


Doesn't really say much to me (other than the obvious fact it's denied)...but perhaps it does to someone else?

Again I have changed my company name to "acme" - I note on the first line - query: google.com.acme.com

is that correct?? why is it appending my domain suffix?

'When all else fails.......read the manual'
 
Also, when I enter "nslookup" into windows and I see this in the command prompt:

*** Can't find server name for address 192.168.1.98: Query refused
*** Default servers are not available
Default Server: UnKnown
Address: 192.168.1.98

I see the following in the log for named:

Jan 5 13:11:52 suse named[18617]: client 192.168.1.224#1082: query: 98.1.168.192.in-addr.arpa IN PTR +
Jan 5 13:11:52 suse named[18617]: client 192.168.1.224#1082: query (cache) '98.1.168.192.in-addr.arpa/PTR/IN' denied



'When all else fails.......read the manual'
 
acl defines the acl "group". You actually defined the group "allow-query", but did not apply it with the directive "allow-query".

like in options

allow-query { "allow-query"; };

I would change the names of those acls to avoid confusion.

I didn't sift through you testing, but it won't work as currently configured.
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top