Outside Inbound DNS Queries

[loyalist]

We are having a dns problem that remains unresolved, we have a couple of websites that are being hosted internally and for some reason we cannot get DNS queries from the outside to work. Our internal dns server works fine, and is able to send queries outside, however whenever we attempt to have an external dns server query our server it fails. When I debug on the pix I can see the dns query come in and then don't see anything else, when doing tcpdump on the external dns server we see the query and see the reply from our server however then the external dns server sends back a port unreachable using icmp?????(added access list statement to allow inbound icmp and it didn't work) This is very bizarre, and we have been unable to make it work, I have looked at many pix configs and they aren't doing anything different than me, however I wonder, it's probably not very common to have inbound dns queries and maybe the pix doesn't allow it or there is an additional setting that I have missed. I have an access-list on the outside and inside interfaces that are allowing udp and tcp dns traffic. The server is being statically translated on the outside interface.

I have tried changing the inside access list around using both any and host as the source and destination just in case and this didn't resolve it, have also tried the alias command and it didn't help either.

Here is my config, any help is greatly appreciated:

PIX Version 6.1(4)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security40
enable password ePHljFUCIEVyOBzQ encrypted
passwd mKjpNR.iP.gTbXrV encrypted
hostname pix
domain-name pix.com
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
name 10.100.75.12 dmz_server_no_public_access
name 10.100.50.62 user
name xxx.xxx.xxx.xxx dmz_webserver1
name xxx.xxx.xxx.xxx internal_dns_server
name xxx.xxx.xxx.xxx dmz_webserver2
access-list 20 permit tcp any host dmz_webserver1 eq 443
access-list 20 permit tcp any host dmz_webserver1 eq www
access-list 20 permit tcp any host dmz_webserver1 eq 22
access-list 20 permit tcp any host dmz_webserver2 eq www
access-list 20 permit tcp any host dmz_webserver2 eq 443
access-list 20 permit tcp any host internal_dns_server eq 443
access-list 20 permit tcp any host internal_dns_server eq www
access-list 20 permit tcp any host internal_dns_server eq 22
access-list 20 permit udp any host internal_dns_server eq domain
access-list 20 permit tcp any host dmz_webserver2 eq 22
access-list 20 permit tcp any host internal_dns_server eq domain
access-list 10 permit ip any any
access-list 10 permit icmp any any
access-list 10 permit udp host internal_dns_server any eq domain
access-list 10 permit tcp host internal_dns_server any eq domain
access-list dmz permit icmp any any
access-list dmz permit ip any any
pager lines 24
logging on
logging timestamp
logging buffered informational
interface ethernet0 10baset
interface ethernet1 100full
interface ethernet2 100full
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip address outside xxx.xxx.xxx.xxx 255.255.255.248
ip address inside 10.100.150.9 255.255.255.248
ip address dmz 10.100.75.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm history enable
arp timeout 14400
global (outside) 1 interface
global (dmz) 1 interface
nat (inside) 1 10.100.150.8 255.255.255.248 0 0
nat (inside) 1 10.100.25.0 255.255.255.0 0 0
nat (inside) 1 10.100.50.0 255.255.255.0 0 0
nat (inside) 1 10.100.100.0 255.255.255.0 0 0
nat (dmz) 1 10.100.75.0 255.255.255.0 0 0
static (inside,outside) internal_dns_server 10.100.50.254 netmask 255.255.255.255 0 0
static (dmz,outside) dmz_webserver1 10.100.75.10 netmask 255.255.255.255 0 0
static (dmz,outside) dmz_webserver2 10.100.75.11 netmask 255.255.255.255 0 0
access-group 20 in interface outside
access-group 10 in interface inside
access-group dmz in interface dmz
route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 1
route inside 10.100.50.0 255.255.255.0 10.100.150.10 1
route inside 10.100.100.0 255.255.255.0 10.100.150.10 1
timeout xlate 1:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
http server enable
http user 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
no sysopt route dnat
telnet user 255.255.255.255 inside
telnet user 255.255.255.255 dmz
telnet timeout 15
ssh timeout 5
terminal width 80
Cryptochecksum:01c4262dbf4da3b09a3a39b66fcda3b6

 

[bwilliam13]

May be a stupid question...I recognize you from another thread...

But can your DNS server surf the web?

 

[loyalist]

yes it can

 

[bwilliam13]

Slightly off-topic, but what is your DNS server? Linux? Windows? Solaris? And what version of BIND/DNS is it running?

This isn't a problem with your firewall config. All the rules are correct to make this happen.

 

[loyalist]

redhat linux 7.2, bind version 9.2.1-1.7x.2 ipchains rules: -A input -s 0/0 53 -d 0/0 -p udp -j ACCEPT -A input -s 0/0 53 -d 0/0 -p tcp -y -j ACCEPT -A input -s 0/0 -d 0/0 53 -p udp -j ACCEPT -A input -s 0/0 -d 0/0 53 -p tcp -y -j ACCEPT

Funny thing is before we installed the pix, this box was our firewall and dns was working fine. Have tried permit ip any any on both inside and outside interfaces and it still doesn't work. Starting to wonder, I have made so many changes to the access lists over the past week and the configuration in general and have not reloaded the pix. Maybe I should remove all the current access lists and reboot the box, this could clear up the problems, however all the other access lists are working fine.

 

[bwilliam13]

Maybe you should completely clear the IPchains/IPtables rules on the DNS box and see what happens.

I'm out of suggestions at this point. I don't think this is a PIX issue.

 

[loyalist]

Actually, we have done that as well. I'm out of options, think I will reboot it tonight after everyone leaves and see what happens.

Thanks for your input.

 

[BuckWeet]

Your static command for that server is incorrect. You need to do it like this

static (inside,outside) <global ip> internal_dns_server netmask 255.255.255.255

then whatever is on the outside going in to query your server should work. Might also do a clear xlate on it..

BuckWeet

 

[loyalist]

Thanks guys, found the problem, bwilliam you were right, it wasn't the pix afterall, it was the external dns server we were using to test, it is configured to not accept updates from unknown clients. Tried a different dns server to test from and everything is working fine.