I'm having an interesting problem with DNS behind an iptables firewall. This
is a public addressed lan connecting to the internet through the firewall. The
lan is routed to the public interface on the firewall.
I have a network with 2 DNS servers behind the firewall. The firewall is a
2.4.17 kernel on redhat 7.1 (all updates applied). Netfilter is built into the
kernel.
The rules on the firewall are set to allow forwarding of all UDP traffic from
anywhere to anywhere. The INPUT, OUTPUT and FORWARD chains have default
policies of accept.
When I query the DNS for a zone that it is authoritative for I get an answer.
If I query a zone that it is not authoritative for I get a time out after 2
seconds. If I run the same query on the dns server I get an answer.
I have tried explicitly accepting port 53 from anywhere and explicitly letting
all traffic from the protected lan back out. I have also tried letting
everything through with all chains set to default accept and no rules.
Has anyone seen this happen before? Any suggestions appreciated.
Regards,
Dave.
--
Dave Hickey david.hickey at esat.net
Esat IP NOC www.esat.net
Maintained by the ILUG website team. The aim of Linux.ie is to
support and help commercial and private users of Linux in Ireland. You can
display ILUG news in your own webpages, read backend
information to find out how. Networking services kindly provided by HEAnet, server kindly donated by
Dell. Linux is a trademark of Linus Torvalds,
used with permission. No penguins were harmed in the production or maintenance
of this highly praised website. Looking for the
Indian Linux Users' Group? Try here. If you've read all this and aren't a lawyer: you should be!
