DNS and firewall - I give up !

mpalladi · n00b Joined: 16 Apr 2003 Posts: 47

I have been in the process of moving over from mandrake..this one has me stumped.

Am running a shorewall two-interface firewall. The deal is that I cannot get the windows clients resolving beyond the firewall. They can dns resolve to the linux (gateway).

I have tried both bind and dnsmasq, without success.

Ie hunted the forums, and can find no clues, which makes me think it normally works, just not for me.

(The mandrake setup uses bind, and works fine )

Any suggestions greatly appreciated

xedx · Tux's lil' helper Joined: 23 May 2003 Posts: 93

can u post ur firewall rules
_________________
--+//+

gcostanz · Posted: Tue May 27, 2003 10:39 pm Post subject:

This is just a note of support. I'm in the process of doing the same thing. I've been running my gateway, webserver and mail system on Mandrake 8.1. And before that, 7, and before that Redhat 6.0. It has worked great.

But now all of my desktop boxes are running Gentoo, and I wan't my server on the same platform-- mainly to stay current.

So, I'm in the process of setting up Gentoo on my AMD K6-III. I was just about to sit down an start working on the dns_masq configuration, when I decided to check the forums first. Your note is not encouraging, but I intend to plod through it. It will be a few days before I have an answer-- but I'll be watching this thread.

fatcat.00 · Tux's lil' helper Joined: 12 Aug 2002 Posts: 145

Not to worry, I am quite sure we can get it working.

There are two obvious things that could be wrong.
1) Your DNS server isn't handing out root servers when he should.
or
2) Your firewall is blocking DNS queries to the Internet.

First, run this command from a UN*X host *behind* your firewall:

mpalladi · n00b Joined: 16 Apr 2003 Posts: 47

fatcat.

Your help was invaluable !

I tried your suggestions, what I found was very interesting.

The nameservers that I am automatically assigned from my ISP are

nameserver 203.194.27.57 #kppp temp entry
nameserver 203.194.56.150 #kppp temp entry

My firewall is able to dig these servers as you suggest. However these servers have been configured in such a way as they cannot be pinged, I guess to prevent from a denial of service attack. Try it yourself from your machine.

The consequence of this, is that for a reason I do not know, the client windows machines behind the firewall cannot use them as a dsn server , either directly, or through the firewall.

So whatever they have done is very restrictive and clever, and far beyond my simple knowledge.

I added a few more less restrictive name servers in my /etc/resolv.conf file, and eveything worked.

Mark

fatcat.00 · Tux's lil' helper Joined: 12 Aug 2002 Posts: 145

Alright well there's something else you can do too. Add this to your named.conf file in the "options" section: