Re: My Introduction and current issues -

On 2025-05-10 02:03, Greg Choules wrote:

> @Danilo you are correct, the contents of /etc/resolv.conf are not set 
> by BIND and BIND itself does not use them. But all applications running 
> on that machine (including dig, unless you specify @<address>) that 
> want some kind of name resolution will make OS system calls and then 
> the OS *will* use what's in resolv.conf to determine where to send DNS 
> queries on behalf of the application.
> 
> Therefore, I will change resolv.conf to replace the current IP with the 
> IP of the server machine itself and, perhaps, Localhost itself 
> (127.0.0.1). I never created resolv.conf and have no idea how it got 
> created. It's weird because "/etc/resolv.conf" is actally a symlink to 
> /run/systemd/resolve/stub-resolv.conf"... the file I need to change.
> 
> In the very first mail, bind9 said that the BIND config contains this:
> 
> listen-on port 53 { 123.123.123.10; 127.0.0.1; };  Correct
> At startup, the named process will tell the OS to send it packets that 
> have those destination addresses AND destination port 53. All fine so 
> far.
> 
> However, bind9 also said this:
> 
> The resolv.conf file contains:
> 
> nameserver 127.0.0.53 Confining things to the Ubuntu box for now, this 
> tells the OS to make DNS queries to 127.0.0.53 - the 53 is *not* the 
> port number, it is the 4th octet of the IPV4 address.
> So the OS sends queries to 127.0.0.53 and named is listening on 
> 127.0.0.1. I think you can see that this isn't going to work.
> 
> I will change that immediately. I will make that entry the same IP as 
> my server machine itself. Do I need a "search" entry for the name 
> server as well? And if yes, should it be just the domain name or the 
> FQDN of the server machine?
> 
> I don't know why resolv.conf contains that nameserver address (and it 
> is an address, not a name - read the man page for resolv.conf), but the 
> easiest solution would be to add that address to the set that named is 
> listening on. i.e.
> 
> listen-on port 53 { 123.123.123.10; 127.0.0.1; 127.0.0.53;};
> 
> The 127.0.0.53 addr is invalid for any form of listening. I will 
> eliminate any reference to it. I will use only the server machine's IP 
> and the loopback.
> 
> You will need to stop/edit/start named for this change to take effect.
> 
> I usually do "systemctl restart named".
> 
> This should fix your issues with apt and other applications running on 
> the Ubuntu server.
> I agree that you should not be using 123.123.123.0/24 [1]. Please read 
> RFC1918 for guidance on private addressing.
> 
> Again, 123.123.123.0/24 is not the actual subnet address. It's just a 
> place holder in the named.conf.options file to mask the real subnet 
> address. For security reasons, I do not publish the actual internal 
> subnet address. But rest assured, the real subnet address definitely 
> falls within the correct publishing guidelines (i.e. 19*) for the head 
> octet.
> 
> tcpdump has a lot of options. For capturing DNS traffic to disk I would 
> suggest this as a first pass:
> 
> sudo tcpdump -c 1000 -n -i all -w <filename> port 53
> 
> This captures all port 53 traffic on any interface (including the 
> loopback), stops after 1000 packets (if you don't stop it yourself with 
> ctrl-C), writes binary capture data to the file <filename> (you choose 
> whatever name you like) and tells tcpdump to *not* attempt to resolve 
> addresses to names. This may be irrelevant since it is capturing to 
> disk but doesn't hurt.
> 
> Thanks much! This will help quite a bit.
> 
> Over to the Windows machine now. You will not have dig by default. BIND 
> for Windows (including utilities like dig) hasn't existed for several 
> years. It is still available to download but I *don't* recommend you 
> install it.
> 
> I won't.  Not worth it.  nslookup seems to be working well enough. And, 
> as stated below, I'll get Wireshark installed.
> 
> Windows nslookup is actually not bad for making test queries, 
> especially if used in interactive mode. Again, read the help to see 
> what options it has.
> 
> Precisely.
> Wireshark can be downloaded and installed for free and I recommend that 
> you do that on the Windows machine, so that when you have captured 
> traffic on the Ubuntu server, once you have copied the capture file to 
> Windows you can open it in Wireshark there. Wireshark can also capture 
> packets, like tcpdump, so you can use it to see exactly what your 
> Windows machine is doing with DNS.
> 
> I'll go ahead and do it.  I might actually have it already for install 
> on Windows, but I'll check for the most current version.
> 
> Hopefully this lot gives you some things to try and also to read, to 
> understand the behaviour you are seeing.
> Cheers, Greg
> 
> Thanks much again!
> 
> On Sat, 10 May 2025 at 06:01, Danilo Godec via bind-users 
> <[email protected]> wrote:
> 
> On 10.05.2025 05:29, [email protected] wrote:
> 
>> Also check /etc/resolv.conf and see what address(es) is/are listed as 
>> nameservers.
> 
> The resolv.conf file contains:
> 
> nameserver 127.0.0.53
> 
> search mydomain.net [2]   (where mydomain is my actual domain name and 
> not the FQDN of the machine (i.e. "machine01.mydomain.net [3]")).
> 
> This was entered by default as BIND was installed.   I am wondering if 
> the "namesever" should be the machine name on which the server is 
> running and not 127.0.0.53 And I gather the 53 on the end has to do 
> with the port on which it's listening. I'm not sure if it's correct 
> that the 4th octet is substituted like that.
> 
> /etc/resolv.conf is not changed or set by BIND, as far as I know it's 
> got nothing to do with BIND at all.
> 
> IIRC Ubuntu is using 'systemd-resolved' (a local resolver with cache) 
> and 127.0.0.53 is the address it listens on, so you might need to check 
> that with 'resolvectl dns'.
> 
> Then check what is listening on port 53 (netstat -anp | egrep 
> ":53.*LISTEN") on the server.
> 
> And also check what DNS servers your DHCP sets.
> 
> Danilo
> 
> --
> Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe 
> from this list
> 
> ISC funds the development of this software with paid support 
> subscriptions. Contact us at https://www.isc.org/contact/ for more 
> information.
> 
> bind-users mailing list
> [email protected]
> https://lists.isc.org/mailman/listinfo/bind-users



Links:
------
[1] http://123.123.123.0/24
[2] http://mydomain.net
[3] http://machine01.mydomain.net

-- 
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list

ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.


bind-users mailing list
[email protected]
https://lists.isc.org/mailman/listinfo/bind-users