Re: [MaraDNS list] Fwd: MaraDNS doesn't respond to queries from the bind addr subnet

Hi Sam et. al,

Wanted to share how this turned out:

http://serverfault.com/questions/513608/maradns-does-not-respond-to-a-recor=
d-queries-of-locally-connected-rfc1918-addres/516464#516464

Moral of the story is:  "Capture traffic early, capture traffic often."
 Especially when NAT is involved :-)

Thanks to everyone for listening.  Very happy to learn that MaraDNS is not
the culprit.

Dave Owens
TeamUnify, LLC





On Fri, Jun 14, 2013 at 2:12 PM, Dave Owens <[email protected]> wrote:

> Hi Sam,
>
> I tried this with your lightweight DNS server, on a different machine
> (same route), still no luck.  Testing a non-connected rfc1918 returns a
> response, testing a connected rfc1918 address does not work.
>
> An enhanced packet capture shows that when the reply for the 'special' A
> record is sent to the router, the router replies with an
> icmp-host-unreachable packet indicating the that the destination IP is
> unreachable.... I must be hitting a bug or possibly hidden configuration =
in
> the router OS.
>
> Attached is a .pcapng file that illustrates the behavior... first request
> succeeds, subsequent three requests fail.
>
>  Dave Owens
> TeamUnify, LLC
>
>
>
>
>
> On Fri, Jun 14, 2013 at 11:13 AM, Sam Trenholme <[email protected]> wrote=
:
>
>> > Yesterday I ran captures both on our DNS node (it indeed sends the
>> reply)
>> > and on the other side of our edge router (no reply is seen).  Our colo
>> > provider says they aren't doing any deep packet inspection around
>> this...
>>
>> I want to know how this gets resolved--so I can add this information
>> to the MaraDNS FAQ (which is horribly outdated and needs a serious
>> revamp).  There is a small chance it=92s a case of =93MaraDNS makes a
>> weird DNS packet which this route doesn=92t like=94. One way to normaliz=
e
>> against that is to have another computer whose packets go through the
>> same route use a different DNS server to send out the 192.168.50.141
>> DNS reply.
>>
>> For example, here=92s a DNS server I wrote a few years ago:
>>
>> $ cat > nanodns.c
>> /*Placed in the public domain by Sam Trenholme*/
>> #include <arpa/inet.h>
>> #include <string.h>
>> #include <stdint.h>
>> #define Z struct sockaddr
>> #define Y sizeof(d)
>> int main(int a,char **b){uint32_t i;char q[512]
>> ,p[17]=3D"\xc0\f\0\x01\0\x01\0\0\0\0\0\x04";if(a>
>> 1){struct sockaddr_in d;socklen_t f=3D511;bzero(&
>> d,Y);a=3Dsocket(AF_INET,SOCK_DGRAM,0);*((uint32_t
>> *)(p+12))=3Dinet_addr(b[1]);d.sin_family=3DAF_INET;
>> d.sin_port=3Dhtons(53);bind(a,(Z*)&d,Y);for(;;){i
>> =3Drecvfrom(a,q,255,0,(Z*)&d,&f);if(i>9&&q[2]>=3D0)
>> {q[2]|=3D128;q[11]?q[3]|=3D4:1;q[7]++;memcpy(q+i,p,
>> 16);sendto(a,q,i+16,0,(Z*)&d,Y);}}}return 0;}
>> // Hit control-D to end this file here
>> $ gcc -g -O nanodns nanodns.c
>> $ su
>> Password:
>> # ./nanodns 192.168.50.141
>>
>> At this point, the machine is running a tiny little DNS server which
>> will reply to all DNS queries with the IP 192.168.50.141.
>>
>> I have a more readable version of that DNS server here:
>>
>> http://samiam.org/software/microdns.html
>>
>> - Sam
>>
>
>