<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
The query-source address is nat'ed address inside the firewall. We
opted for that to make our firewall less porous but may be we should
re-visit that strategy.<br>
<br>
The forwarder actually works. That was the primary/only DNS server
we were using until we decided to install our own internal dns and
delegate non-internal DNSqueries to that particular forwarder -
66.7.224.17.<br>
<br>
Yes we will try to debug Whois and DNS separately. But were just
curious about the strange behavior that seems to be connected to us
changing the DNS servers.<br>
<br>
As for logging bind queries, here's a line in our named.conf.log
that does the logging:<br>
<blockquote>category queries { query_log; };<br>
</blockquote>
Not much luck using tcpdump either. We know, from both the query_log
and tcpdump logging, that the queries are going out. But we never
get a reply back. That's the confusing part. The Google DNS server
replies back but not our own ISP's DNS. It times out multiple times
before replying once if at all.<br>
<br>
Thank you,<br>
--<br>
Harsha<br>
<br>
On 6/7/11 7:57 AM, Stephane Bortzmeyer wrote:
<blockquote cite="mid:20110607145758.GA17926@nic.fr" type="cite">
<pre wrap="">On Fri, Jun 03, 2011 at 03:09:13PM -0700,
Sri Harsha Yalamanchili <a class="moz-txt-link-rfc2396E" href="mailto:harsha@thought-matrix.com"><harsha@thought-matrix.com></a> wrote
a message of 145 lines which said:
</pre>
<blockquote type="cite">
<pre wrap=""> o query-source address X.X.X.X port 53;
</pre>
</blockquote>
<pre wrap="">
That's typically a very bad idea because it makes the source port
predictable and therefore makes you much more vulnerable to the
Kaminsky vulnerability.
</pre>
<blockquote type="cite">
<pre wrap=""> forwarders {
66.7.224.17; //Telepacific's DNS server
};
</pre>
</blockquote>
<pre wrap="">
Did you try this forwarder with, for instance, dig? Does it really
work?
</pre>
<blockquote type="cite">
<pre wrap=""> * The whois lookup works as long as we're telepacific's dns
server.
</pre>
</blockquote>
<pre wrap="">
I don't really understand the sentence but, anyway, remember that
whois and DNS are two different and unrelated protocols. I suggest to
debug them separately.
</pre>
<blockquote type="cite">
<pre wrap="">We can clearly see that the queries are going out from the query
log.
</pre>
</blockquote>
<pre wrap="">
BIND logs the outgoing queries? I didn't know. Anyway, I suggest using
tcpdump to see what is really going in and out.
</pre>
</blockquote>
</body>
</html>