<div dir="ltr"><div dir="ltr"><div dir="ltr"><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Jan 18, 2019 at 12:07 PM Ben Croswell <<a href="mailto:ben.croswell@gmail.com">ben.croswell@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="auto">As long as all 4 DNS servers are running the same version, my first suggestion would be to check firewalls for dropped packets.<div dir="auto"><br></div><div dir="auto">Some FW/IPS drop packets with edns versions other 0 because they see it as an attack. </div></div></blockquote><div><br></div><div><div class="gmail_default" style="font-family:verdana,sans-serif">This can be generalized to "<span style="font-family:Arial,Helvetica,sans-serif">Some FW/IPS drop packets".</span></div><div class="gmail_default" style="font-family:verdana,sans-serif">A huge number of nameservers are running with their nameserver software directly exposed on the Internet (and the rest of their services protected by iptables / stateless ACLs) - this leads to better stability, performance, and predictability - the simplification usually also leads to better security - being able to understand the system and what the (lack of) firewall is doing make it simpler and easier to protect.</div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif">Either your "firewall" is doing really deep inspection and understanding of the DNS protocol (in which case you are relying on the ALG to be fully compliant with all behaviors), or you have disabled all ALG work, in which case the firewall is simply adding another point of failure (and likely building state, making troubleshooting harder,etc).</div><br></div><div class="gmail_default" style="font-family:verdana,sans-serif">Roland Dobbins had some good articles about the fragility and security decrease caused by stateful devices in front of Internet service type protocols (such as DNS,etc).</div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif">Warren "Fully expecting FW vendor flames" Kumari.</div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br><div class="gmail_quote"><div dir="ltr">On Fri, Jan 18, 2019, 12:02 PM N. Max Pierson <<a href="mailto:nmaxpierson@gmail.com" target="_blank">nmaxpierson@gmail.com</a> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div dir="ltr"><div dir="ltr">Hi List,<div><br></div><div>I am trying to ensure our Bind servers comply with EDNS for the upcoming Flag Day (<a href="https://dnsflagday.net/" rel="noreferrer" target="_blank">https://dnsflagday.net/</a>). I am somewhat ignorant to EDNS but from what I have read, the information is somewhat conflicting as some documentation states EDNS is not a record that you configure in your zone file then other sites refer to some sort of OPT record you can configure. So my first question is which of the documentation is correct from what I have read? Is it DNS server functionality that supports EDNS or do you also have to configure something in the zone files?</div><div><br></div><div>Also, I have 4 (well 5 counting the master that isn't queryable) nameservers with multiple domains served on them. When I run one of my primary domains through the ISC EDNS tool, it comes back as 2 out of the 4 are failing EDNS queries.They are all on the same version of Bind (9.8.2rc1) and they are all slaves of the master so they should all have the same records. Can anyone please explain what I need to do to resolve the timeouts listed on the ISC testing tool?</div><div><br></div><div>Here is what the tool says ...</div><div><br></div><div><br></div><div><p style="color:rgb(0,0,0);font-family:Arial,sans-serif;font-size:16px"><a href="http://venyu.com" rel="noreferrer" target="_blank">venyu.com</a>. @<a href="http://208.79.48.30" rel="noreferrer" target="_blank">208.79.48.30</a> (ns4.venyu.com.): dns=ok edns=ok <b><font color="darkred">edns1=timeout</font></b> edns@512=ok ednsopt=ok <b><font color="darkred">edns1opt=timeout</font></b> do=ok ednsflags=ok docookie=ok edns512tcp=ok <b><font color="darkred">optlist=timeout</font></b> <br></p><p style="color:rgb(0,0,0);font-family:Arial,sans-serif;font-size:16px"><a href="http://venyu.com" rel="noreferrer" target="_blank">venyu.com</a>. @<a href="http://69.2.33.250" rel="noreferrer" target="_blank">69.2.33.250</a> (ns1.venyu.com.): dns=ok edns=ok edns1=ok edns@512=ok ednsopt=ok edns1opt=ok do=ok ednsflags=ok docookie=ok edns512tcp=ok optlist=ok <br><a href="http://venyu.com" rel="noreferrer" target="_blank">venyu.com</a>. @2604:d800:12::250 (ns1.venyu.com.): dns=ok edns=ok edns1=ok edns@512=ok ednsopt=ok edns1opt=ok do=ok ednsflags=ok docookie=ok edns512tcp=ok optlist=ok <br></p><p style="color:rgb(0,0,0);font-family:Arial,sans-serif;font-size:16px"><a href="http://venyu.com" rel="noreferrer" target="_blank">venyu.com</a>. @<a href="http://69.2.63.250" rel="noreferrer" target="_blank">69.2.63.250</a> (ns3.venyu.com.): dns=ok edns=ok edns1=ok edns@512=ok ednsopt=ok edns1opt=ok do=ok ednsflags=ok docookie=ok edns512tcp=ok optlist=ok <br><a href="http://venyu.com" rel="noreferrer" target="_blank">venyu.com</a>. @2604:d800:13::250 (ns3.venyu.com.): dns=ok edns=ok edns1=ok edns@512=ok ednsopt=ok edns1opt=ok do=ok ednsflags=ok docookie=ok edns512tcp=ok optlist=ok <br></p><p style="color:rgb(0,0,0);font-family:Arial,sans-serif;font-size:16px"><a href="http://venyu.com" rel="noreferrer" target="_blank">venyu.com</a>. @<a href="http://208.79.48.26" rel="noreferrer" target="_blank">208.79.48.26</a> (ns2.venyu.com.): dns=ok edns=ok <b><font color="darkred">edns1=timeout</font></b> edns@512=ok ednsopt=ok <b><font color="darkred">edns1opt=timeout</font></b> do=ok ednsflags=ok docookie=ok edns512tcp=ok <b><font color="darkred">optlist=timeout</font></b> </p><p style="color:rgb(0,0,0);font-family:Arial,sans-serif;font-size:16px"><br></p><p style="color:rgb(0,0,0);font-family:Arial,sans-serif;font-size:16px">TIA!!</p><p style="color:rgb(0,0,0);font-family:Arial,sans-serif;font-size:16px">Regards,</p><p style="color:rgb(0,0,0);font-family:Arial,sans-serif;font-size:16px">Max</p></div></div></div></div>
_______________________________________________<br>
Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br>
<br>
bind-users mailing list<br>
<a href="mailto:bind-users@lists.isc.org" rel="noreferrer" target="_blank">bind-users@lists.isc.org</a><br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
</blockquote></div>
_______________________________________________<br>
Please visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br>
<br>
bind-users mailing list<br>
<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature">I don't think the execution is relevant when it was obviously a bad idea in the first place.<br>This is like putting rabid weasels in your pants, and later expressing regret at having chosen those particular rabid weasels and that pair of pants.<br> ---maf</div></div></div>