<div dir="ltr">
<div>Hello <br></div><div><br></div><div>Still with problems. That setup was running fine for few years. <br></div><div>Bind Server is on DMZ and doing NAT for the local net. Test Server is behing NAT</div><div><br></div><div>Must have another problem</div><div><br></div><div>I try this days a lot of things and nothing works, think in try reinstall but i<span lang="en"><span><span> preferred to know what happened and solve it</span></span></span> <br></div><div><br></div><div>I increase logging and give some additional data but i not understand if is relevant.<br></div><div><br></div><div>lots of :</div><div><br></div><div>adb reached high water mark</div><div>DNS_EVENT_ADBNOMOREADDRESSE</div><div><br></div><div>
network unreachable resolving '<a href="http://play.google.com/A/IN" target="_blank">play.google.com/A/IN</a>': 216.239.36.10#53 <br></div><div>timed out resolving '<a href="http://google.com/A/IN" target="_blank">google.com/A/IN</a>': 1.1.1.1#53</div><div>(first unreacheable then timeout)<br></div><div><br></div><div>08-Jan-2022 00:14:21.588 expire_v4 set to MIN(2147483647,1641597271) import_rdataset<br>08-Jan-2022 00:14:21.588 dns_adb_createfind: found A for name <a href="http://m.root-servers.net" target="_blank">m.root-servers.net</a> (0x7f901a5e53a0) in db<br>08-Jan-2022 00:14:21.644 delete_node(): 0x7f901a73b450 <a href="http://static-assets-prod.s3.amazonaws.com" target="_blank">static-assets-prod.s3.amazonaws.com</a> (bucket 17)<br>08-Jan-2022 00:14:21.648 dns_adb_destroyfind on find 0x7f901a5eb110<br>08-Jan-2022 00:14:21.648 dns_adb_destroyfind on find 0x7f901a5eef10</div><div><br></div><div>08-Jan-2022 00:23:40.915 dispatch 0x7f901435e1f0 response 0x7f901a355ca8 198.97.190.53#53: attached to task 0x7f901a81f5f8<br>08-Jan-2022 00:23:41.023 dispatch 0x7f901435e1f0 response 0x7f901a355ca8 198.97.190.53#53: detaching from task 0x7f901a81f5f8<br>08-Jan-2022 00:23:41.023 dispatch 0x7f901435e1f0: detach: refcount 2</div><div>08-Jan-2022 00:23:41.039 dispatchmgr 0x7f901e3451c8: destroy_mgr_ok: shuttingdown=1, listnonempty=1, depool=7, rpool=0, dpool=7<br>08-Jan-2022 00:23:41.039 dispatch 0x7f901435caf0: shutting down; detaching from sock (nil), task 0x7f901a626880</div><div><br></div><div>08-Jan-2022 00:22:31.479 view internal: validating <a href="http://mmx-ds.cdn.whatsapp.net/A" target="_blank">mmx-ds.cdn.whatsapp.net/A</a>: starting<br>08-Jan-2022 00:22:31.479 view internal: validating <a href="http://mmx-ds.cdn.whatsapp.net/A" target="_blank">mmx-ds.cdn.whatsapp.net/A</a>: attempting insecurity proof<br>08-Jan-2022 00:22:31.479 view internal: validating <a href="http://mmx-ds.cdn.whatsapp.net/A" target="_blank">mmx-ds.cdn.whatsapp.net/A</a>: checking existence of DS at 'net'<br>08-Jan-2022 00:22:31.479 view internal: validating <a href="http://mmx-ds.cdn.whatsapp.net/A" target="_blank">mmx-ds.cdn.whatsapp.net/A</a>: checking existence of DS at '<a href="http://whatsapp.net" target="_blank">whatsapp.net</a>'<br>08-Jan-2022 00:22:31.479 view internal: validating <a href="http://mmx-ds.cdn.whatsapp.net/A" target="_blank">mmx-ds.cdn.whatsapp.net/A</a>: marking as answer (proveunsecure (4))<br>08-Jan-2022 00:22:31.479 view internal: validator @0x7f9004034a70: dns_validator_destroy</div><div><br></div><div>Some:</div><div>success/success [domain:<a href="http://ifconfig.me" target="_blank">ifconfig.me</a>,referral:0,restart:1,qrysent:1,timeout:0,lame:0,quota:0,neterr:0,badresp:0,adberr:0,findfail:0,valfail:0]</div><div>timed out resolving '<a href="http://android.l.google.com/A/IN" target="_blank">android.l.google.com/A/IN</a>': 1.1.1.1#53</div><div>broken trust chain resolving '_.<a href="http://clients6.google.com/A/IN" target="_blank">clients6.google.com/A/IN</a>': 216.239.34.10#53</div><div><br></div><div><br></div><div>And the tiemout error:</div><div>timed out/success [domain:<a href="http://google.com" target="_blank">google.com</a>,referral:0,restart:4,qrysent:13,timeout:12,lame:0,quota:0,neterr:0,badresp:0,adberr:0,findfail:0,valfail:0]</div><div><br></div><div><br></div><div><br></div><div>thanks</div><div><br></div><div>ps: sorry list for wrong subject</div>
</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Jan 12, 2022 at 1:15 PM Tony Finch <<a href="mailto:dot@dotat.at">dot@dotat.at</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Diego Garcia <<a href="mailto:diegargon@gmail.com" target="_blank">diegargon@gmail.com</a>> wrote:<br>
><br>
> Each 20/30 minutes and lasting about 5 minutes i got 'timeout' in bind<br>
> querys. After that time everything works fine again.<br>
><br>
> My bind server got response (from 0.1 to 2 seconds) but reply with a ICMP<br>
> 'port unreachable'.<br>
><br>
> Any idea the problem or what i can check?<br>
><br>
> Firewall is off while testing.<br>
><br>
> My bind server is a NAT router.<br>
<br>
It sounds like the NAT is interfering with BIND's resolver. In general,<br>
NAT (as well as stateful firewalls) do not work well with the DNS, because<br>
UDP port randomization uses a lot of (mostly useless) connection-tracking<br>
state. So it's best to put a full service resolver outside a NAT if<br>
possible.<br>
<br>
In your case, I guess there are several possible IP addresses that BIND<br>
can use as the query source address. Try setting the query-source option<br>
in named.conf to an IP address that's outside the NAT. You will need to<br>
use tcpdump to verify that the right packets with the right addresses are<br>
appearing on the wire.<br>
<br>
Tony.<br>
-- <br>
f.anthony.n.finch <<a href="mailto:dot@dotat.at" target="_blank">dot@dotat.at</a>> <a href="https://dotat.at/" rel="noreferrer" target="_blank">https://dotat.at/</a><br>
Portland, Plymouth: Northeast, veering east or southeast, 3 or 4.<br>
Slight or moderate, occasionally rough at first in Plymouth. Fog<br>
patches at first in south. Moderate or good, occasionally very poor at<br>
first in south.<br>
<br>
</blockquote></div>