<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<div>
<div id="x_nine_body_n186b50-bba36" class="x_nine_body" dir="auto" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12.0pt; line-height:1.3; color:#1F497D">
<div class="x_nine-pg" dir="auto">Recommend you run tcpdump on the affected server:</div>
<div class="x_nine-pg" dir="auto"><br>
</div>
<div class="x_nine-pg" dir="auto">tcpdump -n -i ethxxx port 53</div>
<div class="x_nine-pg" dir="auto"><br>
</div>
<div class="x_nine-pg" dir="auto">This should give you a better lay of the land instead of observational troubleshooting. If you do not see packets leaving then there is something on your side.</div>
<div class="x_nine-pg" dir="auto"><br>
</div>
<div class="x_nine-pg" dir="auto">If you see port 53 packets leaving and not returning could be many things but at least you know your putting them out there. Armed with that info you might be able to convince the ISP to dig (no pun intended .. okay intended)
harder.</div>
<div class="x_nine-pg" dir="auto"><br>
</div>
<div class="x_nine-pg" dir="auto">Good hunting.</div>
<div class="x_nine-pg" dir="auto"><br>
</div>
<div class="x_nine-pg" dir="auto">John</div>
<div class="x_nine-pg x_blank x_sign" dir="auto"><br>
</div>
<div id="x_nine-sign-n186b50-bba36" class="x_nine_signature" dir="auto">
<div class="x_nine-pg" dir="auto">Sent from <a href="http://www.9folders.com/" style="text-decoration:none; color:#009BDF">
Nine</a></div>
</div>
</div>
<div class="x_quoted_output_body">
<div id="x_quoted_header_n186b50-bba36" class="x_quoted_header_editor x_fold" dir="auto">
<hr style="border:none; height:1px; color:#E1E1E1; background-color:#E1E1E1">
<div dir="auto" style="border:none; padding:3.0pt 0cm 0cm 0cm"><span style="font-size:11.0pt; font-family:Calibri,Arial,Helvetica,sans-serif"><b>From:</b> Mike Lieberman <mike@netwright.net><br>
<b>Sent:</b> Sunday, March 5, 2023 9:47 PM<br>
<b>To:</b> bind-users@lists.isc.org<br>
<b>Subject:</b> Something other than port 53 is blocking the LAN based BIND9 Servers<br>
</span></div>
</div>
<br type="attribution">
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">Hi, I am new here, but have been using BIND since 1994. <br>
<br>
I am confused by the issue herein and maybe someone has an idea of at least what group I should be talking to.
<br>
<br>
I have a Debian based operation and my BIND9 servers run on Debian. BUT...<br>
<br>
This is really about BIND as it interacts with my ISP supplied FTTH routers. There is apparent port blocking of the servers ONLY using their newer routers and not the older ones. I can't figure out which port is being blocked because UDP and TCP port 53 is
open in all cases and works from any client (including a client application running from Terminal on a server). (Once again, my BIND servers work fine without errors.)<br>
<br>
My ISP (PLDT Philippines) has had a FTTH router that allowed my three BIND servers to work flawlessly. It didn't require a whitelist on a firewall. And all clients could either use our LAN based DNS service or a public one. DIG and NSLOOKUP (yes I know is has
been obsoleted, but net-tools still has it) works.<br>
<br>
But older Router reached EoL and the ISP wanted to change it out to its new FTTH router. And that is when I hit a wall.<br>
<br>
The newer router blocks my local BIND servers (ONLY not clients using downstream servers) from receiving anything from the Internet. OUR BIND servers still have the local networks, but nothing else.
<br>
<br>
So, with the new router, my clients can access a public DNS server downstream and get FQDN resolved. The new router allows remote DNS lookups but denies my local BIND servers access to resolve the same non-local addresses.<br>
<br>
The ISP's EoL equipment is really no longer good for other reasons but I can't use the new one.<br>
<br>
The question I need resolved by the proper group/forum is: What port or technology is doing the blocking? The ISP has no idea.<br>
<br>
I have tried three of the new routers but all blocked my servers. I tried a replacement EoL router and that works. Without changing anything on the network, other than the physical router, it was like flipping a switch.<br>
-- <br>
Visit <a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br>
<br>
ISC funds the development of this software with paid support subscriptions. Contact us at
<a href="https://www.isc.org/contact/">https://www.isc.org/contact/</a> for more information.<br>
<br>
<br>
bind-users mailing list<br>
bind-users@lists.isc.org<br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
</div>
</span></font>
</body>
</html>