Pfsense not allowing UDP to internal DNS server
-
I have an internet connection with a static ip from my ISP. I do have mail servers and webservers hosted from it. What i would like to achieve is run couple of nameservers by getting another static ip from my ISP. I have forwarded TCP and UDP ports from my local IP address and the internet connection is being managed by pfsense. The DNS resolver and forwarder service has been disabled.
I tried to setup a nameserver by NAT and forwarded PORT 53 for udp & tcp traffic. But still when i try to query a record for a zone on my nameserver using dig externally or internally , i get an error "no servers could be reached". Is there any guide or information that would help me to setup the nameservers behind NAT or help me solve this issue?
My ISP has confirmed that they do not have blocks or filters in place. I have also confirmed that no ports are being blocked or filtered from my end too.
ETHERNET CONFIG on NS1
auto eth1
iface eth1 inet static
address 192.168.1.12
netmask 255.255.255.0
gateway 192.168.1.1(PFSENSE)
dns-nameservers 8.8.8.8/etc/bind/named/conf.options
options {
directory "/var/cache/bind";
dnssec-validation auto;
auth-nxdomain no;
listen-on-v6 { any; };
};Named.conf.local file on ns1
nano /etc/bind/named.conf.local
zone "sitehelpers.in" {
type master;
allow-transfer {none;};
file"/etc/bind/pri.sitehelpers.in"
};Netstat output from below:
tcp 0 0 192.168.1.36:domain . LISTEN 1156/named
tcp 0 0 localhost:domain . LISTEN 1156/named
tcp 0 0 localhost:953 . LISTEN 1156/named
udp 0 0 192.168.1.36:domain . 1156/named
udp 0 0 localhost:domain . 1156/namedDNSCHECK at PINGDOM
No name servers found at child.
No name servers could be found at the child.
This usually means that the child is not configured to answer queries about the zone.Please find some screenshots of my router config which might help you to point me in the right direction. I use pfsense on a PC which is managing all the internet connection and firewall.
When using packet capture on my wan port in pfsense, i get
19:05:02.660753 IP xx.xx.xx.xx.13747 > 8.8.8.8.53: UDP, length 27
19:05:02.669900 IP 8.8.8.8.53 > xx.xx.xx.xx.13747: UDP, length 509
19:05:02.670409 IP xx.xx.xx.xx.63621 > 8.8.8.8.53: UDP, length 44
19:05:02.694125 IP xx.xx.xx.xx.34919 > 8.8.8.8.53: UDP, length 27
19:05:02.704487 IP 8.8.8.8.53 > xx.xx.xx.xx.34919: UDP, length 509
19:05:02.705580 IP xx.xx.xx.xx.11687 > 8.8.8.8.53: UDP, length 44
19:05:02.741893 IP 8.8.8.8.53 > xx.xx.xx.xx.11687: UDP, length 208
19:05:02.741919 IP 8.8.8.8.53 > xx.xx.xx.xx.63621: UDP, length 208I also tried a probe of my nameservers using intodns.com. Here is what it returned on packet capture (pfsense) on my WAN port.
19:13:39.682095 IP 81.143.220.107.51368 > xx.xx.xx.xx.53: tcp 0
19:13:39.682355 IP xx.xx.xx.xx.53 > 81.143.220.107.51368: tcp 0
19:13:39.893583 IP 81.143.220.107.51368 > xx.xx.xx.xx: tcp 0
19:13:39.894893 IP 81.143.220.107.51368 > xx.xx.xx.xx.53: tcp 34
19:13:39.895023 IP xx.xx.xx.xx.53 > 81.143.220.107.51368: tcp 0
19:13:39.895353 IP xx.xx.xx.xx.53 > 81.143.220.107.51368: tcp 155
19:13:40.100199 IP 81.143.220.107.51368 > xx.xx.xx.xx.53: tcp 0
19:13:40.100220 IP 81.143.220.107.51368 > xx.xx.xx.xx.53: tcp 0The report at intodns.com says
DNS servers responded ERROR: One or more of your nameservers did not respond:
The ones that did not respond are: xx.xx.xx.xxCan anyone help me on this?
-
"or internally ,"
If you can not even dig to your NS when your on the same network.. How exactly do you think it would work externally?
So your NS is on 192.168.1.12/24 - get it working working so you can query it from 192.168.1.0/24 then worry about externally.
Running your own NS on the public internet is normally a BAD idea.. Unless you fully and completely understand all of the implications that brings! Which since your here asking why its not working - this seems to not be the case.
You show that your ip is suppose to be .12, then why is your netstat on the same NS box showing its listening on .36?
Netstat output from below:
tcp 0 0 192.168.1.36:domain . LISTEN 1156/named
udp 0 0 192.168.1.36:domain . 1156/named
