Bind9 denied query

Question

I created a bind9 based DNS server to work only in forwarding mode:

This is my named.conf.options file:

#acl goodclients {
#        localhost;
#        localnets;
#};


options {

        directory "/var/cache/bind";

        // If there is a firewall between you and nameservers you want
        // to talk to, you may need to fix the firewall to allow multiple
        // ports to talk.  See http://www.kb.cert.org/vuls/id/800113

        // If your ISP provided one or more IP addresses for stable
        // nameservers, you probably want to use them as forwarders.
        // Uncomment the following block, and insert the addresses replacing
        // the all-0's placeholder.

        recursion yes;

        #allow-query { goodclients; };

        forwarders {
            8.8.8.8;
            8.8.4.4;
        };
        forward only;

        //========================================================================
        // If BIND logs error messages about the root key being expired,
        // you will need to update your keys.  See https://www.isc.org/bind-keys
        //========================================================================
        dnssec-validation auto;

        auth-nxdomain no;    # conform to RFC1035
        listen-on-v6 { any; };
};

I configured the client and everything works fine but I got errors like this:

May 15 08:54:49 digitalocean named[3294]: client x.x.x.x#8137 (unix.stackexchange.com): query (cache) 'unix.stackexchange.com/A/IN' denied

Where x.x.x.x is my public IP address.

Note that the DNS server is public and I am using its public IP in the client config.

Should I ignore the error message ?

When I dig google.com using the public IP of the DNS server (y.y.y.y):

dig @y.y.y.y google.com


; <<>> DiG 9.9.5-3ubuntu0.8-Ubuntu <<>> @y.y.y.y google.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 28091
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;google.com.            IN  A

;; Query time: 15 msec
;; SERVER: y.y.y.y#53(y.y.y.y)
;; WHEN: Sun May 15 14:57:56 CEST 2016
;; MSG SIZE  rcvd: 39

This is confusing.

Rui F Ribeiro · Answer 1 · 2018-02-03T00:45:17.810

It is not working because you have commented out the allow-query and goodclients directives. You should uncomment them and populate goodclients with the IPs/networks BIND is supposed to answer queries.

acl goodclients {
    localhost;
    x.x.x.0/24;
};

options {
    ...
    allow-query { goodclients; };

}

From http://www.zytrax.com/books/dns/ch7/queries.html#allow-query

allow-query defines an match list of IP address(es) which are allowed to issue queries to the server.

Also please do note that from BIND 9.4.1-P1 the default behaviour of allow-query changed from allowed to forbidden.

https://kb.isc.org/article/AA-00269/0/What-has-changed-in-the-behavior-of-allow-recursion-and-allow-query-cache.html

4m1nh4j1 · Accepted Answer · 2016-05-18T15:55:32.830

5

Found it. The solution is to add:

allow-query {
            any;
        };

EDIT: The solution of Rui F Ribeiro works, but I need to create a public server. If you would like to avoid the security issues, please see the comments.

edited May 18 '16 at 15:55

answered May 15 '16 at 14:06

4m1nh4j1

1,823
8
29
40

2

I advise you to not open BIND queries to all. http://openresolverproject.org – Rui F Ribeiro May 15 '16 at 14:10
What if I would like to set it as a public DNS server ? Is there a security threat in this ? – 4m1nh4j1 May 15 '16 at 14:44
yes, there are. have you read the previous link? – Rui F Ribeiro May 15 '16 at 14:50
Yes there are useful information thanks. Since I am using Bind9, I was looking how to install the TCP-ANY Patch, haven't found it. Do you how can I install it ? – 4m1nh4j1 May 15 '16 at 15:42
I advise using rate-limit instead. Please open another question about it. – Rui F Ribeiro May 15 '16 at 16:07

Bind9 denied query

2 Answers2