I figured out the internal address issue. I'm not sure why I keyed it into the nccumc.org <http://nccumc.org> zone but I did. I switched it to the public addresses. I have transferred all of our domains (38!) and they are all working properly. Thanks for your assistance!
On 10/5/05, Aaron Joyner <[EMAIL PROTECTED]> wrote: > > Douglas Ward wrote: > > >I have set up two bind servers (one with master zones and the other with > >slave zones). After much research and work I have all of my domains set > up > >and have verified that transfers are working properly. Now is the time > for > >the servers to go live. I have pointed two test domains to these name > >servers before moving anything in full production. Requests aren't making > it > >through. I think I have missed a step. Here is what I have done so far: > > > >1) Set up servers > >2) Verified that transfers are working properly from master to slave > >3) Entered all of my zones, a records, ns records, mx records etc... > >4) Opened port 53 on the firewall for both servers > >(ns1.nccumc.org <http://ns1.nccumc.org><http://ns1.nccumc.org>and > >ns2.nccumc.org <http://ns2.nccumc.org> <http://ns2.nccumc.org>) > >5) Registered both name servers as public servers through my domain > >registrar > >6) Pointed two domains (nccumc.com <http://nccumc.com> <http://nccumc.com> > and > >nccumc.net <http://nccumc.net><http://nccumc.net>) > >to the name servers > > > >I can't get through to them (name servers). While reading the O'Reilly > book > >on Bind it was suggested to use the following line in named.conf to > restrict > >all activity to port 53: > > > >query-source address * port 53; > > > >Have I missed a port (or range of ports) that should be opened? Maybe a > >configuration step? Any suggestions would be most helpful. Thanks! > > > > > Okay, let's work through this with the .com domains, and see where we > end up. First, we query the .com name servers for > nccumc.com<http://nccumc.com>(for you > purists, yes I'm skipping the root nameservers, it's not relevant): > > $ dig +nocmd +nostats +noquery nccumc.com <http://nccumc.com> @ > a.gtld-servers.net <http://a.gtld-servers.net> > ;; Got answer: > ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3539 > ;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 2, ADDITIONAL: 0 > > ;; AUTHORITY SECTION: > nccumc.com <http://nccumc.com>. 172800 IN NS > ns1.nccumc.org<http://ns1.nccumc.org> > . > nccumc.com <http://nccumc.com>. 172800 IN NS > ns2.nccumc.org<http://ns2.nccumc.org> > . > > Okay, so far so good. This shows us that your registrar has done their > job, and they're delegating to ns{1,2}.nccumc.org (again, for the > purists, we'll skip the step of trying to resolve > nccumc.org<http://nccumc.org>, > it's > working fine). > > > $ dig +nocmd +nostats +noquery nccumc.com <http://nccumc.com> @ > ns1.nccumc.org <http://ns1.nccumc.org> > ;; Got answer: > ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 42960 > ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2 > > ;; ANSWER SECTION: > nccumc.com <http://nccumc.com>. 38400 IN A 70.150.217.67<http://70.150.217.67> > > ;; AUTHORITY SECTION: > nccumc.com <http://nccumc.com>. 38400 IN NS > ns1.nccumc.org<http://ns1.nccumc.org> > . > nccumc.com <http://nccumc.com>. 38400 IN NS > ns2.nccumc.org<http://ns2.nccumc.org> > . > > ;; ADDITIONAL SECTION: > ns1.nccumc.org <http://ns1.nccumc.org>. 38400 IN A > 192.168.10.59<http://192.168.10.59> > ns2.nccumc.org <http://ns2.nccumc.org>. 38400 IN A > 192.168.10.60<http://192.168.10.60> > > So here we see that we got the answer you probably wanted, an A record > of 70.150.217.67 <http://70.150.217.67>. But there's a subtle problem. The > authority section > is correct, it gives us ns1.nccumc.org <http://ns1.nccumc.org> back as the > authoritative DNS > servers, but the name server is attempting to be helpful, and gives us > some "additional" records back, giving us the IP addresses of those .org > name servers, as 192.168.10.{59,60}. Unfortunately, that will poison > the cache of any future dns requests, as they'll know that the most > authoritative answer for ns1.nccumc.org <http://ns1.nccumc.org> should be > 192.168.10.59 <http://192.168.10.59> and .60. > > So look at why ns1.nccumc.org <http://ns1.nccumc.org> believes that > ns1.nccumc.org <http://ns1.nccumc.org> resolves to > 192.168.10.59 <http://192.168.10.59>, and you'll be a lot better off. This > might be a good > time to consider views (read up on it, it'll help you do what you're > probably trying to do, serve two views of internal vs external dns). > > Aaron S. Joyner > -- > TriLUG mailing list : http://www.trilug.org/mailman/listinfo/trilug > TriLUG Organizational FAQ : http://trilug.org/faq/ > TriLUG Member Services FAQ : http://members.trilug.org/services_faq/ > -- TriLUG mailing list : http://www.trilug.org/mailman/listinfo/trilug TriLUG Organizational FAQ : http://trilug.org/faq/ TriLUG Member Services FAQ : http://members.trilug.org/services_faq/
