DNS Server Setup

Posted on 2004-04-08
Last Modified: 2013-12-15
I'm setting up my first DNS server on RedHat Linux 9 and have come across a problem when other computers attempt to query my server.
The server itself can resolve names to IP's but from a remote computer the server doesn't responed.
For example:
From a windows computer on the same LAN I try to do a nslookup for and get the following response:

Server:  []
*** [] can't find No response from server

Why would the server not give responses to other remote computers?
Question by:wookaka
  • 3
  • 2
  • 2
LVL 40

Expert Comment

ID: 10788998
My guess would be that your DNS server probably isn't, in fact, working. It /etc/resolv.conf on the DNS server still contains the IP(s) of an Internet nameserver you'd still be able to resolve hostnames/IP's since the requests would go to the Internet DNS servers.

If there's a serious error in your DNS configuration you should be able to see what's wrong by watching the tail end of /var/log/messages (tail -f /var/log/messages) while you start named.

Author Comment

ID: 10789430
I already removed all other DNs servers from the resolv.conf file except for and also check the /log/messages file. I did have one error about the 0.0.127 zone file missing but corrected that and the same problem continued.
Since this was a "getting my feet wet setup" I formatted and reinstalled without the firewall and I can now get DNS requests from the server.

Thanks anyway.
LVL 12

Expert Comment

ID: 10791147
Is the RedHat server running IPTABLES and not allowing access to the BIND instance?

RedHat 9 installs IPTables by default, and bases its setup on how you answer a question or two during the installation.

See if IPTables is installed/running with    iptables -L -n

You may need to stop the firewall rules with    /etc/init.d/iptables stop    and try your DNS query again.
VMware Disaster Recovery and Data Protection

In this expert guide, you’ll learn about the components of a Modern Data Center. You will use cases for the value-added capabilities of Veeam®, including combining backup and replication for VMware disaster recovery and using replication for data center migration.


Author Comment

ID: 10792301
Here's what I get when I run the first command...

[root@nsi1 root]# iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

I'm guessing that since I've reinstalled with no firewall that the IPTables are already stopped.

I'm guessing I would use   /etc/init.d/iptables start    to turn it on?
How would I then customize this to allow only ports 22 and 53 into the box?
LVL 12

Expert Comment

ID: 10792596
The output shows that you have no restrictions in place for communications. Other machines should be able to access the NAMED server.

Let's keep the IPTables out of it for now...

You will need to check your /etc/named.conf and /etc/named.custom files for things like "allow-query" statements. It is quite possible that the server has ACL's on it (although this is not a default) that are preventing it from working properly. Use RedHat's on-line documentation to make sure you have everything set the way you need it...

Author Comment

ID: 10793205
Just to make sure you are aware, the DNS server is working now. If you read above the server has been working since I reinstalled RedHat. I did 2 things in this setup different:
1) disabled the firewall during the initial installation.
2) didn't play with named.conf

It's now a caching name server and even setup as a slave for 1 domain.

I can't give the points for the DNS problem but would be happy to if you could give me some info on enambling the IPTables to secure the box and only allow ports 22 and 53 in.

LVL 40

Accepted Solution

jlevie earned 125 total points
ID: 10793561
Below is the firewall setup that I use to limit access to servers. It is pretty heavily commented and is currently configured to only allow SSH & DNS. Read through the comments to see how to set it up and for examples of other things you can do with it.

# This is a simple, reasonably complete local host based firewall suitable for
# protecting a server that might be exposed to malicous activity.
# Save this in root's home directory as iptables-host and make it executable
# with 'chmod +x iptables-host'. Then to install the rule set simply run it
# with './iptables-host'.
# Once the rule sets are to your liking you can easily arrange to have them
# installed at boot on a Redhat box (7.1 or later). Save the rules with:
# service iptables save
# which saves the running ruleset to /etc/sysconfig/iptables. When
# /etc/init.d/iptables executes it will see the file and restore the rules.
# I find it easier to modify this file and run it to change the rulesets,
# rather than modifying the running rules. That way I have a readable
# record of the firewall configuration.
# Author: Jim Levie (
# Set an absolute path to IPTABLES and define my IP.
# Clear out any existing firewall rules, and any chains that might have
# been created. Then set the default policies.
$IPT -F -t mangle
$IPT -F -t nat
# Begin setting up the rulesets. First define some rule chains to handle
# exception conditions. These chains will receive packets that we aren't
# willing to pass. Limiters on logging are used so as to not to swamp the
# firewall in a DOS scenario.
# silent       - Just dop the packet
# tcpflags     - Log packets with bad flags, most likely an attack
# firewalled   - Log packets that that we refuse, possibly from an attack
$IPT -N silent
$IPT -A silent -j DROP

$IPT -N tcpflags
$IPT -A tcpflags -m limit --limit 15/minute -j LOG --log-prefix TCPflags:
$IPT -A tcpflags -j DROP

$IPT -N firewalled
$IPT -A firewalled -m limit --limit 15/minute -j LOG --log-prefix Firewalled:
$IPT -A firewalled -j DROP
# These are all TCP flag combinations that should never, ever, occur in the
# wild. All of these are illegal combinations that are used to attack a box
# in various ways.
$IPT -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j tcpflags
$IPT -A INPUT -p tcp --tcp-flags ALL ALL -j tcpflags
$IPT -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j tcpflags
$IPT -A INPUT -p tcp --tcp-flags ALL NONE -j tcpflags
$IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j tcpflags
$IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j tcpflags
# Allow selected ICMP types and drop the rest.
$IPT -A INPUT -p icmp --icmp-type 0 -j ACCEPT
$IPT -A INPUT -p icmp --icmp-type 3 -j ACCEPT
$IPT -A INPUT -p icmp --icmp-type 11 -j ACCEPT
$IPT -A INPUT -p icmp --icmp-type 8 -m limit --limit 1/second -j ACCEPT
$IPT -A INPUT -p icmp -j firewalled
# The loopback interface is inheritly trustworthy. Don't disable it or
# a number of things will break.
# Now allow Internet hosts access to those services we provide. Note that
# enabling inbound FTP 20 & 21 tcp will also require allowing ports
# 1024-65534/tcp. Which in itself is good enough reason not to allow FTP
# connections and to only allow ssh/scp/sftp.
# Allow ssh from anywhere to this server
$IPT -A INPUT -p tcp -s 0/0 --dport 22 -j ACCEPT
# DNS access from anywhere
$IPT -A INPUT -p tcp -s 0/0 --dport 53 -j ACCEPT
$IPT -A INPUT -p udp -s 0/0 --dport 53 -j ACCEPT
# HTTP access from anywhere
#$IPT -A INPUT -p tcp -s 0/0 --dport 80 -j ACCEPT
#$IPT -A INPUT -p tcp -s 0/0 --dport 443 -j ACCEPT
# Allow access to SMTP only from a single node
#$IPT -A INPUT -p tcp -s --dport 25 -j ACCEPT
# If there are trusted nodes you can allow then access to everything with
# something like this. Be sure to set IP at the top of this script if you
# enable one of these.
#$IPT -A INPUT -s -d $IP1 -j ACCEPT
#$IPT -A INPUT -s -d $IP1 -j ACCEPT
# Allow packets that are part of an established connection to pass
# through the firewall. This is required for normal Internet activity.
# Anything not already matched gets firewalled and logged.
$IPT -A INPUT -j firewalled

Featured Post

Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Debug VNC connection on CentOS7 server 22 87
linux installs 6 60
Run DOS2UNIX and then execute the command 21 72
linux 13 51
This is the error message I got (CODE) Error caused by incompatible libmp3lame 3.98-2 with ffmpeg I've googled this error message and found out sometimes it attaches this note "can be treated with downgrade libmp3lame to version 3.97 or 3.98" …
Over the last ten+ years I have seen Linux configuration tools come and go. In the early days there was the tried-and-true, all-powerful linuxconf that many thought would remain the one and only Linux configuration tool until the end of times. Well,…
Learn how to get help with Linux/Unix bash shell commands. Use help to read help documents for built in bash shell commands.: Use man to interface with the online reference manuals for shell commands.: Use man to search man pages for unknown command…
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.

822 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question