BIND-8/9 interface bug? Or is it FreeBSD?

[Oleg Polyakov]

--- Jeremy Chadwick <freebsd at jdc.parodius.com> wrote:
> Oleg:
> 
>         I tried your recommendation of commenting out the transfer-source
>         line, and within a few moments of running this:
> 
> ipfw zero 1005 && ndc stop && /usr/sbin/named -u bind -g bind
> 
>         ...saw the following in our security syslog:
> 
> Apr 18 13:11:09 pentarou /kernel: ipfw: Entry 1005 cleared.
> Apr 18 13:11:33 pentarou /kernel: ipfw: 1005 Deny UDP 10.0.0.1:53
> 64.71.184.190:53 out via fxp0
> Apr 18 13:12:04 pentarou last message repeated 5 times
> 
>         ...and our named syslog:
> 
> Apr 18 13:11:33 pentarou named[77949]: ns_req: sendto([64.71.184.190].53):
> Permission denied
> 
>         So, it doesn't look like that's the offender.  :-)
> 
>         By the way, something I didn't cover: 64.71.184.190 is our
>         secondary nameserver's WAN IP.  It's private is 10.0.0.2.
Possibly it's asymmetrical traffic. UDP query comes from that secondary through
fxp1 and replay goes through fxp0 and got filtered out. Just run
tcpdump -i fxp1 port 53 udp
and check if there are anything unusual as packets from 64.71.184.190.

>         I'm still wondering why tcpdump isn't catching the I/O...
I believe tcpdump catches everything after IPFW - you have to open
firewall to check what those packets are...
 
> -- 
> | Jeremy Chadwick                                   jdc at parodius.com |
> | Parodius Networking                       http://www.parodius.com/ |
> | UNIX Systems Administrator                  Mountain View, CA, USA |
> | Making life hard for others since 1977.                            |
> 
> On Fri, Apr 18, 2003 at 01:09:36PM -0700, Oleg Polyakov wrote:
> > You may want to comment out line:
> > //         transfer-source 10.0.0.1;
> > 
> > Transfers to 10.0.0.0 should choose address 10.0.0.1 automagically.
> > Transfers elsewhere should use zone-relevant transfer-source option.
> > 

=== message truncated ===


__________________________________________________
Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo
http://search.yahoo.com