Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #177768

RE: DNS hits

Show all headers | View raw

Hi Glenn,

>> Actually the current Bind in stable is just a blessing in this respect.
>> It - by default- just allows recursion for localnet, localhost.
>
> This server is still Wheezy. The virtual websites didn't work on Jessie Apache (I have no idea why yet).
> 
>> So if you don't mess with it at all is does the right thing automagically.
> 
>> Most likely if you remove anything you tried to configure in the options it
>> will work just the way you want.
>
> I'd already done what Eduardo suggested in his post (config BIND to allow recursion from only a specified list of IPs), and all was well -- as soon as I tested it properly.
>
> FWIW, I ran dnstop for a while. I saw quite a bit of my own server at first, but over few minutes, its output turned into a list of hits on my domains.
> Almost all from the 52, 54 area (AWS). I don't know, but I assume dnstop is looking at packets before iptables processes them. If not, something is still badly broken.

If you configure BIND to just respond to local requests then dnstop might still see the requests coming from other ip numbers, BIND just might not respond to a recurvice query.
AFAIK iptables has nothing to do with this. You cannot block dns requests at the iptables level as it cannot distinguish between a request for your own domain, to which BIND should respond, and a recursive request for another domain, which BIND should ignore.

Bonno Bloksma

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

DNS hits Glenn English <ghe2001@gmail.com> - 2017-02-11 19:00 +0100
  Re: DNS hits Steve Kemp <steve@steve.org.uk> - 2017-02-11 19:50 +0100
  Re: DNS hits Henning Follmann <hfollmann@itcfollmann.com> - 2017-02-11 22:10 +0100
    Re: DNS hits Glenn English <ghe2001@gmail.com> - 2017-02-12 00:20 +0100
      Re: DNS hits Andy Smith <andy@strugglers.net> - 2017-02-12 02:40 +0100
        Re: DNS hits Glenn English <ghe2001@gmail.com> - 2017-02-12 04:50 +0100
      Re: DNS hits Eduardo M KALINOWSKI <eduardo@kalinowski.com.br> - 2017-02-12 11:40 +0100
      Re: DNS hits Henning Follmann <hfollmann@itcfollmann.com> - 2017-02-12 15:10 +0100
        (d@@g) Bug #849382: apt Markus <debianer@gmx.de> - 2017-02-12 15:30 +0100
          Re: (d@@g) Bug #849382: apt Pascal Hambourg <pascal@plouf.fr.eu.org> - 2017-02-12 15:40 +0100
          Re: (d@@g) Bug #849382: apt Martin Read <zen75502@zen.co.uk> - 2017-02-12 16:10 +0100
        Re: DNS hits Glenn English <ghe2001@gmail.com> - 2017-02-12 19:30 +0100
          RE: DNS hits Bonno Bloksma <b.bloksma@tio.nl> - 2017-02-13 11:10 +0100
  Re: DNS hits Igor Cicimov <icicimov@gmail.com> - 2017-02-12 01:10 +0100

csiph-web