<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
meepmeep @ Fantasya.org wrote:
<blockquote
cite="mid:r2sb5e7736b1004130236n47fc76d5v25b88022d57f10d1@mail.gmail.com"
type="cite">Hi
<div><br>
</div>
<div>As an IRC Network administrator, I'm using rbldnsd to create my
own black list of private botnet.</div>
<div>It works great locally, everything is fine. But, with the time,
private botnet goes over other IRC Network, and we thought that it
would be a great idea to share our dnsbl.</div>
<div><br>
</div>
<div>Currently and locally, I request my bind server (listen on
127.0.0.1 and x.x.x.226, both on port 53), and it transfer the request
to rbldnsd (listen to public ip : x.x.x.229, port 53).</div>
<div>I could ask bind or rbldnsd, it works while I'm still on my
server.</div>
<div><br>
</div>
<div>Now, I tried to use this rbldnsd from "outside", and I have a
problem ...</div>
<div>I add 2 entries in my DNS configuration:</div>
<div><br>
</div>
<div><a moz-do-not-send="true" href="http://testbl.mydomain.com">testbl.mydomain.com</a>
IN NS x.x.x.229 (direct access to rbldnsd)</div>
<div><a moz-do-not-send="true" href="http://testbl1.mydomaine.com">testbl1.mydomaine.com</a>
IN NS x.x.x.226 (direct access to bind)</div>
<div><br>
</div>
<div>I add this on my bind configuration :</div>
<div>
<div>zone "<a moz-do-not-send="true"
href="http://testbl1.mydomain.com">testbl1.mydomain.com</a>" IN {</div>
<div> type forward;</div>
<div> forward first;</div>
<div> forwarders {</div>
<div> x.x.x.229 port 53;</div>
<div> };</div>
<div><br>
</div>
</div>
<div><br>
</div>
<div>(in every case, bind should transfer the request to rbldnsd on
x.x.x.229)</div>
<div><br>
</div>
<div>My ip4set on rbldnsd start like this :</div>
<div>
<div>$SOA 0 <a moz-do-not-send="true" href="http://noc.mydomain.com">noc.mydomain.com</a>
<a moz-do-not-send="true" href="http://noc.mydomain.com">noc.mydomain.com</a>
2010071801 15 1m 4w 15</div>
<div>$NS 0 <a moz-do-not-send="true" href="http://noc.mydomain.com">noc.mydomain.com</a></div>
<div>$TTL 10s</div>
<div>:127.0.0.2:IP $ is listed as corrupt</div>
</div>
<div>1.1.1.1 :4:prout</div>
<div>etc.</div>
<div><br>
</div>
<div>And rbldnsd is launch like this : </div>
<div>/usr/sbin/rbldnsd -p /var/run/rbldnsd.pid -r /var/lib/rbldns -w
. -v -f -b x.x.x.229/53 -t 30 -l rbldns.log -s rbldns.stats
dnsbl.irc:ip4set:openhost dnsbl.myircnetwork.ext:ip4set:openhost
testbl.mydomain.com:ip4set:openhost
testbl1.mydomain.com:ip4set:openhost</div>
<div><br>
</div>
<div>And last point (which is for me the source of the problem): </div>
<div>In bind configuration :</div>
<div>
<div> </div>
<div> recursion yes;</div>
<div> allow-recursion { any; };</div>
<div> allow-query { any; };</div>
<div> allow-query-cache { any; };</div>
<div> allow-transfer { any; };</div>
</div>
<div><br>
</div>
<div>So, know .. what is happening :</div>
<div>From an external source, I could request to <a
moz-do-not-send="true" href="http://testbl.mydomain.com">testbl.mydomain.com</a>
(the one that ask rbldnsd directly), and it works. It mean that rbldnsd
manage the zone without any problem: </div>
<div>
<div>$>host <a moz-do-not-send="true"
href="http://1.1.1.1.testbl.mydomain.com">1.1.1.1.testbl.mydomain.com</a></div>
<div><a moz-do-not-send="true"
href="http://1.1.1.1.testbl.mydomain.com">1.1.1.1.testbl.mydomain.com</a> has
address 127.0.0.4</div>
</div>
<div><br>
</div>
<div><br>
</div>
<div>BUT, if I try to request </div>
<div>$>host <a moz-do-not-send="true"
href="http://1.1.1.1.testbl1.mydomain.com">1.1.1.1.testbl1.mydomain.com</a></div>
<div>
<div>;; connection timed out; no servers could be reached</div>
</div>
<div><br>
</div>
<div>
<div>bind's log (daemon.log), doesn't show any error/reject answer...</div>
</div>
<div><br>
</div>
<div>Here I'm stuck .. Why does BIND doesn't tranfer the request ?
How could I check that bind is the one that failed the request ? Why
bind does the job locally and not remotely ?</div>
<div><br>
</div>
<div>I know this isn't related to rbldnsd directly (it seems obvious
that bind is the source of the problem), but I think it's the best
place to get my answer :)</div>
<div><br>
<div>--<br>
Nicolas G. / meepmeep<br>
[EuropNet.org Admin]<br>
<br>
</div>
</div>
<pre wrap="">
<hr size="4" width="90%">
_______________________________________________
rbldnsd mailing list
<a class="moz-txt-link-abbreviated" href="mailto:rbldnsd@corpit.ru">rbldnsd@corpit.ru</a>
<a class="moz-txt-link-freetext" href="http://www.corpit.ru/mailman/listinfo/rbldnsd">http://www.corpit.ru/mailman/listinfo/rbldnsd</a>
</pre>
</blockquote>
If your client is asking x.x.x.226, it expects an answer from x.x.x.226
and won't accept an answer from x.x.x.229 as the client did ask
x.x.x.229 a question. I don' t think you need the forward in this
case. You just need to make sure BIND will do recursive queries from
the outside(dangerous).<br>
<br>
Lyle Giese<br>
LCR Computer Services, inc.<br>
<br>
</body>
</html>