[ale] DNS woes w/Devil Linux
Joe Knapka
jknapka at kneuro.net
Mon Feb 16 15:01:53 EST 2004
Jonathan Glass <jonathan.glass at ibb.gatech.edu> writes:
Thanks, Jonathan. [Putting this here because otherwise
it will get lost in the shell output below:-]
> Long shot, but does Devil Linux use tcp_wrappers? Have you checked
> /etc/hosts.allow and /etc/hosts.deny?
It does not appear to use tcp_wrappers; /etc/hosts.allow et al do
not exist. It does run BIND in a chroot jail, but the hosts.*
are missing there as well.
> Check your /etc/named.conf file for anything relating to allowed
> clients.
named.conf is extremely minimal. It contains only:
options {
listen-on { 192.168.81.14; 192.168.71.1; };
};
(the internal and wireless interfaces, respectively).
I'm really not sure how this configuration achieves
forward-only behavior; I seem to remember having to
do something rather more complicated when I was
setting BIND up manually on my previous router.
But it does seem to work, for queries from the internal
net.
> Also, what does 'iptables -L -n' report?
Here goes. Incidentally, if I flush all the firewall rules
and change all the policies to ACCEPT, I *still* can't
get DNS to work on the wireless net. Strange, no?
eth0 is the cable modem, eth1 is internal wired LAN,
eth2 is wireless. Notes about what I think is supposed to
happen in #comments.
root at airwall:~ # iptables -L -v -n
Chain INPUT (policy DROP 3858 packets, 205K bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
696 44722 ACCEPT all -- eth1 * 0.0.0.0/0 0.0.0.0/0
838 134K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
61 4584 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 REJECT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:113 reject-with tcp-reset
# Here we should be allowing DNS reqs from wireless-land.
0 0 ACCEPT tcp -- eth2 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53
0 0 ACCEPT udp -- eth2 * 0.0.0.0/0 0.0.0.0/0 udp dpt:53
697 242K DROP all -- * * 0.0.0.0/0 255.255.255.255
0 0 DROP all -- * * 0.0.0.0/0 224.0.0.0/8
463 24951 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 3 LOG flags 0 level 4 prefix `INPUT policy: '
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- eth2 eth1 0.0.0.0/0 192.168.81.28 tcp dpt:9100
0 0 LOG all -- eth0 * 0.0.0.0/0 0.0.0.0/0 state INVALID,NEW LOG flags 0 level 4 prefix `FORWARD INVALID: '
0 0 DROP all -- eth0 * 0.0.0.0/0 0.0.0.0/0 state INVALID,NEW
518K 466M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT all -- eth1 * 0.0.0.0/0 0.0.0.0/0 state NEW
1 92 LOG all -- eth2 eth1 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4 prefix `DMZ->IN: '
1 92 DROP all -- eth2 eth1 0.0.0.0/0 0.0.0.0/0
20568 989K ACCEPT all -- eth2 * 0.0.0.0/0 0.0.0.0/0 state NEW
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 3 LOG flags 0 level 4 prefix `FORWARD policy: '
Chain OUTPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * lo 0.0.0.0/0 0.0.0.0/0
589 169K ACCEPT all -- * eth1 0.0.0.0/0 0.0.0.0/0
# Here we should be allowing DNS replies to hosts on the wireless side.
412 70950 ACCEPT all -- * eth2 0.0.0.0/0 0.0.0.0/0
899 64542 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 LOG all -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 3 LOG flags 0 level 4 prefix `OUTPUT policy: '
root at airwall:~ # iptables -t nat -L -v -n
Chain PREROUTING (policy ACCEPT 825 packets, 47391 bytes)
pkts bytes target prot opt in out source destination
# This seems to just kill off wayward Microsofties.
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:135
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:135
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpts:137:139
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpts:137:139
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:445
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:445
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
# Masq everything going to The World.
575 27715 MASQUERADE all -- * eth0 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 2 packets, 131 bytes)
pkts bytes target prot opt in out source destination
root at airwall:~ #
Cheers,
-- Joe Knapka
--
Barney comes to play with us whenever we may need him;
Someday we will hunt him down and chop him up and eat him!
-- Annze, age 7
--
If you really want to get my attention, send mail to
jknapka .at. kneuro .dot. net.
More information about the Ale
mailing list