[CentOS] Not - Re: New DNS server up and running

[Robert Moskowitz]

On 02/20/2013 08:28 PM, Robert Moskowitz wrote:
> It looks like no system, internal or external could access the DNS on my
> new server.  IPTABLES was set for 53 both UDP and TCP. Firewall was OK.
> In fact a local system on the same subnet, thus NOT going through my
> firewall was denied access to the internal domain.  Localhost of course
> works.

In 9.4.1.P1 the allow-query default was changed to localhost; localnet, 
and I had my own name for the acl for my localnets so I was locking 
everything out.  What tripped me up was the default named.conf had 
allow-query {localhost;} and I took that to mean that the default was 
any, not that this blocked out localnet.  Sigh. Panic over and back to 
running with the new box.  But that old box will be kept running for the 
next week.

>
> So it is either the Linux firewall and bind port randomization, or it is
> SELINUX.  How do I test to find out which?
>
> Since the new server is on the same IP address as the old, it is
> unplugged from the switch.  I can switch back and forth between to two
> boxes, only taking the time for ARP table updates.
>
> So I hope someone can point me to what I have missed.
>
>
> On 02/20/2013 02:13 PM, Robert Moskowitz wrote:
>> A new and improved instance of onlo.htt-consult.com is up and providing
>> DNS service.  It is my 1st Centos 6.3 production box.
>>
>> This is Phase I which included IPv6 working 'right'.  Phase II will be
>> to sign my zone and get fully with DNSSEC.
>>
>> I want to thank people here in answering my questions.
>>
>> Now on to other projects.  I have a couple dozen to tackle.
>>
>>
>> _______________________________________________
>> CentOS mailing list
>> CentOS at centos.org
>> http://lists.centos.org/mailman/listinfo/centos
>>
> _______________________________________________
> CentOS mailing list
> CentOS at centos.org
> http://lists.centos.org/mailman/listinfo/centos
>