Newsgroup: it.comp.reti.cisco
Titolo: SOHO77 and nameserver problems

Hi
I've got a SOHO77 on Tiscali ADSL in Denmark. After having replaced my Cisco
677 with the SOHO77 I'm trying to get my Nameserver up and running. The
server runs fine (Bind9 on Debian) and answers very nicely to requests from
inside the network, but from the outside i've got problems :-( I think it is
a problem with the configuration of the router.
The nameserver is on 192.168.1.2 on the internal net.
The router is on 192.168.1.1 on the internal net.
My NAT entries Looks like this (Listed by "sh ip nat trans"):
XXXXXXXX#sh ip nat trans
Pro Inside global         Inside local          Outside local
Outside global
udp  
213.237.88.166:1539
 
192.168.1.2:1539
 
199.108.6.210:44463
199.108.6.210:44463
tcp  
213.237.88.166:23
 
192.168.1.1:23
        YYY.YYY.YYY.YYY:3299
YYY.YYY.YYY.YYY:3299
tcp  
213.237.88.166:22240
 
192.168.1.240:22
      ---                   ---
tcp  
213.237.88.166:22241
 
192.168.1.241:22
      ---                   ---
tcp  
213.237.88.166:22242
 
192.168.1.242:22
      ---                   ---
tcp  
213.237.88.166:22243
 
192.168.1.243:22
      ---                   ---
---  213.237.88.166        192.168.1.2           ---                   ---
tcp  
213.237.88.166:23
 
192.168.1.1:23
        ---                   ---
(tcp  
213.237.88.166:23
 
192.168.1.1:23
 YYY.YYY.YYY.YYY:3299
YYY.YYY.YYY.YYY:3299 is my self telnetting to the router from the outside
:-)
Using the line ---  213.237.88.166  192.168.1.2  ---  --- I would have
guessed that everything should work, but... nothiong is comming back to
clients on the outside.
I making a lookup from the outside (from IP YYY.YYY.YYY.YYY) the following
entries appears in the NAT list (one try and one retry i guess) :
udp  
213.237.88.166:53
 
192.168.1.2:53
        YYY.YYY.YYY.YYY:1967
YYY.YYY.YYY.YYY:1967
udp  
213.237.88.166:53
 
192.168.1.2:53
        YYY.YYY.YYY.YYY:2012
YYY.YYY.YYY.YYY:2012
The server seems to be answering the request, at least the same things
appear in the debug log as when making the request from inside the
net(Another IP in the list of course :-).
All TCP works beautifully (web, ssh, slaveupdates fra the master DNS).
The server listens on port 53 to "any" address by the way.
Has anybody got an idea of what might be wrong?
Thanx in advance
Hans-Christian Jehg


Hi Hans,
I've just tried to resolve some RR using your BIND server: it looks like to
be a server configuration problem rather than a router's matter... in fact I
could get public SOA, MX, PTR and NS resource records, but no A type record.
What DNS zone are you hosting?
Andrew

 wrote in message
news:bpq4a6$36c$1...@lacerta.tiscalinet.it...


Hi.
I'm replying to myself :-)
I just upgraded to Bind 9.2.3. Same problem :-(
Hans-Christian Jehg
"HC" <a@b.c> wrote in message
news:3fc0a0e1$1$112$65c6...@mercury.nildram.net...



I am not a BIND expert, but it seems its config is OK, uhm.... try to remove
any ACL on the external router interface and make sure there is a rule like
this in the IOS configuration:
!
ip nat inside source static udp [BIND server's address] 53 interface
[external] 53
!
Andrew

 wrote in message
news:bpqulp$q8e$1...@lacerta.tiscalinet.it...



Doing so you can always telnet the router from external, but your internal
network will not be as protected as before... in any case I would solve
first the DNS lookup problem; then, if it will be confirmed to come from
ACLs, I would redefine them in a little more "pragmatic" manner... :-)))
Bye
Andrew