Support with configuring bind9 DNS server for a private network

binddomain-name-systemlinux-networkingnetworkingUbuntu

I have a number of servers on my home network (192.168.0.0/24) and would like to setup bind9 as a DNS server, so I can more easily resolve IP addresses of these machines by name.

I installed and configured bind9 on ubuntu 20.04 in the following way — following this tutorial pretty closely.

2 zones:
epicsystems.local.com – /etc/bind/zones/db.epicsystems.local.com

    $TTL    604800
@   IN  SOA ns1.epicsystems.local.com. admin.epicsystems.local.com. (
                  3     ; Serial
             604800     ; Refresh
              86400     ; Retry
            2419200     ; Expire
             604800 )   ; Negative Cache TTL
;
; name servers - NS records
    IN  NS  ns1.epicsystems.local.com.

; name servers - A records
ns1.epicsystems.local.com.  IN  A   192.168.0.69


; 192.168.0.0/16 - A records
host2.epicsystems.local.com.    IN  A    192.168.0.67
host1.epicsystems.local.com         IN  A    192.168.0.66

db.192.168 — reverse lookup zone

;
; BIND reverse data file for local loopback interface
;
$TTL    604800
@   IN  SOA ns1.epicsystems.local.com. admin.epicsystems.local.com. (
                  3     ; Serial
             604800     ; Refresh
              86400     ; Retry
            2419200     ; Expire
             604800 )   ; Negative Cache TTL
;

;name servers - NS records
    IN  NS  ns1.epicsystems.local.com.

;PTR records
69.0    IN  PTR ns1.epicsystems.local.com.          ;192.168.0.69
66.0    IN  PTR host1.epicsystems.local.com.            ;192.168.0.66
67.0    IN  PTR host2.epicsystems.local.com.        ;192.168.0.67

My named.conf.local in /etc/bind/named.conf.local has:

//
// Do any local configuration here
//

// Consider adding the 1918 zones here, if they are not used in your
// organization
//include "/etc/bind/zones.rfc1918";

zone "epicsystems.local.com"{
    type master;
    file "/etc/bind/zones/db.epicsystems.local.com"; #zone file path
};

zone "168.192.in-addr.arpa" {
    type master;
    file "/etc/bind/zones/db.192.168"; #192.168.0.0/16 subnet
};

I checked the syntax of the conf and the zones – and syntactically it is valid – but it is not working.

I assign my local mac the dns server 192.168.0.69 — and try an nslookup for ubuntu.com — this works – so the bind9 works to that extent.

If I then try a nslookup for host1 , or host2 – it fails. The misc log for the bind9 shows the zones being setup:

09-Aug-2021 21:23:34.627 zoneload: info: managed-keys-zone: loaded serial 11
09-Aug-2021 21:23:34.627 zoneload: info: zone 0.in-addr.arpa/IN: loaded serial 1
09-Aug-2021 21:23:34.631 zoneload: info: zone 255.in-addr.arpa/IN: loaded serial 1
09-Aug-2021 21:23:34.635 zoneload: info: zone 127.in-addr.arpa/IN: loaded serial 1
09-Aug-2021 21:23:34.635 zoneload: info: zone 168.192.in-addr.arpa/IN: loaded serial 3
09-Aug-2021 21:23:34.639 zoneload: info: zone localhost/IN: loaded serial 2
09-Aug-2021 21:23:34.639 zoneload: info: zone epicsystems.local.com/IN: loaded serial 3
09-Aug-2021 21:23:34.639 general: notice: all zones loaded
09-Aug-2021 21:23:34.639 general: notice: running
09-Aug-2021 21:23:34.743 dnssec: info: managed-keys-zone: Key 20326 for zone . is now trusted (acceptance timer complete)
09-Aug-2021 21:23:34.811 resolver: info: resolver priming query complete
09-Aug-2021 21:23:42.131 dnssec: info:   validating ./SOA: got insecure response; parent indicates it should be secure
09-Aug-2021 21:23:42.143 dnssec: info:   validating ./SOA: got insecure response; parent indicates it should be secure
09-Aug-2021 21:23:42.163 dnssec: info:   validating ./SOA: got insecure response; parent indicates it should be secure
09-Aug-2021 21:23:42.231 dnssec: info:   validating ./SOA: got insecure response; parent indicates it should be secure
09-Aug-2021 21:23:42.247 dnssec: info:   validating ./SOA: got insecure response; parent indicates it should be secure
09-Aug-2021 21:23:42.335 dnssec: info:   validating ./SOA: got insecure response; parent indicates it should be secure
09-Aug-2021 21:23:42.347 dnssec: info:   validating ./SOA: got insecure response; parent indicates it should be secure
09-Aug-2021 21:23:42.415 dnssec: info:   validating ./SOA: got insecure response; parent indicates it should be secure
09-Aug-2021 21:23:42.603 dnssec: info:   validating com/SOA: got insecure response; parent indicates it should be secure
09-Aug-2021 21:23:42.623 dnssec: info:   validating com/SOA: got insecure response; parent indicates it should be secure
09-Aug-2021 21:23:42.707 dnssec: info: validating com/DNSKEY: got insecure response; parent indicates it should be secure
09-Aug-2021 21:23:42.715 dnssec: info: validating com/DNSKEY: got insecure response; parent indicates it should be secure
09-Aug-2021 21:24:20.508 dnssec: info:   validating com/SOA: got insecure response; parent indicates it should be secure
09-Aug-2021 21:24:20.528 dnssec: info:   validating com/SOA: got insecure response; parent indicates it should be secure
09-Aug-2021 21:24:29.244 dnssec: info:   validating cloud/SOA: got insecure response; parent indicates it should be secure
09-Aug-2021 21:24:29.260 dnssec: info:   validating cloud/SOA: got insecure response; parent indicates it should be secure
09-Aug-2021 21:24:29.324 dnssec: info: validating cloud/DNSKEY: got insecure response; parent indicates it should be secure
09-Aug-2021 21:24:29.340 dnssec: info: validating cloud/DNSKEY: got insecure response; parent indicates it should be secure
09-Aug-2021 21:25:36.973 dnssec: info:   validating ./SOA: got insecure response; parent indicates it should be secure
09-Aug-2021 21:25:36.989 dnssec: info:   validating ./SOA: got insecure response; parent indicates it should be secure
09-Aug-2021 21:25:37.005 dnssec: info:   validating ./SOA: got insecure response; parent indicates it should be secure
09-Aug-2021 21:25:37.093 dnssec: info:   validating ./SOA: got insecure response; parent indicates it should be secure
09-Aug-2021 21:29:26.277 dnssec: info:   validating com/SOA: got insecure response; parent indicates it should be secure
09-Aug-2021 21:29:26.577 dnssec: info: validating net/DNSKEY: got insecure response; parent indicates it should be secure

The query.log shows the lookup for host1 arrives – but doesn't resolve anything:

09-Aug-2021 21:25:15.148 client @0x7f1cc0005910 192.168.0.13#49292 (host1.epicsystems.local.com): query: host1.epicsystems.local.com IN A + (192.168.0.69)
09-Aug-2021 21:25:36.941 client @0x7f1cbc00a550 192.168.0.13#58522 (host1): query: host1 IN A + (192.168.0.69)

Can anyone see what I have done wrong here? It is my first time trying to set a DNS server up so it is most likely I made a mistake somewhere!

Best Answer

host1.epicsystems.local.com         IN  A    192.168.0.66

This record is missing a trailing dot. That means that a bind DNS server does not treat it as the fully qualified domain name you wanted to use, but rather as shorthand.

Bind will append the $ORIGIN (the zone name) to shorthand records, making that the A record for host1.epicsystems.local.com.epicsystems.local.com. which is probably not what you intended.

Related Topic