Bind DNS(Nameserver is unreachable.)

Question

Good day!

I would like to on how to bind dns to a NAT? Our old server was using a pulbic IP but due to change in service providers, we were given only an option to do port forwarding.

So I have set up the NAT configuration at the CWP Settings and changed the zone for my domain.

Our current zone for the domain is this

; Generated by CWP
; Zone file for slsu.edu.ph
$TTL 14400
slsu.edu.ph.      86400        IN      SOA     ns1.slsu.edu.ph. mrveeen05.gmail.com. (
                2013071600      ; serial, todays date+todays
                86400           ; refresh, seconds
                7200            ; retry, seconds
                3600000         ; expire, seconds
                86400 )         ; minimum, seconds

slsu.edu.ph. 86400 IN NS ns1.slsu.edu.ph.
slsu.edu.ph. 86400 IN NS ns02.slsu.edu.ph.

slsu.edu.ph. IN A xxx.xxx.xxx.xxx (NAT IP)

localhost.slsu.edu.ph. IN A 127.0.0.1

slsu.edu.ph. IN MX 0 slsu.edu.ph.
mail IN CNAME slsu.edu.ph.
www IN CNAME slsu.edu.ph.
ftp IN CNAME slsu.edu.ph.
; Add additional settings below this line
_dmarc  14400   IN  TXT "v=DMARC1; p=none"

When I try to access the website at http://leafdns.com/, I am still prompted with Nameserver is unreachable

Aside from this, after changing the default configuration in our dns, the BIND DNS Server in the dashboard went to Failed Status with error

Job for named.service failed because the control process exited with error code. See "systemctl status named.service" and "journalctl -xe" for details.

Now I am lost as to why this all happened.

Answer 1

After some research, first off - please get someone who knows how DNS works to help and teach you - you really need a much more in-depth understanding then we can give you - and there are multiple problems here.

The first big problem is that your nameserver is not reachable externally (as leafdns.com) says. Your nameservers - at least as far as the world outside your network goes are NOT ns1.slsu.edu.ph and ns02.slsu.edu.ph - they are webserver.slsu.edu.ph and webserver2.slsu.edu.ph - and both resolve to an IP address of 58.69.125.124.

This is all set up outside of your DNS, and is tied in to details provided to the registrar of your domain name. You need to update these details, including the "glue record". A glue record is an IP address specified when a domain name refers to a subdomain of itself, and this is loaded into the parent nameservers (in this case the nameservers for edu.ph).

Your second problem is that the outside world does not know, does not care and can not reach an IP address in a NAT (strictly speaking RFC1918 or similar) range. If you are trying to have the domain name reachable from outside your network, specifying a NAT IP address is wrong. (You might need to run 2 nameservers and/or split DNS, or ensure your routers support hairpin NAT)

A third problem (at this stage not one that is holding you up) is that you have 2 nameservers, both specifying the same IP address. This breaks specification and is not OK. The DNS system is meant to - and required to be robust. Specifying only 1 IP address for it is not OK (except in edge cases like some clusters, but people setting these up even know better then to do that!)

It also appears likely you are not even running a nameserver. You have pretty much stated that BIND DNS is not running, but for some reason did not provide the output it requested you look at to work out why.

The starting points to fix your problem are -

(a) Produce the output of "systemctl status named.service" and "journalctl -xe" so we can work out why BIND is down.

(b) Change the internal IP address to an external address in your BIND configuration.

(c) Log in to the registrar and update the nameservers and glue records.

(d) Get someone who knows what they are doing to sort out the mess you have properly. (eg split dns/hairpin nat handling, multiple IP addresses and servers)

Alternatively it occurs to me - the solution is STOP USING YOUR OWN DNS SERVERS. You don't know how to. Most registrars will allow you to use their nameservers at no cost. These are generally properly set up, redundant and easy to use through a web interface. Why are you reinventing the wheel?