When I have a custom search domain, the domain name with the svc.cluster.local suffix cannot be resolved within the k8s cluster - linux

When I add a custom search such as abc to /etc/resolv.conf on the node, the full service.namespace.svc.cluster.local domain name cannot be resolved inside the pod。
This is the content of /etc/resolv.conf inside my pod
nameserver 100.96.0.10
search system.svc.cluster.local svc.cluster.local cluster.local abc
options ndots:5
When I resolve short domain names such as apigateway. It can be resolved normally
bash-5.1# nslookup apigateway
Server: 100.96.0.10
Address: 100.96.0.10#53
Name: apigateway.system.svc.cluster.local
Address: 100.96.101.242
or something like this
bash-5.1# nslookup apigateway.system
Server: 100.96.0.10
Address: 100.96.0.10#53
Name: apigateway.system.svc.cluster.local
Address: 100.96.101.242
bash-5.1# nslookup apigateway.system.svc
Server: 100.96.0.10
Address: 100.96.0.10#53
Name: apigateway.system.svc.cluster.local
Address: 100.96.101.242
But when I add cluster.local it can't resolve
bash-5.1# nslookup apigateway.system.svc.cluster.local
Server: 100.96.0.10
Address: 100.96.0.10#53
*** Can't find apigateway.system.svc.cluster.local.abc: No answer
The external domain name also cannot be resolved
bash-5.1# nslookup www.github.com
Server: 100.96.0.10
Address: 100.96.0.10#53
*** Can't find www.github.com.abc: No answer
From the coredns log, we can see that when the full domain name apigateway.system.svc.cluster.local.abc. is queried, coredns returns noerror. But in fact the domain name does not exist
[INFO] 100.64.2.137:40043 - 60409 "AAAA IN apigateway.system.svc.cluster.local.system.svc.cluster.local. udp 78 false 512" NXDOMAIN qr,aa,rd 171 0.00021492s
[INFO] 100.64.2.137:40043 - 59971 "A IN apigateway.system.svc.cluster.local.system.svc.cluster.local. udp 78 false 512" NXDOMAIN qr,aa,rd 171 0.000247841s
[INFO] 100.64.2.137:56051 - 8509 "A IN apigateway.system.svc.cluster.local.cluster.local. udp 67 false 512" NXDOMAIN qr,aa,rd 160 0.000146127s
[INFO] 100.64.2.137:56051 - 8780 "AAAA IN apigateway.system.svc.cluster.local.cluster.local. udp 67 false 512" NXDOMAIN qr,aa,rd 160 0.000197555s
[INFO] 100.64.2.137:50812 - 47345 "AAAA IN apigateway.system.svc.cluster.local.svc.cluster.local. udp 71 false 512" NXDOMAIN qr,aa,rd 164 0.000198486s
[INFO] 100.64.2.137:50812 - 47072 "A IN apigateway.system.svc.cluster.local.svc.cluster.local. udp 71 false 512" NXDOMAIN qr,aa,rd 164 0.000296226s
[INFO] 100.64.2.137:50985 - 42386 "AAAA IN apigateway.system.svc.cluster.local.abc. udp 57 false 512" NOERROR qr,aa,rd,ra 57 0.026135963s
[INFO] 100.64.2.137:50985 - 41590 "A IN apigateway.system.svc.cluster.local.abc. udp 57 false 512" NOERROR qr,aa,rd,ra 57 0.059998825s
After I removed this custom search domain everything went back to normal
bash-5.1# nslookup www.github.com
Server: 100.96.0.10
Address: 100.96.0.10:53
Non-authoritative answer:
www.github.com canonical name = github.com
Name: github.com
Address: 20.205.243.166
Non-authoritative answer:
www.github.com canonical name = github.com
bash-5.1# nslookup apigateway.system.svc.cluster.local
Server: 100.96.0.10
Address: 100.96.0.10:53
*** Can't find apigateway.system.svc.cluster.local: No answer
Name: apigateway.system.svc.cluster.local
Address: 100.96.101.242

Related

root nameservers doesn't return a Top-Level Domain NS record

Refer to this nslookup session:
>
> a.root-servers.net
Server: 127.0.0.53
Address: 127.0.0.53#53
Non-authoritative answer:
Name: a.root-servers.net
Address: 198.41.0.4
Name: a.root-servers.net
Address: 2001:503:ba3e::2:30
>
> server 198.41.0.4
Default server: 198.41.0.4
Address: 198.41.0.4#53
>
> set type=ns
> com.
;; connection timed out; no servers could be reached
This is when I tried from a linux server.
When I try from my own Windows machine:
> a.root-servers.net
Server: ip-10-220-201-1.eu-west-3.compute.internal
Address: 10.220.201.1
Non-authoritative answer:
DNS request timed out.
timeout was 2 seconds.
Name: a.root-servers.net
Address: 198.41.0.4
> server 198.41.0.4
Default Server: a.root-servers.net
Address: 198.41.0.4
> set type=ns
> com.
Server: a.root-servers.net
Address: 198.41.0.4
*** a.root-servers.net can't find com.: Non-existent domain
> com
Server: a.root-servers.net
Address: 198.41.0.4
*** a.root-servers.net can't find com: Non-existent domain
As far as I know, the root servers should be able to tell me about the Top-Level Domains, so why isn't it working?

Server can't find NXDOMAIN

I'm just tring to configure a DNS server in my local
I configure the /etc/named.conf
options {
listen-on port 53 {
127.0.0.1; 192.168.220.135;
};
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query {
localhost; 192.168.220.0/24;
};
allow-transfer{
localhost; 192.168.220.136;
};
recursion yes;
dnssec-enable yes;
dnssec-validation yes;
dnssec-lookaside auto;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
managed-keys-directory "/var/named/dynamic";
also-notify {
};
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
zone "ayoub.local" IN {
type master;
file "direct.zone";
#allow-update {none;};
};
zone "220.168.192.in-addr.arpa" IN {
type master;
file "inverse.zone";
#allow-update {none;};};
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
and /var/named/direct.zone
**$TTL 3H
# IN SOA MasterDNS.ayoub.local. root.ayoub.local. (
20160421 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minim
# IN NS MasterDNS.ayoub.local.
# IN NS SlaveDNS.ayoub.local.
# IN A 192.168.220.135
# IN A 192.168.220.136
# IN A 192.168.220.137
MasterDNS IN A 192.168.220.135
SlaveDNS IN A 192.168.220.136
Client IN A 192.168.220.137
and the /var/named/inverse.zone
$TTL 3H
# IN SOA MasterDNS.ayoub.local. root.ayoub.local. (
20160418 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
# IN NS MasterDNS.ayoub.local.
# IN NS SlaveDNS.ayoub.local.
# IN PTR ayoub.local.
MasterDNS IN A 192.168.220.135
SlaveDNS IN A 192.168.220.136
Client IN A 192.168.220.137
135 IN PTR MasterDNS.ayoub.local.
136 IN PTR SlaveDNS.ayoub.local.
137 IN PTR Client1.ayoub.local.
and the /etc/resolv.conf
domain ayoub.local
search ayoub.local
nameserver 127.0.0.1
nameserver 192.168.220.136
when i test the domaine with nslookup
;; Got SERVFAIL reply from 127.0.0.1, trying next server
;; connection timed out; trying next origin
;; Got SERVFAIL reply from 127.0.0.1, trying next server
;; connection timed out; no servers could be reached
and when i set /etc/resolv.conf with that
search localdomain
nameserver 192.168.220.2
i see comme result of nslookup
Server: 192.168.220.2
Address: 192.168.220.2#53
** server can't find ayoub.local: NXDOMAIN
Sometimes error happens due to nameserver 127.0.0.1
So in resolve.conf use following or any other name server you like.
Here is my resolve.conf file
nameserver 8.8.8.8
nameserver 1.1.1.1
I resolved the problem. I just forgot to change the group of direct. zone and inverse.zone from the root to named, command is :
chgroup named /var/named/direct.zone
and I force resolve to not changing by the DHCP :
chattr +i /etc/resolv.conf

Issues Setting Up DNS on Linux BIND

I am actually try to setup a DNS and adding an A record for an host that is locally on the network . It looks it seems to have some issues .
[root#vxctf8500 ~]# nslookup N8500
Server: 10.209.194.15
Address: 10.209.194.15#53
Non-authoritative answer:
*** Can't find N8500: No answer
Following The Configuration Files ::
named.conf
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
options {
listen-on port 53 { 127.0.0.1;10.209.194.15; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query {any;};
allow-recursion {any;};
recursion no;
dnssec-enable yes;
dnssec-validation yes;
dnssec-lookaside auto;
/* Path to ISC DLV key */
bindkeys-file "/etc/named.iscdlv.key";
managed-keys-directory "/var/named/dynamic";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
zone"vxctf8500.com" IN {
type master;
file "forward.vxctf8500.com";
allow-update { none; };
};
zone"0.209.10.in-addr.arpa" IN {
type master;
file "reverse.vxctf8500.com";
allow-update { none; };
};
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
Forward Zone ::
$TTL 1D
# IN SOA ns1.vxctf8500.com. root.vxctf8500.com. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
# IN NS vxctf8500.com.
# IN A 10.209.194.15
N8500 A 10.209.194.22
~
With , keeping recursion as YES, the query never completes and gives network error. However the local server resolves
[root#vxctf8500 ~]# nslookup vxctf8500.com
Server: 10.209.194.15
Address: 10.209.194.15#53
Name: vxctf8500.com
Address: 10.209.194.15
[root#vxctf8500 ~]#
Tried With Following Again ::
$TTL 1D
# IN SOA ns1.vxctf8500.com. root.vxctf8500.com. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
IN NS vxctf8500.com.
IN A 10.209.194.15
ns1.vxctf8500.com IN A 10.209.194.15
N8500 IN A 10.209.194.22
[root#vxctf8500 ~]# nslookup N8500
Server: 10.209.194.15
Address: 10.209.194.15#53
Non-authoritative answer:
*** Can't find N8500: No answer
[root#vxctf8500 ~]#
Have also restart the named services.
Any Clues on Setting up Reverse Lookup ::
$TTL 1D
# IN SOA ns1.vxctf8500.com. root.vxctf8500.com. (
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
NS #
A 127.0.0.1
AAAA ::1
IN NS 10.209.194.15.
22 IN PTR nclusters.vxctf8500.com
23 IN PTR nclusters.vxctf8500.com
24 IN PTR nclusters.vxctf8500.com
25 IN PTR nclusters.vxctf8500.com
26 IN PTR nclusters.vxctf8500.com
in forward zone
you need to write
(fully qualified domain ) IN A (ip address of domain)
================================================
IN SOA
ns1.vxctf8500.com. root.vxctf8500.com.
(
0 ; serial
1D ; refresh
1H ; retry
1W ; expire
3H ) ; minimum
IN NS vxctf8500.com.
IN A 10.209.194.15
ns1.vxctf8500.com. IN A 10.209.194.15
N8500. IN A 10.209.194.22
:wq! save it

tshark SIP protocol display collapse

I'm using tshark protocol filter as I need to parse the contents of the SIP Packets.
tshark -r df32c2248fe646a6793ce9a63b124b34#0.0.0.0.pcap -O sip
I get this:
Frame 14: 553 bytes on wire (4424 bits), 553 bytes captured (4424 bits)
Linux cooked capture
Internet Protocol Version 4, Src: 4.4.4.4 (4.4.4.4), Dst: 3.3.3.3 (3.3.3.3)
User Datagram Protocol, Src Port: 5060 (5060), Dst Port: 5060 (5060)
Session Initiation Protocol (200)
Status-Line: SIP/2.0 200 OK
Status-Code: 200
[Resent Packet: False]
[Request Frame: 11]
[Response Time (ms): 115]
[Release Time (ms): 115]
Message Header
Via: SIP/2.0/UDP 2.2.2.2:5060;received=3.3.3.3;branch=z9hG4bK18f6609d-1c76-4a8b-a96b-2cf7d8036d36_6772d868_3067109296759172
Transport: UDP
Sent-by Address: 2.2.2.2
Sent-by port: 5060
Received: 3.3.3.3
Branch: z9hG4bK18f6609d-1c76-4a8b-a96b-2cf7d8036d36_6772d868_3067109296759172
Contact: <sip:14082186500#1.1.1.1:17060>
Contact URI: sip:14082186500#1.1.1.1:17060
Contact URI User Part: 14082186500
Contact URI Host Part: 1.1.1.1
Contact URI Host Port: 17060
To: <sip:14082186500#spicyramen.ippbx.com;user=phone>;tag=83174026
SIP to address: sip:14082186500#spicyramen.ippbx.com;user=phone
SIP to address User Part: 14082186500
SIP to address Host Part: spicyramen.ippbx.com
SIP To URI parameter: user=phone
SIP to tag: 83174026
From: <sip:anonymous#sip.ie1.sipprovider.com>;tag=87638703_6772d868_18f6609d-1c76-4a8b-a96b-2cf7d8036d36
SIP from address: sip:anonymous#sip.ie1.sipprovider.com
SIP from address User Part: anonymous
SIP from address Host Part: sip.ie1.sipprovider.com
SIP from tag: 87638703_6772d868_18f6609d-1c76-4a8b-a96b-2cf7d8036d36
Call-ID: df32c2248fe646a6793ce9a63b124b34#0.0.0.0
CSeq: 44365 BYE
Sequence Number: 44365
Method: BYE
User-Agent: 3CXPhoneSystem 14.0.44198.522 (44097)
Content-Length: 0
As you can see output is not collapse. I want to see something like this:
Frame 14: 553 bytes on wire (4424 bits), 553 bytes captured (4424 bits)
Linux cooked capture
Internet Protocol Version 4, Src: 4.4.4.4 (4.4.4.4), Dst: 3.3.3.3 (3.3.3.3)
User Datagram Protocol, Src Port: 5060 (5060), Dst Port: 5060 (5060)
Session Initiation Protocol (200)
Status-Line: SIP/2.0 200 OK
Message Header
Via: SIP/2.0/UDP 2.2.2.2:5060;received=3.3.3.3;branch=z9hG4bK18f6609d-1c76-4a8b-a96b-2cf7d8036d36_6772d868_3067109296759172
Contact: <sip:14082186500#1.1.1.1:17060>
To: <sip:14082186500#spicyramen.ippbx.com;user=phone>;tag=83174026
From: <sip:anonymous#sip.ie1.sipprovider.com>;tag=87638703_6772d868_18f6609d-1c76-4a8b-a96b-2cf7d8036d36
Call-ID: df32c2248fe646a6793ce9a63b124b34#0.0.0.0
CSeq: 44365 BYE
User-Agent: 3CXPhoneSystem 14.0.44198.522 (44097)
Content-Length: 0
WiresharkYou can use Wireshark to do the job.
Apply a display filter:
sip
Go to the the Packet Details pane.
Expand "Session Initiation Protocol"
Expand Request-Line, Message Header and Message Body* (do not Expand Subtrees)
Go to File - Export - Export Packet Dissections... - As "Plain Text" File...
Packet Format section: select "Packet Summery Line" and "Packet Details: As Displayed"
Add a file name and save the file
*Note
I have used sample file: aaa.pcap
Message Body: see packet 223
TShark
You can use -T Fields and add all the fields you need.
For example:
tshark -r aaa.pcap -Y sip -E header=y -E separator="?" -T fields -e frame.number -e sip.Request-Line -e sip.r-uri -e sip.Via -e sip.From -e sip.To -e sip.Call-ID -e sip.Contact -e sip.Expires -e sip.CSeq -e sip.User-Agent -e sip.Content-Length > aaa.csv

DNS debian SERVFAIL server can't find, no ping [closed]

Closed. This question is off-topic. It is not currently accepting answers.
Want to improve this question? Update the question so it's on-topic for Stack Overflow.
Closed 9 years ago.
Improve this question
I'm trying create a DNS server in my environment of test, but i don't know bind. The settings from my server is created with result of search in google. The bind start without error, but don't resolve my domain. I'm trying create a domain: lunarinterativa.labs to use in my solutions.
i receive this error:
server can't find www.lunarinterativa.labs.lunarinterativa.labs: SERVFAIL
when i execute the command below:
nslookup
> server interativa32
Default server: interativa32
Address: 172.224.116.100#53
> www.lunarinterativa.labs
Server: interativa32
Address: 172.224.116.100#53
My internal netwotk settings is:
ip address: 172.224.116.100
netmask: 255.255.255.0
gateway: 172.224.116.254
I ping to interativa32.lunarinterativa.labs: is OK
PING interativa32.lunarinterativa.labs (172.224.116.100) 56(84) bytes of data.64 bytes from interativa32.lunarinterativa.labs (172.224.116.100): icmp_req=1 ttl=64 time=0.049 ms
I ping to www.interativa32.lunarinterativa.labs: is Wrong
ping: unknown host www.interativa32.lunarinterativa.labs
This is the content of file of settings from my domain (file: /etc/bind/db.lunarinterativa.labs) :
; -------------------------------------------------------------------
; Created by Lunar Interativa Scripts
; type: Bind9
; author: Sileno de Oliveira Brito
; since: 09 Mar 2013
; created: 10 Mar 2013
; domain: lunarinterativa.labs
; ip address: 172.224.116.100
; hostname: interativa32
; -------------------------------------------------------------------
$TTL 604800
# IN SOA interativa32.lunarinterativa.labs. root.interativa32.lunarinterativa.labs. (
2004111700 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
;
# IN A 172.224.116.100
interativa32 IN A 172.224.116.100
www IN CNAME #
ftp IN CNAME #
repo IN CNAME #
ns1 IN CNAME #
This is the content of file of settings from my reverse domain (file: /etc/bind/db.lunarinterativa.labs):
; -------------------------------------------------------------------
; Created by Lunar Interativa Scripts
; type: Bind9 Reverse
; author: Sileno de Oliveira Brito
; since: 09 Mar 2013
; created: 10 Mar 2013
; domain: lunarinterativa.labs
; reverse: 116.224.172.in-addr.arpa
; ip address: 172.224.116.100
; hostname: interativa32
; -------------------------------------------------------------------
# IN SOA interativa32.lunarinterativa.labs. root.interativa32.lunarinterativa.labs. (
2004111700 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
# IN NS ns.lunarinterativa.labs.
# IN A 172.224.116.100
100 IN PTR interativa32.lunarinterativa.labs
This is the entry in /etc/bind/named.conf.local
zone "116.224.172.in-addr.arpa" {
type master;
file "/etc/bind/db.116.224.172.in-addr.arpa";
};
zone "lunarinterativa.labs" {
type master;
file "/etc/bind/db.lunarinterativa.labs";
};
This is my /etc/resolv.conf
domain lunarinterativa.labs
search lunarinterativa.labs
nameserver 127.0.0.1
This is my /etc/hosts
127.0.0.1 localhost
172.224.116.100 interativa32.lunarinterativa.labs interativa32
# The following lines are desirable for IPv6 capable hosts
::1 ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
This is my /etc/bind/named.conf.options
options {
directory "/var/cache/bind";
// If there is a firewall between you and nameservers you want
// to talk to, you may need to fix the firewall to allow multiple
// ports to talk. See http://www.kb.cert.org/vuls/id/800113
// If your ISP provided one or more IP addresses for stable
// nameservers, you probably want to use them as forwarders.
// Uncomment the following block, and insert the addresses replacing
// the all-0's placeholder.
forwarders {
8.8.8.8;
// 0.0.0.0;
172.224.116.254;
};
auth-nxdomain no; # conform to RFC1035
listen-on port 53 { 127.0.0.1; 172.224.116.100; };
allow-query { 127.0.0.1; 172.224.116.0/24; };
allow-recursion { 127.0.0.1; 172.224.116.0/24; };
allow-transfer { none; };
listen-on-v6 { any; };
The error is in my file of configuration i found in web a script and see my error.
This is the correct content of file of settings from my domain (file: /etc/bind/db.lunarinterativa.labs) :
; -------------------------------------------------------------------
; Created by Lunar Interativa Scripts
; type: Bind9
; author: Sileno de Oliveira Brito
; credit: OLIVEIRA , Willian:CONFIGURAÃO APACHE E DNS (BIND). Viva o Linux, Disponíl em: http://www.vivaolinux.com.br/script/Configuracao-Apache-e-DNS-(bind), Acesso em 10/03/2012 à20h 00min
; since: 09 Mar 2013
; created: 10 Mar 2013
; domain: labs.lunarinterativa
; ip address: 172.224.116.100
; hostname: interativa32
; -------------------------------------------------------------------
$TTL 604800
# IN SOA labs.lunarinterativa. root.labs.lunarinterativa. (
2004111700 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
;
# IN NS labs.lunarinterativa.
# IN A 172.224.116.100
interativa32 IN A 172.224.116.100
www IN CNAME interativa32.labs.lunarinterativa.
ftp IN CNAME interativa32.labs.lunarinterativa.
repo IN CNAME interativa32.labs.lunarinterativa.
ns1 IN CNAME interativa32.labs.lunarinterativa.
This is the correct content of file of settings from my reverse domain (file: /etc/bind/db.lunarinterativa.labs):
; -------------------------------------------------------------------
; Created by Lunar Interativa Scripts
; type: Bind9 Reverse
; author: Sileno de Oliveira Brito
; since: 09 Mar 2013
; created: 10 Mar 2013
; domain: labs.lunarinterativa
; reverse: 116.224.172.in-addr.arpa
; ip address: 172.224.116.100
; hostname: interativa32
; -------------------------------------------------------------------
# IN SOA labs.lunarinterativa. root.labs.lunarinterativa. (
2004111700 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
# IN NS labs.lunarinterativa.
# IN A 172.224.116.100
100 IN PTR interativa32.labs.lunarinterativa.
Responses:
nslookup to domain
nslookup www.labs.lunarinterativa
Server: 172.224.116.100
Address: 172.224.116.100#53
nslookup to ip reverse:
nslookup 172.224.116.100
Server: 172.224.116.100
Address: 172.224.116.100#53
100.116.224.172.in-addr.arpa name = interativa32.labs.lunarinterativa.
Now the ping is ok.
To me understand the problem i used the script from Wiliam Oliveira available in http://www.vivaolinux.com.br/script/Configuracao-Apache-e-DNS-(bind)
one special thanks to he. Your scripts not have error in my enviroment.

Resources