rndc issues

English Network/Internet
#1

Hi all.

I’ve got 10.3 running bind on 5 boxes. 1 is the master, the other 4 are slaves. My issue is kind of strange.

I’m using webmin for DNS management (we have windows admins too, they need a gui!). My problem is the slaves aren’t showing any sign that they are getting the notifies from the master.

If I make a record change via webmin and apply changes in an existing zone, I can see in /var/log/messages that the notifies are sent. I’m not seeing any sign in the logs on the slaves that the notify was received. If I go to the slave I can manually run “rndc refresh zone” and the slave checks in right away and updates the zone. rndc status also doesn’t result in any errors.

It was my understanding that making changes on the master would send notifies to the slaves and that the slaves would immediately (or as soon as possible) check in and update the zone. Frustrating that it works manually just fine via forcing the updates (webmin or CLI), but not automatically.

I have verified the keys are all the same, the rndc.conf’s reference the proper keys, and the named.conf’s have all the right information. I’m starting to wonder if the notifies are being stopped by a firewall somewhere. My net peeps tell me that nothing is blocked, and I can do all normal network comm to and from these boxes. In the controls I have defined 127.0.0.1 because if I set the control interface to the internal IP, it breaks rndc.

Being this is my first real foray into bind, please forgive me if I’ve missed something obvious. My boss is starting to say “let’s just use windows DNS” so i’d like to get this working.

Please let me know any relevant configs that would be helpful.

Thanks,

Jay

#2

When a slave receives a NOTIFY request, it has to double check with the master with a NOTIFY response to make sure it really an update and not a forged NOTIFY notification which would cause an unnecessary transfer from the master. Although the BIND doco implies that the master should accept NOTIFY responses from slaves, perhaps you should include an allow-notify { slave1 IP; slave2 IP; }; in the master’s config file.

You could debug the notify exchange with wireshark, or by enable logging for notify at the slave, but I see from typical logs that notify activity at the slave is logged.

Good luck.

#3

Added that to the master, as well as added the allow-notify to the slaves and put in the master IP.

Still not seeing the notify in the slave logs.

I’ll look deeper into the network side. Thanks for the advice. I’m thinking for some reason they aren’t making it to the slaves.

#4

Turns out my net team lied to me!

Firewall was blocking the notifies.

Thanks for the help.