1

bind9 bind-9.17.2 has been compiled from source on debian-9.

./named -V
BIND 9.17.2 (Development Release) <id:6d46544>
running on Linux x86_64 4.9.0-6-amd64 #1 SMP Debian 4.9.88-1+deb9u1 (2018-05-07)
built by make with  '--with-maxminddb' '--prefix=/usr' '--enable-fixed-rrset' '--sysconfdir=/etc/bind'
compiled by GCC 6.3.0 20170516
compiled with OpenSSL version: OpenSSL 1.1.0l  10 Sep 2019
linked to OpenSSL version: OpenSSL 1.1.0l  10 Sep 2019
compiled with zlib version: 1.2.8
linked to zlib version: 1.2.8
linked to maxminddb version: 1.2.0
threads support is enabled

default paths:
  named configuration:  /etc/bind/named.conf
  rndc configuration:   /etc/bind/rndc.conf
  DNSSEC root key:      /etc/bind/bind.keys
  nsupdate session key: /usr/var/run/named/session.key
  named PID file:       /usr/var/run/named/named.pid
  named lock file:      /usr/var/run/named/named.lock
  geoip-directory:      /usr/share/GeoIP

The main goal is use its GeoIP feature and answering queries based on resolver(s) IP address location and the configuration for named.conf.local is as simple as this :

...
...
include "/etc/bind/geoip/GeoIP.acl";

view "Iran" {
      match-clients { IR; };
      recursion no;
      zone "ppod.ir" {
            type master;
            file "/etc/bind/db.ppod.ir.iran";
      };
};

view "default"  {
       include "/etc/bind/named.conf.default-zones";
       ...
       ...

The zone for db.ppod.ir.iran is:

; A, AAAA => host record
ppod.ir.     1      IN      A       185.8.172.233

and for the default view is:

; A, AAAA => host record
ppod.ir.     1      IN      A       5.63.13.22
ppod.ir.     1      IN      A       95.216.12.6

Now if I query the domain ppod.ir from Iran, the DNS server gives me wrong IPs.

$ dig ppod.ir # the answer is wrong

; <<>> DiG 9.11.3-1ubuntu1.12-Ubuntu <<>> ppod.ir
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15519
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;ppod.ir.           IN  A

;; ANSWER SECTION:
ppod.ir.        1   IN  A   5.63.13.22
ppod.ir.        1   IN  A   95.216.12.6

;; Query time: 263 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Tue Jul 14 12:59:53 +0430 2020
;; MSG SIZE  rcvd: 68

but either ways if I ask the DNS server directly or trace the query it gives the right IP.

$ dig ppod.ir @171.22.25.82 +short # the answer is right
185.8.172.233

and tracing it:

$ dig ppod.ir @1.1.1.1 +trace  +short # the answer is right
NS a.root-servers.net. from server 1.1.1.1 in 257 ms.
NS b.root-servers.net. from server 1.1.1.1 in 257 ms.
NS c.root-servers.net. from server 1.1.1.1 in 257 ms.
NS d.root-servers.net. from server 1.1.1.1 in 257 ms.
NS e.root-servers.net. from server 1.1.1.1 in 257 ms.
NS f.root-servers.net. from server 1.1.1.1 in 257 ms.
NS g.root-servers.net. from server 1.1.1.1 in 257 ms.
NS h.root-servers.net. from server 1.1.1.1 in 257 ms.
NS i.root-servers.net. from server 1.1.1.1 in 257 ms.
NS j.root-servers.net. from server 1.1.1.1 in 257 ms.
NS k.root-servers.net. from server 1.1.1.1 in 257 ms.
NS l.root-servers.net. from server 1.1.1.1 in 257 ms.
NS m.root-servers.net. from server 1.1.1.1 in 257 ms.
RRSIG NS 8 0 ..... from server 1.1.1.1 in 257 ms.
couldn't get address for 'ns2.redcursor.ir': not found
A 185.8.172.233 from server 171.22.25.82 in 40 ms.

The cache for TTL has been set to 1, also bind has been complied with GeoIP feature, and question is why does not DNS server response correctly? I know about caching IP address and recursive queries of public-dns-servers, but based on what I configured the IPs should be cached

here is the log for these two queries dig ppod.ir and dig ppod.ir @171.22.25.82 from the same location and IP address. the first one is wrong, the second one is right.

14-Jul-2020 08:38:21.312 info: client @0x7fbb20000a30 162.158.82.125#56703 (ppod.ir): view default: query: ppod.ir IN A -E(0)D (171.22.25.82)
14-Jul-2020 08:38:21.312 debug 3: client @0x7fbb20000a30 162.158.82.125#56703 (ppod.ir): view default: query 'ppod.ir/A/IN' approved
14-Jul-2020 08:38:21.312 debug 3: client @0x7fbb20000a30 162.158.82.125#56703 (ppod.ir): view default: reset client
14-Jul-2020 08:38:43.308 debug 3: client @0x7fbb20000a30 5.117.5.210#55509: UDP request
14-Jul-2020 08:38:43.308 debug 5: client @0x7fbb20000a30 5.117.5.210#55509: view Iran: using view 'Iran'
14-Jul-2020 08:38:43.308 debug 3: client @0x7fbb20000a30 5.117.5.210#55509: view Iran: request is not signed
14-Jul-2020 08:38:43.308 debug 3: client @0x7fbb20000a30 5.117.5.210#55509: view Iran: recursion not available
14-Jul-2020 08:38:43.308 info: client @0x7fbb20000a30 5.117.5.210#55509 (ppod.ir): view Iran: query: ppod.ir IN A +E(0)K (171.22.25.82)
14-Jul-2020 08:38:43.308 debug 3: client @0x7fbb20000a30 5.117.5.210#55509 (ppod.ir): view Iran: query 'ppod.ir/A/IN' approved
14-Jul-2020 08:38:43.308 debug 3: client @0x7fbb20000a30 5.117.5.210#55509 (ppod.ir): view Iran: reset client
Shakiba Moshiri
  • 191
  • 6
  • 1
    You seem to be using a local stub resolver (e.g. systemd-resolved). Is it configured to query DNS servers which are in Iran? If it sends DNS queries to servers in another country, that might cause the problem you are seeing. – Michael Hampton Jul 14 '20 at 13:28
  • @MichaelHampton yes I am using `systemd-resovle` and CF DNS servers `1.1.1.1` and `1.0.0.1`. also I suspected them and changed them but still the response was wrong. I noticed that [CloudFlare DNS server does not send](https://community.cloudflare.com/t/1-1-1-1-prevents-geoip-based-dns-lookups-from-working/173272) the actual user IP address. Maybe it is the issue that public DNS servers do not send actual IP address – Shakiba Moshiri Jul 14 '20 at 14:54

1 Answers1

0

Thanks to @MichaelHampton that pointed out this fact that my local resolver has been configured to use a DNS server our side of the network that I had set up bind9 DNS server.
So after not configuration my local resolver using systemd-resolver and enabling DHCP of my modem, now a query from dig gives the right answer.

dig ppod.ir

; <<>> DiG 9.11.3-1ubuntu1.12-Ubuntu <<>> ppod.ir
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21503
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;ppod.ir.           IN  A

;; ANSWER SECTION:
ppod.ir.        1   IN  A   185.8.172.233

;; Query time: 153 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Sun Jul 19 12:14:46 +0430 2020
;; MSG SIZE  rcvd: 52
Shakiba Moshiri
  • 191
  • 6