Hey Dean,
Well, I do run a DNS, and the reverse lookup on my machines that I manage works
properly.
HOWEVER, I do believe this is a firewall issue and I'm not quite sure how to
start resolving it. I took down the firewall and set the default policy to
ACCEPT for all iptable's chains. Then I tried to ftp, and it was INSTANT. If
I put it back up, it takes around 45-60 seconds.
Do you have any idea what ports I should start messing with? I currently have
rules to allow port 53 (dns as far as I know) connections.
I'm not sure if this is helpful at all, but here are are the relevent iptable
commands:
EXTERNAL_INTERFACE is the inteface which leads to the internet
ANYWHERE is any/0
IPADDR is the ipaddress of my server
UNPRIVPORTS is 1024:65535
# DNS Queries Between Servers
# ---------------------------
$IPTABLES -A INPUT -i $EXTERNAL_INTERFACE -p udp \
-s $ANYWHERE --sport $UNPRIVPORTS \
-d $IPADDR --dport 53 -j ACCEPT
$IPTABLES -A OUTPUT -o $EXTERNAL_INTERFACE -p udp \
-s $IPADDR --sport 53 \
-d $ANYWHERE --dport $UNPRIVPORTS -j ACCEPT
# DNS Queries Between Servers with Long Replies
# ---------------------------------------------
$IPTABLES -A INPUT -i $EXTERNAL_INTERFACE -p tcp \
-s $ANYWHERE --sport $UNPRIVPORTS \
-d $IPADDR --dport 53 -j ACCEPT
$IPTABLES -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp \
-s $IPADDR --sport 53 \
-d $ANYWHERE --dport $UNPRIVPORTS -j ACCEPT
# DNS Client Queries
# ------------------
$IPTABLES -A INPUT -i $EXTERNAL_INTERFACE -p udp \
-s $ANYWHERE --sport $UNPRIVPORTS \
-d $IPADDR --dport 53 -j ACCEPT
$IPTABLES -A OUTPUT -o $EXTERNAL_INTERFACE -p udp \
-s $IPADDR --sport 53 \
-d $ANYWHERE --dport $UNPRIVPORTS -j ACCEPT
# DNS Client Queries with long Replies
# ------------------------------------
$IPTABLES -A INPUT -i $EXTERNAL_INTERFACE -p tcp \
-s $ANYWHERE --sport $UNPRIVPORTS \
-d $IPADDR --dport 53 -j ACCEPT
$IPTABLES -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp \
-s $IPADDR --sport 53 \
-d $ANYWHERE --dport $UNPRIVPORTS -j ACCEPT
# DNS client (53)
# ---------------
$IPTABLES -A OUTPUT -o $EXTERNAL_INTERFACE -p udp \
-s $IPADDR --sport $UNPRIVPORTS \
-d $ANYWHERE --dport 53 -j ACCEPT
$IPTABLES -A INPUT -i $EXTERNAL_INTERFACE -p udp \
-s $ANYWHERE --sport 53 \
-d $IPADDR --dport $UNPRIVPORTS -j ACCEPT
$IPTABLES -A OUTPUT -o $EXTERNAL_INTERFACE -p tcp \
-s $IPADDR --sport $UNPRIVPORTS \
-d $ANYWHERE --dport 53 -j ACCEPT
$IPTABLES -A INPUT -i $EXTERNAL_INTERFACE -p tcp ! --syn \
-s $ANYWHERE --sport 53 \
-d $IPADDR --dport $UNPRIVPORTS -j ACCEPT
Thanks alot for your time. I'm kind of dead in the water on this issue.
-dave
>Hi!,
>> I've been fighting with my machine for about a year now =) If I telnet to
>> it, it gets right in. If I ftp to the machine, it sits for a little while
>> before letting me in (reverse-dnsing, then sometimes timing out).
>> The box serves as a firewall, and a DNS. Why would telnet work, but ftp
>> fail (the reverse-lookup part)?
>The first question would be whether or not a reverse-DNS entry exists for your
>machine. By the sounds of it, it doesn't. I would also suspect that you have
>an entry in your /etc/hosts file which telnet uses and hence this is why you
>can log into your system, but FTP doesn't use the /etc/hosts file to perform
>its reverse lookup. It instead goes to the DNS server and tries to find out
>the information from there.
>There are three options open to you:
> * Install a small DNS internally, which will resolve the reverse lookup
> * Recompile the FTP daemon with NODNS support. It can be done by changing
> a line in the code
> * For xinetd users, it has been reported that sometimes you can get around
> the problem by removing the HOSTID and/or USERID entries out of the
> logging process. Personally, I don't think this will chance too much,
> because it is the FTP daemon which does the work, but you can always
> give it a shot and see what happens
> * Get another FTP server which doesn't perform reverse DNS or allows it to
> check the /etc/hosts file first
>See ya
>Dean Thompson
>--
>+____________________________+____________________________________________+
>| Bach. Computing (Hons) | ICQ - 45191180 |
>| PhD Student | Office - <Off-Campus> |
>| School Comp.Sci & Soft.Eng | Phone - +61 3 9903 2787 (Gen. Office) |
>| MONASH (Caulfield Campus) | Fax - +61 3 9903 1077 |
>| Melbourne, Australia | |
>+----------------------------+--------------------------------------------+
--
+-----------------------------+--------------------------------------------
--+
| Dave Marotti | Looking for a Visio alternative for *nix? |
| lndshark ! speakeasy net | Kivio : http://thekompany.com/projects/kivio |
+-----------------------------+----------------------------------------------+
| I just don't trust anything | I suppose that in a few more hours I will |
| that bleeds for 5 days and | sober up. That's such a sad thought. I think |
| doesn't die. - Mr. Garrison | I'll have a few more drinks to prepare myself|
+-----------------------------+----------------------------------------------+
by