A preliminary comment -- please be more careful about use of upper and lower case in your reporting. I'm inclined to believe that your interface variables really are eth0 and eth1, not (as you report them) Eth0 and Eth1, and I doubt your LAN-side SuSE server is named both pingu-serv and Pingu-serv. And the app is named tcpdump, not Tcpdump. I spotted all of these mistakes easily, but the number of them leaves me a bit concerned that there is some other error (either in your reporting or in your actual setup) caused by misuse of case.

Now, the tcpdump traffic you report is --

17:07:30.870333 pingu-serv.farside.net.vfo > 193.37.83.1.domain: 58405+
PTR? 81.83.37.193.in-addr.arpa. (43) (DF)
17:07:30.870892 193.37.83.1 > pingu-serv.farside.net: icmp: 193.37.83.1 udp
port domain unreachable [tos 0xc0]

The second line replies to a packet *from* pingu-serv to the DNS port on the router *itself* (193.37.83.1.domain), one that attempts a reverse lookup on your NT host. (No indication of why the SuSE host is doing this recverse lookup, but such requests are commonplace.) So far so good. But the router's reply is that the DNS port cannot be reached on the router. Bad.

So ... why not? Two candidate reasons --

1. The firewall blocks access to that port. Improbable if the rest of your reporting is correct (but given my opening comment, worth considering). Check your firewall log for any report of REJECTed traffic to port 53 (domain).

2, Nothing is listening on port 53 on the router. The more likely answer, a consequence of some error in your (undescribed by you, beyond the uninformative "Made what I considered to be appropriate settings") configuration of dnscache (or conceivably one of the other 2 packages). Report what you did and someone may be able to help. In addition to rounding up the usual suspects (consult the SR FAQ) and describing your setup of dnscache and tinydns, see what, if anything, "netstat -ln" says is actually listening on port 53.

At 06:01 PM 11/12/02 +0000, Wrigglesworth, Colin wrote:
Help needed setting up DNS on Dachstein-CD V1.02.

Have installed the packages djbutils, dnscache and tinydns. Made what I
considered to be appropriate settings using the lrcfg menus, saved and
rebooted.
Host names for machines on the private side have been entered in
NETWORK.CONF and DNS set to YES.

The LRP box is configured thus:

Eth0=89.10.1.1
Eth1=193.37.83.1

The Eth0 side is connected to the main company network which has a
proliferation of windoze boxen one of which is a DNS server on 89.2.7.6
On the Eth1 side I have a SuSe8.0 box (Pingu-serv) 193.37.83.2 and a couple
of WinNT3.51 boxes one of which is 193.37.83.81

Running Tcpdump on pingu-serv I get the following

17:07:30.870333 pingu-serv.farside.net.vfo > 193.37.83.1.domain:  58405+
PTR? 81.83.37.193.in-addr.arpa. (43) (DF)
17:07:30.870892 193.37.83.1 > pingu-serv.farside.net: icmp: 193.37.83.1 udp
port domain unreachable [tos 0xc0]

Pingu-serv is set to get DNS info for both the private network (farside.net)
and the company network from 193.37.83.1, the private side of the LRP box.

All ipchains rules have been flushed and the default policies set to ACCEPT
so I shouldn't be blocking any requests.

What is this tcpdump output telling me?

I'm a relative newbie so pointing me at some relevant, but easily
comprehensible reading matter might assist. To me it just looks like the
port which serves the dns requests isn't open.



--
-------------------------------------------"Never tell me the odds!"--------
Ray Olszewski -- Han Solo
Palo Alto, California, USA [EMAIL PROTECTED]
-------------------------------------------------------------------------------



-------------------------------------------------------
This sf.net email is sponsored by: To learn the basics of securing your web site with SSL, click here to get a FREE TRIAL of a Thawte Server Certificate: http://www.gothawte.com/rd522.html
------------------------------------------------------------------------
leaf-user mailing list: [EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/leaf-user
SR FAQ: http://leaf-project.org/pub/doc/docmanager/docid_1891.html

Reply via email to