Internal DNS. BIND not reachable from the internal network

1. 1. 1. BIND service status #

   copy sudo systemctl status bind9 2>/dev/null || sudo systemctl status named

   Expect: active (running)

   If not: Inactive: systemctl start bind9. Won't start: named-checkconf shows syntax errors, or journalctl -u bind9 -n 50 for permission/zone-load problems.
2. 2. 2. Config + zone syntax validation #

   copy named-checkconf && for z in /etc/bind/db.*; do echo "== $z =="; named-checkzone $(basename $z) $z; done

   Expect: No named-checkconf output + OK for each zone

   If not: Any error message names the file/line. Common: missing trailing dot on FQDN, wrong $ORIGIN, un-bumped SOA serial after an edit.
3. 3. 3. Listening on both UDP AND TCP 53? #

   copy ss -ulnp | grep :53 ; echo '---'; ss -tlnp | grep :53

   Expect: UDP and TCP on the internal IP (not just 127.0.0.1)

   If not: Missing one: set listen-on { any; }; in named.conf.options and listen-on-v6 { any; };, reload.
4. 4. 4. Test forward zone from localhost #

   copy dig @127.0.0.1 team<N>.ncaecybergames.org A +short

   Expect: The A record's IP

   If not: Empty / SERVFAIL = zone not loaded, or the name isn't in the zone. See DNS EXT FWD playbook for adding the record.
5. 5. 5. Test reverse zone from localhost (separate structure, often forgotten) #

   copy dig @127.0.0.1 -x <one-of-your-internal-IPs> +short

   Expect: A PTR record with trailing dot

   If not: Empty = reverse zone not configured. See DNS EXT REV playbook step 4 for a minimal in-addr.arpa zone.
6. 6. 6. Test from a DIFFERENT internal host (mirror the scorer) #

   copy # from any other internal machine: dig @<dns-vm-ip> team<N>.ncaecybergames.org +short

   Expect: The A record's IP

   If not: Fails from elsewhere but works on the DNS VM = listen-on too narrow OR host firewall dropping inbound 53. Check ufw/iptables.
7. 7. 7. Host firewall not blocking 53 inbound? #

   copy sudo iptables -L INPUT -nv | grep -E ':53|dpt:53'; sudo ufw status 2>/dev/null

   Expect: No DROP/REJECT on tcp/udp 53

   If not: Drop rule: iptables -D INPUT <num> or ufw allow 53. Make sure BOTH udp and tcp are allowed.
8. 8. 8. AppArmor denials (silent cause of zone-not-loading) #

   copy grep -i 'apparmor' /var/log/syslog | grep -i named | tail; sudo aa-status 2>/dev/null | grep named

   Expect: No denials; or named in complain mode

   If not: DENIED lines for /etc/bind/db.<something> = AppArmor blocking. Either move zone files into /etc/bind/ or edit /etc/apparmor.d/local/usr.sbin.named to grant read.
9. 9. 9. recursion no recommended for authoritative servers #

   copy grep -E 'recursion|allow-recursion' /etc/bind/named.conf.options

   Expect: recursion no; and allow-recursion { none; };

   If not: Open resolvers get DDoS-amplified. You only need to answer queries for YOUR zones; recursion=no and allow-recursion={none} locks it down.

Decision tree

Context