I created 2 DNS records at an external hosting company:
test1.domain.com 8.8.8.8
test2.domain.com 10.243.20.1
When I dig test1.domain.com it resolves.
When I dig test2.domain.com it times out.
/etc/resolv.conf contains "nameserver 127.0.0.1"
So, I do "tcpdump -n -i lo icmp or \(port 53 and host 127.0.0.1\)" and do the digs again, result:
listening on lo, link-type EN10MB (Ethernet), snapshot length 262144 bytes
22:43:08.718430 IP 127.0.0.1.44761 > 127.0.0.1.53: 37990+ [1au] A? test1.domain.com. (56)
22:43:08.719013 IP 127.0.0.1.53 > 127.0.0.1.44761: 37990$ 1/0/1 A 8.8.8.8 (60)
22:43:12.132320 IP 127.0.0.1.50064 > 127.0.0.1.53: 54736+ [1au] A? test2.domain.com. (56)
22:43:17.137606 IP 127.0.0.1.48339 > 127.0.0.1.53: 54736+ [1au] A? test2.domain.com. (56)
22:43:22.134766 IP 127.0.0.1.53 > 127.0.0.1.50064: 54736$ 0/0/1 (50)
22:43:22.134787 IP 127.0.0.1 > 127.0.0.1: ICMP 127.0.0.1 udp port 50064 unreachable, length 86
22:43:22.134870 IP 127.0.0.1.53 > 127.0.0.1.48339: 54736$ 0/0/1 (50)
So, I strace bind. I see the request being answered when I dig test1.domain.com. When I dig test2.domain.com, bind doesn't receive the request. strace stays at: epoll_pwait(5
When I strace dig, resolving test2.domain.com, I just see it timing out after it has sent the request.
I restart bind, no effect.
So I change resolv.conf: nameserver 8.8.8.8, no effect. The tcpdump output is also the same (except the udp port unreachable line).
I create some more test records at the external hosting company: 192.168.1.1, 1.1.1.1, 127.0.0.1.
1.1.1.1 works, the other 2 don't.
My iptables config is quite basic. Also, creating this effect using iptables might not even be possible.
nslookup in stead of dig, makes no difference.
This worked a few months ago and I didn't upgrade the kernel since then. So, it's not the kernel.
It seems the network doesn't really send the request if the resolution is for a non-public ipnumber. However, It cannot know this until after the resolution.
I'm at a loss here. Does anyone have an idea?