DNS works fine on the private network but not on the public network

[wjleon]

Hi there,

I am trying to configure bind9 on a debian Sarge (Testing) box. I made all the .conf files and the servers starts ok (as the log -/var/log/daemon.log- says). The box handling Bind9 has a Publia IP address and a private address.

I turn down all the firewall rules and I can reach the server from outside the network, I can ping it, traceroute it, telnet it (to port 53) and ssh it BUT when I try aquery like this:

dig someBox @public_ip

All I get is:

;; global options: printcmd
;; connection timed out; no servers could be reached

and when I try the same query from inside the network (using the private IP address of the DNS server) it WORKS FINE!

dig someBox (the box same as above) @private_IP_ADDRESS_of_the_same_DNS_SERVER
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode&#58; QUERY, status&#58; NOERROR, id&#58; 32024
;; flags&#58; qr aa rd ra; QUERY&#58; 1, ANSWER&#58; 1, AUTHORITY&#58; 1, ADDITIONAL&#58; 1

So, any clue?

My named.conf file is:

options {
directory "/var/cache/bind";
listen-on {
127.0.0.1;
192.168.0.47;
1.2.3.4;
};

forward first;
forwarders {
150.188.4.200;
};
auth-nxdomain no; # conform to RFC1035

};
logging {
channel query_logging {
file "/var/log/named_querylog"
versions 3 size 100M;
print-time yes; // timestamp log entries
};
category queries {
query_logging;
};
category lame-servers { null; };
};

zone "." {
type hint;
file "/etc/bind/db.root";
};

zone "localhost" {
type master;
file "/etc/bind/db.local";
};

zone "127.in-addr.arpa" {
type master;
file "/etc/bind/db.127";
};


zone "3.2.1.in-addr.arpa" {
type master;
file "/etc/bind/1.2.3";
};

zone "1234-zone" {
        type master;
        file "/etc/bind/1234-zone-file";
        allow-transfer {
                        150.188.4.0/24;
                };
        };

and 1234-zone-file says:

$TTL 3D
@ IN SOA dns.havingproblems.org. someone.dns.havingproblems.org. (
200506031
8H
2H
4W
1D )
;
NS dns.havingproblems.org.
;
localhost A 127.0.0.1
dns.havingproblems.org. A 1.2.3.4
www.havingproblems.org. A 5.6.7.8

[/code]