Bind 9.6.1-P1 ignoring listen-on directive

[John Center]

Of course, right after hitting enter on this message, I came across a 
message from last year about localhost mapping to all interfaces, not 
just 127.0.0.1.  I created a "loopback" acl & used it instead that 
worked.  Sorry for the noise.

	-John


On 09/09/2009 03:04 PM, John Center wrote:
> Hi,
>
> I'm testing Bind 9.6.1-P1 on Solaris 10 SPARC (64bit/Sun Studio 12.1)&
> I noticed this in the logs:
>
> Sep  9 13:15:31 ns3a/ns3a named[23042]: [ID 873579 daemon.info]
> listening on IPv4 interface lo0, 127.0.0.1#53
> Sep  9 13:15:31 ns3a/ns3a named[23042]: [ID 873579 daemon.info]
> listening on IPv4 interface bge0, 153.104.92.2#53
> Sep  9 13:15:31 ns3a/ns3a named[23042]: [ID 873579 daemon.info]
> listening on IPv4 interface bge0:1, 153.104.92.4#53
> Sep  9 13:15:31 ns3a/ns3a named[23042]: [ID 873579 daemon.info]
> listening on IPv4 interface bge1, 10.104.36.20#53
>
> I only wanted named to listen on one interface + the loopback, so I
> added a listen-on statement in named.conf:
>
> acl testnets { 153.104.244.0/24; 153.104.248.0/24; };
> options {
>           directory "/opt/isc/bind/var/db";
>           allow-query { testnets; };
>           listen-on { localhost; 153.104.92.2; };
>           listen-on-v6 { none; };
> };
> zone "0.0.127.in-addr.arpa" in {
>           type master;
>           file "db.127.0.0";
>           notify no;
> };
>
> But, I still have the same log entries when I start named.  I then
> modified named.conf to specifically exclude the other interfaces:
>
> listen-on { localhost; 153.104.92.2; !153.104.92.4; !10.104.36.20; };
>
> But, again, I'm still seeing it state that it is listening on the
> excluded interfaces.  I tried increasing the debug level, but I didn't
> see any additional info pertaining to this.  I know that it is listening
> on the excluded interfaces because I see a queries on the 10.104.36.20
> interface:
>
> Sep  9 13:09:16 ns3a/ns3a named[22867]: [ID 873579 daemon.info] client
> 10.104.109.0#1041: query (cache) 'ATF/A/IN' denied
> Sep  9 13:09:16 ns3a/ns3a named[22867]: [ID 873579 daemon.info] client
> 10.104.109.0#1046: query (cache) 'ATP.villanova.edu/A/IN' denied
>
> Is this a known problem?  It's an issue for us because we restrict DNS
> queries to particular interfaces.  If it isn't a known bug, I'd be glad
> to help troubleshoot this problem.
>
> Thanks.
>
> 	-John
>