IspConfig and Godaddy

Discussion in 'General' started by extr3mal, Apr 2, 2024.

  1. extr3mal

    extr3mal Member

    if i do host from server here is tcp dump

    Code:
    tcpdump: listening on enp2s0, link-type EN10MB (Ethernet), capture size 1500 bytes
    12:58:47.184513 IP (tos 0x0, ttl 64, id 57655, offset 0, flags [none], proto UDP (17), length 59)
        192.168.100.100.46675 > 178.18.44.142.53: 388+ A? aloraprim.com. (31)
    12:58:47.184935 IP (tos 0x0, ttl 63, id 57655, offset 0, flags [none], proto UDP (17), length 59)
        178.18.44.142.46675 > 192.168.100.100.53: 388+ A? aloraprim.com. (31)
    12:58:47.185112 IP (tos 0x0, ttl 64, id 57656, offset 0, flags [none], proto UDP (17), length 143)
        192.168.100.100.53 > 178.18.44.142.46675: 388*- 1/2/2 aloraprim.com. A 178.18.44.142 (115)
    12:58:47.185292 IP (tos 0x0, ttl 63, id 57656, offset 0, flags [none], proto UDP (17), length 143)
        178.18.44.142.53 > 192.168.100.100.46675: 388*- 1/2/2 aloraprim.com. A 178.18.44.142 (115)
    12:58:47.185509 IP (tos 0x0, ttl 64, id 57657, offset 0, flags [none], proto UDP (17), length 59)
        192.168.100.100.44061 > 178.18.44.142.53: 55791+ AAAA? aloraprim.com. (31)
    12:58:47.185703 IP (tos 0x0, ttl 63, id 57657, offset 0, flags [none], proto UDP (17), length 59)
        178.18.44.142.44061 > 192.168.100.100.53: 55791+ AAAA? aloraprim.com. (31)
    12:58:47.185827 IP (tos 0x0, ttl 64, id 57658, offset 0, flags [none], proto UDP (17), length 119)
        192.168.100.100.53 > 178.18.44.142.44061: 55791*- 0/1/0 (91)
    12:58:47.186064 IP (tos 0x0, ttl 63, id 57658, offset 0, flags [none], proto UDP (17), length 119)
        178.18.44.142.53 > 192.168.100.100.44061: 55791*- 0/1/0 (91)
    12:58:47.186345 IP (tos 0x0, ttl 64, id 57659, offset 0, flags [none], proto UDP (17), length 59)
        192.168.100.100.49666 > 178.18.44.142.53: 62722+ MX? aloraprim.com. (31)
    12:58:47.186534 IP (tos 0x0, ttl 63, id 57659, offset 0, flags [none], proto UDP (17), length 59)
        178.18.44.142.49666 > 192.168.100.100.53: 62722+ MX? aloraprim.com. (31)
    12:58:47.186625 IP (tos 0x0, ttl 64, id 57660, offset 0, flags [none], proto UDP (17), length 257)
        192.168.100.100.53 > 178.18.44.142.49666: 62722*- 5/2/2 aloraprim.com. MX aspmx.l.google.com. 10, aloraprim.com. MX aspmx2.googlemail.com. 40, aloraprim.com. MX aspmx3.googlemail.com. 50, aloraprim.com. MX alt1.aspmx.l.google.com. 20, aloraprim.com. MX alt2.aspmx.l.google.com. 30 (229)
    12:58:47.186781 IP (tos 0x0, ttl 63, id 57660, offset 0, flags [none], proto UDP (17), length 257)
        178.18.44.142.53 > 192.168.100.100.49666: 62722*- 5/2/2 aloraprim.com. MX aspmx.l.google.com. 10, aloraprim.com. MX aspmx2.googlemail.com. 40, aloraprim.com. MX aspmx3.googlemail.com. 50, aloraprim.com. MX alt1.aspmx.l.google.com. 20, aloraprim.com. MX alt2.aspmx.l.google.com. 30 (229)
    And if i do same host command from outer world on machine that calls host i see
    Code:
    host -v aloraprim.com 178.18.44.142
    Trying "aloraprim.com"
    ;; connection timed out; no servers could be reached
    In server tcp dump i see

    Code:
    tcpdump -n -s 1500 udp and port 53 -v
    tcpdump: listening on enp2s0, link-type EN10MB (Ethernet), capture size 1500 bytes
    13:00:07.980208 IP (tos 0x0, ttl 64, id 24261, offset 0, flags [DF], proto UDP (17), length 85)
        192.168.100.100.46999 > 8.8.4.4.53: 49033+ [1au] SRV? _http._tcp.ppa.launchpad.net. (57)
    13:00:07.980334 IP (tos 0x0, ttl 64, id 26228, offset 0, flags [DF], proto UDP (17), length 89)
        192.168.100.100.37797 > 8.8.4.4.53: 19748+ [1au] SRV? _http._tcp.md.archive.ubuntu.com. (61)
    13:00:08.024825 IP (tos 0x0, ttl 123, id 3461, offset 0, flags [none], proto UDP (17), length 149)
        8.8.4.4.53 > 192.168.100.100.46999: 49033 NXDomain 0/1/1 (121)
    13:00:08.024892 IP (tos 0x0, ttl 64, id 24262, offset 0, flags [DF], proto UDP (17), length 74)
        192.168.100.100.46999 > 8.8.4.4.53: 49033+ SRV? _http._tcp.ppa.launchpad.net. (46)
    13:00:08.038700 IP (tos 0x0, ttl 60, id 26504, offset 0, flags [none], proto UDP (17), length 150)
        8.8.4.4.53 > 192.168.100.100.37797: 19748 NXDomain 0/1/1 (122)
    13:00:08.038762 IP (tos 0x0, ttl 64, id 26229, offset 0, flags [DF], proto UDP (17), length 78)
        192.168.100.100.37797 > 8.8.4.4.53: 19748+ SRV? _http._tcp.md.archive.ubuntu.com. (50)
    13:00:08.068976 IP (tos 0x0, ttl 123, id 29505, offset 0, flags [none], proto UDP (17), length 138)
        8.8.4.4.53 > 192.168.100.100.46999: 49033 NXDomain 0/1/0 (110)
    13:00:08.069628 IP (tos 0x0, ttl 64, id 60329, offset 0, flags [DF], proto UDP (17), length 74)
        192.168.100.100.55400 > 8.8.4.4.53: 10823+ [1au] A? ppa.launchpad.net. (46)
    13:00:08.069766 IP (tos 0x0, ttl 64, id 40632, offset 0, flags [DF], proto UDP (17), length 74)
        192.168.100.100.38526 > 8.8.4.4.53: 54354+ [1au] AAAA? ppa.launchpad.net. (46)
    13:00:08.080570 IP (tos 0x0, ttl 60, id 48703, offset 0, flags [none], proto UDP (17), length 139)
        8.8.4.4.53 > 192.168.100.100.37797: 19748 NXDomain 0/1/0 (111)
    13:00:08.081184 IP (tos 0x0, ttl 64, id 12631, offset 0, flags [DF], proto UDP (17), length 78)
        192.168.100.100.53720 > 8.8.4.4.53: 38850+ [1au] A? md.archive.ubuntu.com. (50)
    13:00:08.081325 IP (tos 0x0, ttl 64, id 47684, offset 0, flags [DF], proto UDP (17), length 78)
        192.168.100.100.58483 > 8.8.4.4.53: 46516+ [1au] AAAA? md.archive.ubuntu.com. (50)
    13:00:08.108023 IP (tos 0x0, ttl 60, id 29059, offset 0, flags [none], proto UDP (17), length 90)
        8.8.4.4.53 > 192.168.100.100.55400: 10823 1/0/1 ppa.launchpad.net. A 185.125.190.80 (62)
    13:00:08.108356 IP (tos 0x0, ttl 123, id 17064, offset 0, flags [none], proto UDP (17), length 102)
        8.8.4.4.53 > 192.168.100.100.38526: 54354 1/0/1 ppa.launchpad.net. AAAA 2620:2d:4000:1::81 (74)
    13:00:08.117567 IP (tos 0x0, ttl 123, id 26747, offset 0, flags [none], proto UDP (17), length 138)
        8.8.4.4.53 > 192.168.100.100.58483: 46516 2/0/1 md.archive.ubuntu.com. CNAME mirror.as43289.net., mirror.as43289.net. AAAA 2a00:1dc0::f00d (110)
    13:00:08.136066 IP (tos 0x0, ttl 60, id 62865, offset 0, flags [none], proto UDP (17), length 126)
        8.8.4.4.53 > 192.168.100.100.53720: 38850 2/0/1 md.archive.ubuntu.com. CNAME mirror.as43289.net., mirror.as43289.net. A 178.17.160.48 (98)
     
  2. Taleman

    Taleman Well-Known Member HowtoForge Supporter

    So did you see traffic from your query on port 53 on your server?
     
  3. extr3mal

    extr3mal Member

    as you can see some traffic goes there however i dont see any name resolution at the end of the day
     
  4. Taleman

    Taleman Well-Known Member HowtoForge Supporter

    Since your name server is behind NAT, have you forwarded port 53 both TCP and UDP to your host?
     
  5. extr3mal

    extr3mal Member

    Yes they forwarded same as it was with http port and admin panel ports , basically i have mappings on router for all ports that hosting uses
     
  6. ahrasis

    ahrasis Well-Known Member HowtoForge Supporter

    Other ports forwarding are normally just TCP but he was asking you whether you forwarded port 53 UDP as well.
     
  7. extr3mal

    extr3mal Member

    Both 53 UDP and 53 TCP on same port map are present
     

Share This Page