Mysterious root DNS zone queries (. IN NS) generated by UTM 9 ?

CarlMankinen said:

I configured my UTM 9 to forward all queries to a local BIND9 server and am logging queries, ....

The UTM9 DNS service is configured to forward queries only. All of my local devices are using the internal DNS server, so there shouldn't be any queries sent to the UTM9...

If you look at bind configuration /var/chroot-bind/etc/named.conf on UTM, you will notice the line

forward first;

With the default configuration, the UTM WILL SEND QUERIES to root servers after querying the forwarder first. This behavior was changed in v8 sometime and I even tried to tell the developers of the unintended consequences https://community.sophos.com/products/unified-threat-management/astaroorg/f/112/p/71270/276107#276107 

This is why UTM is sending queries to root servers even though you are using forwarders, plus UTM will do certain lookups when downloading pattern updates or url categorization so the query doesn't have to come from a client every time.

P.S changing the forward first line to forward only is a losing battle. UTM will change it back with pattern updates etc. I stopped trying to be a responsible admin and gave up on trying to stop UTM from contacting root servers.

CarlMankinen said:

I configured my UTM 9 to forward all queries to a local BIND9 server and am logging queries, ....

The UTM9 DNS service is configured to forward queries only. All of my local devices are using the internal DNS server, so there shouldn't be any queries sent to the UTM9...

If you look at bind configuration /var/chroot-bind/etc/named.conf on UTM, you will notice the line

forward first;

With the default configuration, the UTM WILL SEND QUERIES to root servers after querying the forwarder first. This behavior was changed in v8 sometime and I even tried to tell the developers of the unintended consequences https://community.sophos.com/products/unified-threat-management/astaroorg/f/112/p/71270/276107#276107 

This is why UTM is sending queries to root servers even though you are using forwarders, plus UTM will do certain lookups when downloading pattern updates or url categorization so the query doesn't have to come from a client every time.

P.S changing the forward first line to forward only is a losing battle. UTM will change it back with pattern updates etc. I stopped trying to be a responsible admin and gave up on trying to stop UTM from contacting root servers.

Interesting, I am looking at the named.conf and sure enough it has forward-first and recursion yes.

I thought maybe I could trick it by added a "." zone and setting it to forward. Bind barfed on the configuration and DNS stopped working until I removed the "." conditional forwarding zone.

zone "." IN {

type forward;

forward only;

forwarders {

10.1.1.10;

};

check-names ignore;

};

I was somewhat surprised the UTM allowed me to create the "." zone which conflicted with the root hint zone definition.

I added these lines to /etc/init.d/beeps:

sed -i -- 's/recursion yes/recursion no/g' /var/sec/chroot-bind/etc/named.conf
sed -i -- 's/forward first/forward only/g' /var/sec/chroot-bind/etc/named.conf

Yes, thats why I fell in love with astaro/UTM in the first place, proprietary webadmin interface with open linux system underneath that they intentionally left open for you to tinker with [:O][:D] The beeps init is called when utm is started/restarted to make the beeping sound after all the other daemons have already been started. i usually add everything I want to call at startup in that script instead of other init scripts to keep all my changes in one place. Plus they usually don't update that script regularly so your changes will generally be safe.

 By adding the above lines to /etc/init.d/beeps, the configuration would be regenerated after a reboot (atleast it used to when I was changing things manually). However if you manually restart the daemon by flushing the dns cache etc, the conf file maybe regenerated. Restarting/ reloading bind will probably revert your configuration changes and to fix that you will have to do some editing of the startup script itself

edit /var/mdw/scripts/named

Since you seem to be comfortable with command line tinkering, I will let you experiment with the scripts yourself. Keep in mind though that if you have any support contract, it maybe void by making any changes. And any such changes may not survive a firmware update.

Good luck[:D]

P.S. You can also tinker with /var/sec/chroot-bind/etc/named.conf-default but as you probably noticed by the standard disclaimer on top #  AUTOMATICALLY GENERATED, USELESS EDITING, the bind conf files are not static and the configuration is generated automatically by the conf daemon [:'(]

Yeah, I searched for something that others were using to place these sort of hacks to have them persist as long as possible.

Seems the beeps script was a good/common choice.

Thanks for the response! And yeah, this isn't my first rodeo... I also love the UTM9! I tried the XG, but really had a hard time getting the functionality I have presently with the UTM9 version. I tried Astaro a very long time ago and decided to stay with my PIX/ASA firewalls, but the Astaro/Sophos UTM has improved massively! Pixies are gathering dust...

They really need to fix this DNS behavior though. Because I have internal DNS servers that are performing various levels of security on DNS queries, anything that UTM9 sees with a NXDOMAIN, it switches to recursion and when GUI appears to show a "forward only" configuration. WTF!