[f-nsp] ServerIron Intercepting traffic for no known reason.

[Drew Weaver]

Hi,

I have a real basic setup.

3 recursive DNS servers connected directly to a Serveriron:

server real DNS1 10.1.123.2
port dns
server real DNS2 10.1.123.3
port dns
server real DNS3 10.1.123.4
port dns
server virtual DNS 192.168.74.89
port dns
port dns stateless no-hash
bind dns DNS1 dns DNS2 dns DNS3 dns

[root at linuxweb ~]# nslookup news.com 10.1.123.2
;; reply from unexpected source: 192.168.74.89#53, expected 10.1.123.2#53
[root at linuxweb ~]# nslookup news.com 10.1.123.3
;; reply from unexpected source: 192.168.74.89#53, expected 10.1.123.3#53
[root at linuxweb ~]# nslookup news.com 10.1.123.4
;; reply from unexpected source: 192.168.74.89#53, expected 10.1.123.4#53
[root at linuxweb ~]# nslookup news.com 192.168.74.89
Server:         192.168.74.89
Address:        192.168.74.89#53
Non-authoritative answer:
Name:   news.com
Address: 64.30.224.26

Does anyone know why with port DNS stateless enabled the ServerIron intercepts traffic destined directly for the real servers?

I remember deploying this before in another location and this did not happen.

Thanks,
-Drew

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/foundry-nsp/attachments/20130416/1222d7df/attachment.html>