Issue Configuring slave dns on external debian box with bind

[maolito]

Hi guys!

I'm trying to configure a little vps to use as dns slave for plesk master dns, but after reading documentation and configure the server, domains and plesk slave extension, I always get the following error on bind:

25-Feb-2021 19:12:22.560 general: info: received control channel command 'refresh my-domain.com IN'
25-Feb-2021 19:12:22.560 general: debug 1: queue_soa_query: zone my-domain.com/IN: enter
25-Feb-2021 19:12:22.560 general: debug 1: soa_query: zone my-domain.com/IN: enter
25-Feb-2021 19:12:22.585 general: debug 1: refresh_callback: zone my-domain.com/IN: enter
25-Feb-2021 19:12:22.585 general: debug 1: refresh_callback: zone my-domain.com/IN: serial: new 2021022502, old not loaded
25-Feb-2021 19:12:22.585 general: debug 1: queue_xfrin: zone my-domain.com/IN: enter
25-Feb-2021 19:12:22.585 general: info: zone my-domain.com/IN: Transfer started.
25-Feb-2021 19:12:22.585 general: debug 1: zone my-domain.com/IN: no database exists yet, requesting AXFR of initial version from IP.PLESK.DEBIAN.SERVER#53
25-Feb-2021 19:12:22.611 xfer-in: info: transfer of 'my-domain.com/IN' from IP.PLESK.DEBIAN.SERVER#53: connected using IP.DEBIAN.SLAVE.DNS#52239
25-Feb-2021 19:12:22.636 xfer-in: error: transfer of 'my-domain.com/IN' from IP.PLESK.DEBIAN.SERVER#53: failed while receiving responses: REFUSED
25-Feb-2021 19:12:22.636 general: debug 1: zone my-domain.com/IN: zone transfer finished: REFUSED
25-Feb-2021 19:12:22.636 general: debug 1: zone_settimer: zone my-domain.com/IN: enter
25-Feb-2021 19:12:22.636 general: debug 1: queue_soa_query: zone my-domain.com/IN: enter
25-Feb-2021 19:12:22.636 xfer-in: info: transfer of 'my-domain.com/IN' from IP.PLESK.DEBIAN.SERVER#53: Transfer status: REFUSED
25-Feb-2021 19:12:22.636 xfer-in: info: transfer of 'my-domain.com/IN' from IP.PLESK.DEBIAN.SERVER#53: Transfer completed: 0 messages, 0 records, 0 bytes, 0.025 secs (0 bytes/sec)
25-Feb-2021 19:12:23.060 general: debug 1: soa_query: zone my-domain.com/IN: enter
25-Feb-2021 19:12:23.060 general: debug 1: cancel_refresh: zone my-domain.com/IN: enter
25-Feb-2021 19:12:23.061 general: debug 1: zone_settimer: zone my-domain.com/IN: enter

Running rndc says that the zone refresh is queued, but on bind server I get the REFUSED error

rndc -b IP.PLESK.DEBIAN.SERVER -s IP.DEBIAN.SLAVE.DNS -p 953 -y rndc-key refresh my-domain.com IN
WARNING: key file (/etc/bind/rndc.key) exists, but using default configuration file (/etc/bind/rndc.conf)
zone refresh queued

And here is the configuration file for bind:

options {
        directory "/var/cache/bind";
        dnssec-validation auto;

        auth-nxdomain no;    # conform to RFC1035
        listen-on-v6 { any; };

        allow-new-zones yes;
};


controls {
    inet * port 953 allow { IP.PLESK.DEBIAN.SERVER; 127.0.0.1; } keys { "rndc-key-IP.PLESK.DEBIAN.SERVER";  } ;
 };

key "rndc-key-IP.PLESK.DEBIAN.SERVER" {
  algorithm hmac-md5;
  secret "SECRET-KEY";
};

key "rndc-key" {
  algorithm hmac-md5;
  secret "SECRET-KEY";
};

We have allowed traffic between both ip on both firewalls and also tried with firewalls stopped and no selunix is enabled on slave dns server. And bind is started with ipv4 only.

Bind version is BIND 9.10.3-P4-Debian <id:ebd72b3>

No way to find what is going on to get a refused error on bind. Anyone can help?

Thanks!!

 

[maolito]

Also we tried with the article published by @AYamshanov using bind9 on Centos: Instruction - How to start with Slave DNS Manager | Plesk Forum

We have the same result. All zone transfer to slave ends with REFUSED.

Anyone can help?

 

[AYamshanov]

Hi maolito,

Have you checked the BIND logs on the server IP.PLESK.DEBIAN.SERVER? Are there any hints?