Home / server / Questions / 217871
Accepted
unom
Asked: 2011-01-02 14:34:55 +0800 CST

How do i Setup a Mac OS X Server - NameServer behind an Airport Extreme?

  • 772

I have a Mac mini server i want to setup to host a couple of things.

My setup is as follows:

The WAN connection (static IP and ISP nameservers) goes into the wan port of the Airport Extreme. The Mac mini server is connected to one of the ethernet ports. The mac mini will host my domain something.com.

My settings so far: Airport Express gets:

96.x.x.x as the external static IP from the ISP

174.y.y.y as the nameserver

Mac mini server always gets a reserved DHCP IP from the Airport Express:

10.0.1.3 is the server's ip

10.0.1.1 as the dns (this ip is the airport express itself)

My dns server has an A record pointing to ns.something.com and a PTR doing the reverse.

I've already added my 96.x.x.x to point ns.something.com with my registrar as attached.

NOW: Nobody seems to be able to access my ns.something.com to resolve any of my records. From a any computer in my network I CAN see my ns and everything works. The outside on the other hand does not... it's as if the airport extreme which "holds" the exterior 94.x.x.x address doesn't pass DNS along to my 10.0.1.3 ns server.

I have the server managing the airport. Isn't this supposed to work?

domain-name-system mac-osx-server nameserver

2 Answers

  1. Best Answer

    Edit: Okay... it looks like your top level domain provider hasn't properly pointed ns.invatamax.ro to 96.x.x.x. My computer attempts to resolve invatamax.ro, recognizes that you've set up the nameserver to be ns.invatamax.ro, but then it is unable to resolve what IP address (the 96.x.x.x address) it should look to. When did you have your domain provider set up the pointer? If it was within the last day, it needs time to replicate around the world. Since I'm unable to get the IP address of ns.invatamax.ro at all, it is not a router issue. If it were a router issue I would be able to find out the 96.x.x.x address but a traceroute would fail at the router. alt text

    Check this link out: http://zytrax.com/books/dns/ch8/ns.html It uses a bunch of fancy confusing language but basically what you're missing is that glue record.

    To break the query deadlock for referrals which return name servers within the domain being queried. Assume a query for a domain, say the A RR for www.example.com, returns a referral containing the name but not the IP address of a name server, say ns1.example.com, which lies within the domain example.com. Since the IP address of the name server is not known this will naturally result in a query for the A RR of ns1.example.com which will return, again, a referral with the name but not the IP of ns1.example.com! When the glue record is provided this problem does not occur.

    alt text

    As you can see from the diagram, there's an infinite loop going 2->3->4->5->4->5->4->5->4

    Just a quick thought: It's possible you may also need a reverse record, sometimes called a PTR record. You can ask your ISP to set that up. You'll want a reverse record pointing 96.x.x.x to something.com and ns.something.com.

    A side note: it is highly inadvisable to host public DNS on a single server in a single location with non-redundant power and internet and routers and a consumer-grade connection.

    Also, from outside of the network, run traceroute -p X ns.something.com where X is a port number DNS uses, for each port number DNS is using. This will tell you the path that computers outside of the network are taking to attempt to get to your server.

    • 1

  2. Firstly, "something.com" resolves to a webpage that works ok for me so I am guessing that it's not your real domain name. Knowing the real domain name would help us help you so much faster.

    Secondly, this sounds like you're doing this from home without the support of your ISP? They could well be blocking DNS servers running to domestic networks, as there is very few legitimate reasons why this would be needed by most customers.

    Next, have you actually registered this domain, and got authoritative DNS entries for your domain pointing towards the external internet address of your router?

    It isn't enough just to put a DNS server online, type in a domain name that you fancy and say "here we are, world, come and get us" and from the way your question is phrased it sounds a bit like this is what you've done.

    • 0