(network unreachable) error in my server logs

Solution 1:

All of the addresses are IPv6. Seems an IPv6 issue, you probably have no IPv6 networking configured. Disable IPv6 suport in Bind:

Edit /etc/sysconfig/named and set:

OPTIONS="-4"

Then restart bind:

service named restart

(from http://crashmag.net/disable-ipv6-lookups-with-bind-on-rhel-or-centos)

Are you under attack? I don't think you've been compromised. Those messages can be normal depending on what services you are running (anyhow, any server is always under some attempt of attack, people scans the internet trying exploits on every server).

Solution 2:

It may be worth noting that in Debian Jessie with systemd, the -4 option in /etc/default/bind9 may be ignored. See bug #767798.

In that case, you need to modify the systemd bind9.service file:

Move bind9.service to avoid it being overwritten on updates

cd /etc/systemd
find . -name "bind*" -delete
cp /lib/systemd/system/bind9.service system/

Edit system/bind9.service to use the options in /etc/default/bind9.

$EDITOR system/bind9.service

Add EnvironmentFile=-/etc/default/bind9 and modify ExecStart to include $OPTIONS. (I remove -u bind, because on Debian, it is already included in $OPTIONS)

Make sure to keep the -f option needed for systemd. See this diff for an example:

# diff -u1 /lib/systemd/system/bind9.service /etc/systemd/system/bind9.service 
--- /lib/systemd/system/bind9.service   2015-12-14 21:12:28.000000000 +0100
+++ /etc/systemd/system/bind9.service   2016-02-08 15:34:59.634891951 +0100
@@ -6,3 +6,4 @@
 [Service]
-ExecStart=/usr/sbin/named -f -u bind
+EnvironmentFile=-/etc/default/bind9
+ExecStart=/usr/sbin/named -f $OPTIONS
 ExecReload=/usr/sbin/rndc reload

And finally

systemctl reenable bind9.service
service bind9 restart

---

Solution 3:

The problem is caused by an update to BIND in Centos, it tries to use IPv6 as well as IPv4.

Best way to fix it is either use IPv6 or configure bind to only use IPv4

in /etc/named.conf set

OPTIONS="-4"

This will stop it using IPv6 on start up and restart DNS

service named restart

---

Solution 4:

For ubuntu order than 16.04: sudo vi /etc/default/bind9

OPTIONS="-4 -u bind"

---

Solution 5:

Nice options, I realized that this log appears when you use the named.root servers provided by www.internic.net/zones because some of this servers doesn't have online IPv6 interfaces.

What I did was to work with the forwarders stanza in my named.conf file and this log didn't appear anymore or at least so far.

Here is part my of my named.conf file. As you can see, I commented out the Zone Hints Section. And other stanzas because I'm working on a particular setup.

// Start the options clauses
options {
        listen-on-v6 {
                none;
                };
        listen-on port 53 {
                127.0.0.1;
                192.168.1.0/24;
                };
        directory "/var/named";
//      tkey-gssapi-keytab "/usr/local/samba/private/dns.keytab";
        version "Not Currently Available";
        auth-nxdomain yes;
        empty-zones-enable no;
        notify no;
        forwarders {
                208.67.220.220;
                208.67.222.222;
                };
        allow-query {
                127.0.0.1;
                192.168.1.0/24;
                };
        allow-recursion {
                127.0.0.1;
                192.168.1.0/24;
                };
        allow-transfer {
                none;
                };
        };
// Zone Clauses
// Root Servers to allow Recursion
//zone "." {
// Zone Clauses
// Root Servers to allow Recursion
//zone "." {
//      type hint;
//      file "named.root";
//      };