从局域网绑定9超时，服务器侦听端口53

Ubuntu Xenial上的Bind9有一个非常奇怪的情况。 服务器正在侦听端口53（使用windows portqry进行testing，试图将其作为本地DNS服务器使用），但是它的请求超时：

 > dig @192.168.1.6 YYY +search ; <<>> DiG 9.11.0-P3 <<>> @192.168.1.6 YYY +search ; (1 server found) ;; global options: +cmd ;; connection timed out; no servers could be reached 

search域在windwos上正确设置（ISC DHCP可以确保这一点）。 但是，正如我所说， portqry探测端口53说，它正在倾听。

 > portqry -n 192.168.1.6 -o 53 Querying target system called: 192.168.1.6 Attempting to resolve IP address to a name... Failed to resolve IP address to name querying... TCP port 53 (domain service): LISTENING 

奇怪的是，服务器响应本地主机上的查询（从服务器本身）：

 ; <<>> DiG 9.10.3-P4-Ubuntu <<>> @192.168.1.6 YYY +search ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23454 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;YYY.mydomain.tld. IN A ;; ANSWER SECTION: YYY.mydomain.tld. 3600 IN A 192.168.1.11 ;; AUTHORITY SECTION: mydomain.tld. 3600 IN NS DNS-SERVER.mydomain.tld. ;; ADDITIONAL SECTION: DNS-SERVER.mydomain.tld. 3600 IN A 192.168.1.6 ;; Query time: 0 msec ;; SERVER: 192.168.1.6#53(192.168.1.6) ;; WHEN: Thu Feb 23 03:59:37 CST 2017 ;; MSG SIZE rcvd: 104 

Netstat声称正在监听所有通常的端口/地址：

• BIND 9：loggingcaching命中和未命中
• BIND拆分视图DNS不与区域传输一起使用
• 思科ASAloggingDNSstream量的“定期翻译创buildicmp的失败…”，但它的工作原理
• cachingDNS服务器（bind9.2）CPU使用率如此之高
• DNS请求超时。 超时是2秒

 ~# netstat -tanpl | grep named tcp 0 0 10.8.0.1:53 0.0.0.0:* LISTEN 4074/named tcp 0 0 192.168.1.6:53 0.0.0.0:* LISTEN 4074/named tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 4074/named tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN 4074/named 

有任何想法吗？

编辑 ：这里的stream行请求是/etc/bind/named.conf.options

 options { directory "/var/cache/bind"; // If there is a firewall between you and nameservers you want // to talk to, you might need to uncomment the query-source // directive below. Previous versions of BIND always asked // questions using port 53, but BIND 8.1 and later use an unprivileged // port by default. // query-source address * port 53; // If your ISP provided one or more IP addresses for stable // nameservers, you probably want to use them as forwarders. // Uncomment the following block, and insert the addresses replacing // the all-0's placeholder. // forwarders { // 0.0.0.0; // }; query-source address * port 53; auth-nxdomain no; # conform to RFC1035 listen-on-v6 { none; }; forwarders { 8.8.8.8; 8.8.4.4; }; forward first; };