BIND9 denying queries from IPs outsite localnet (External IPs) on Ubuntu.options {        listen-on port 53       { any; };        directory               /var/bind;        allow-query             { any; };        allow-query-cache       { any; };        allow-transfer          { none; };        recursion               no;        dnssec-validation       auto;        auth-nxdomain           no;};include /etc/bind/zones.conf;include /etc/bind/reverse-zones.conf;include /etc/bind/named.conf.default-zones;Example of zones.confzone test.test IN {    type slave;    file zones/test.test.zone;    masters { 1.1.1.1; };};Also, I saw a denied in my logs so added allow-query-cache       { any; }; however this made no difference.Log:client 192.168.3.100#64088 (test.test.SUB.DOMAIN.INTERN): query (cache) 'test.test.SUB.DOMAIN.INTERN/A/IN' deniedAfter running nslookup test.test 172.1.1.5   ( DNS Timeout)Now nothing shows in the syslog out of the ordinary. This is what BIND shows before it loads the zones (with no errors):adjusted limit on open files from 4096 to 1048576found 18 CPUs, using 18 worker threadsusing 18 UDP listeners per interfaceusing up to 18432 socketsloading configuration from '/etc/bind/named.conf'reading built-in trusted keys from file '/etc/bind/bind.keys'using default UDP/IPv4 port range: [1024, 65535]using default UDP/IPv6 port range: [1024, 65535]no IPv6 interfaces foundlistening on IPv4 interface lo, 127.0.0.1#53listening on IPv4 interface eth0, 172.1.1.5#53generating session key for dynamic DNSsizing zone task pool based on 162 zonesusing built-in root key for view _defaultset up managed keys zone for view _default, file 'managed-keys.bind'command channel listening on 127.0.0.1#953managed-keys-zone: loaded serial 2zone 0.in-addr.arpa/IN: loaded serial 1Var/Bind is in a non standard location but I have checked logs after editing the apparmor profile and see no issue.I can successfully query bind from the same subnet./etc/default/bind9:# run resolvconf?RESOLVCONF=no# startup options for the server# OPTIONS=-u bindOPTIONS=-4 -u bindThis change was to disable ipv6I'm a RHEL guy - set up the server successfully on Centos7(1503) and found out the guys overseas with the slave want to run Ubuntu. So this cool be an OS config error on my part.
BIND9 denying queries from IPs outsite localnet (External IPs) - Ubuntu 14.04
bind;apparmor
This was an upstream loadbalancer issue - responses were being received by the wrong IP and being dropped by firewalls on the other end.