DNS not forwarding requests

I am not sure what your trying to do. If your running DHCP on the server you need to point the clients to your server as the DNS server for them to get internet. If the server has no internet you need to make sure in prefrences, network, and that under your network card you have the outside DNS servers in there as well.

That's not a good practise.

The DNS server should only have it's own IP in Network prefpane.

(The forwarders are used to offload resolving of all external domains to the ISP DNSes.)

If you put in public IP DNSes in Network prefpane they could be used by the server to try to resolve (private IP and/or) internal only names/domains of which they know nothing.

I would prefer to use 2 internal DNS (master/slave) primary/secondary and send/use those two IPs to/on all LAN clients. Both could be setup to use the same ISP forwarders

If your LAN clients use your server for DNS only that server needs to be able to reach Internet DNS for resolving.

If you try to reach Internet from LAN clients and you have a firewall/NAT router in place that NAT router/Firewall needs to now how to forward returning DNS answers to the originating LAN client.

If using OS X firewall - the server is the gw/NAT router - this used to be a problem.

Depending on wich (preset) firewall rules used the firewall could block some traffic including these DNS answers.

Before discovering the keep-state capability in ipfw rules I then setup a rule that said something like:

allow udp from any 53 to <(Private IP) LAN network IP-range/subnet> in

but if using a rule like:

allow ip from <(Private IP) LAN network IP-range/subnet> (in) keep-state

dynamic temporary rules are created instead for any traffic LAN clients have originated.

As all LAN clients and the server should use the server internal/it's own DNS this should only be used to see if the ISP DNS allow recursion (answering your requests) or test the internal DNS servers ability to use ISP DNS for lookups:

host <IP or name/FQDN you want to lookup>. <DNS server you'll like to test if allowing recursion or not>

If your internal DNS is behind another (ipfw) firewall that firewall of course need to let returning DNS answer packets in.


HTH