1

I have a CentOS 6 VPS. I can ping 8.8.8.8 but not google.com.

My resolv.conf is:

nameserver 8.8.4.4
nameserver 8.8.8.8
nameserver 4.2.2.4

Is there anything else that I should check?

Update:

# dig @8.8.8.8 google.com

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.30.rc1.el6_6.3 <<>> @8.8.8.8 google.com
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

# iptables -L -n 
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination    
  • 1
    was it working before? iptables, corporate firewall, firewall of your VPS provider? You could listen/debug port 53 with tcpdump. The post is very scant in details. – Rui F Ribeiro Dec 28 '15 at 13:33
  • 1
    If it is installed, you can use the dig command to gather more information about the problem. For example, to direct a query at a specific DNS server, try something like dig @8.8.8.8 google.com. – JasonAzze Dec 28 '15 at 13:41
  • @RuiFRibeiro Yes, It was working before (a month ago). -bash: tcpdump: command not found How should I use tcpdump? – PHPst Dec 28 '15 at 14:43
  • firewall/routing problems. What´s the output of iptables -L -n – Rui F Ribeiro Dec 28 '15 at 14:50
  • not your own apparently by the ouput...do you have a web panel where you can define firewall rules? – Rui F Ribeiro Dec 28 '15 at 14:51
3

As found out debugging the issue together with the original poster, the problem of DNS failing to resolve is that the VPS provider instated and warned previously about a policy obliging to use an internal DNS address, blocking the use of alternatives in their firewall.

As the OP had the email of the provider warning of the change, it was not necessary to do further debugging to confirm the suspicion.

It is rather common practice to force hosted services or servers to use internal DNS servers, to best monitor the usage, enabling earlier detection of compromised machines doing DNS denial of service attacks, to track better customer problems, give them access to special services, applying policies at DNS level (anti-malware, others), do request rate control, and even statistics.

Often malware also changes the default DNS servers of compromised hosts, and this infra-structure setup does not allow that.

Even without forcing all the customers to change addresses, firewall rules can be done, and are more often configured in VPN services and at corporate level to redirect all the traffic to external DNS servers to an internal one.

I would also add that often, as a current practice in the industry, while internal DNS are forced in customers in the lower tiers of service, it can happen that changing to higher tiers (e.g. paying more), that restriction is lifted.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.