1

I have properly setup resolvconf, which properly sets up /etc/resolv.conf:

# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN

nameserver 8.8.8.8
nameserver 8.8.4.4

I am behind a proxy, so I have updated /etc/profile.d/proxy.sh, /etc/apt/apt.conf.d/99HttpProxy and /etc/wgetrc.

Apt is able to resolve names, but dig or ping is not.

# dig ftp.de.debian.org

(times out)

  • Why is apt resolving the names properly? I thought there is a single DNS resolving mechanism on Debian, based on /etc/resolv.conf?
  • Why is my properly setup /etc/resolv.conf not working?
  • Do I need to install / setup something else for DNS to work? I am under the assumption that DNS is performed by the system libraries (according to the resolver configuration), so no extra service needs to be installed in order for DNS to work.
  • Do I need to restart any service after tweaking the resolver configuration?

EDIT

My /etc/nsswitch.conf is:

# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.

passwd:         compat
group:          compat
shadow:         compat
gshadow:        files

hosts:          files dns
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup:       nis
3
  • Would you read the comments of the 2nd line of /etc/resolv.conf? You want to edit it, I would uninstall resolvconf. Are you able to ping 8.8.8.8? I mention you are behind a proxy, however you do not mention wether you have direct Internet access. May 9, 2016 at 14:24
  • I am happy with resolvconf generating resolv.conf. I can not ping (since ping requests are dropped in my network), but apt is able to resolve fine.
    – blueFast
    May 9, 2016 at 14:38
  • Because proxies do the external name resolution for you. May 9, 2016 at 16:52

1 Answer 1

3

If your network blocks direct HTTP access (so that you need to use a proxy), it probably blocks direct DNS access as well. You've configured your system to access Google's DNS servers. That can't work if your network blocks them.

Remove the setting where you hard-code your preference of DNS servers, and leave the system default. Typically you get an IP address through DHCP, and the DHCP server tells your computer what DNS servers to use.

Programs that use the HTTP proxy work because they don't make DNS requests — the proxy makes them.

4
  • Why can't DNS requests be proxied? As said, apt is able to resolve hostnames just fine ...
    – blueFast
    May 10, 2016 at 4:46
  • DNS requests can be proxied, but not by a http proxy - you need to use a recursive dns resolver. There are several to choose from, including maradns, dnsmasq, bind9, pdns, dnsproxy, and unbound. All of those except dnsproxy will also cache results, which can have significant performance benefits for all machines using the resolver on the local network. BTW, is apt configured to use a proxy? or do you have (ftp|https?)_proxy env vars set?
    – cas
    May 10, 2016 at 8:13
  • @cas: https?_proxy is set. I have the impression that https_proxy was set correctly, and http_proxy was wrong; That's why apt was working (it is hitting https), but curl for example was not (since I was curling an http address)
    – blueFast
    May 11, 2016 at 6:05
  • Thanks @Gilles, I think you nailed. apt is working because I set up correctly the https_proxy env variable; apt is using https and thus DNS is done by the proxy. ping / dig were not working because the DNS servers I setup in resolv.conf were outside the network, and thus DNS requests were blocked by the proxy. curl was not working because the http_proxy variable was wrongly set, and I was trying to hit http with it. Somehow I had the false impression that the (http) proxy was proxying all IP packets, but it is (obviously, hence the name) only proxying http / https requests.
    – blueFast
    May 11, 2016 at 6:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .