3

At my place I have a router that gives me an IPV4 address. My Gentoo PC works fine but my Gentoo laptop stopped resolving names. I visited my parents and tried connecting to their router, which gives me an IPV6 address, and presto, everything was back to normal (I added the IPV6 equivalents of my nameservers to /etc/resolv.conf). Then I tried another router in my parent's network, which sits behind the IPV6 one but which gives me an IPV4 address, and then again I can't resolve names (though if I boot a Gentoo LiveCD I can, so it's a configuration issue on my laptop and related to IPV4) (I re-added the IPV4 addresses back to /etc/resolv.conf, and I also tried leaving the IPV6 ones). I can ping addresses just fine, I just can't resolve names. What could be causing this and how could I fix it?

My resolv.conf (IPV4, used to work in the past):

# dnsmasq
nameserver 127.0.0.1
# OpenNIC
nameserver 31.171.155.107
nameserver 79.133.43.124

IPV6 (working in the IPV6 router):

# dnsmasq
nameserver ::1
# OpenNIC
nameserver 2a05:dfc7:5::53
nameserver 2001:19f0:7001:929:5400:00ff:fe30:50af

Notice that the IPV4 one used to work on the IPV4 routers, it stopped working without me modifying it. Something else got modified and name resolving stopped working. My entire /etc folder (except ssl, shadow, etc) can be found here.

I flushed all iptables rules and set all policies to ACCEPT. No network related services are running except dnsmasq (I tried disabling it and removing the localhost line from resolv.conf, to no avail). I connect to the internet using bare wpa_supplicant and and ip, and it works fine, it's just the name resolving which does not (not even when connecting though the wired interface using Gentoo's rc scripts). Both iptables -L and ip6tables -L return:

 Chain INPUT (policy ACCEPT)
 target     prot opt source               destination         

 Chain FORWARD (policy ACCEPT)
 target     prot opt source               destination         

 Chain OUTPUT (policy ACCEPT)
 target     prot opt source               destination

Some tests and their results (all on an IPV4 router connected wirelessly, though the results are the same with a wired connection):

$ nslookup google.com 8.8.8.8 
;; connection timed out: no servers could be reached.

...

$ dig @8.8.8.8 gentoo.org
;; connection timed out: no servers could be reached.

tcpdump registers nothing when trying to ping a hostname such as google.com, but successfully register ICMP echoes when pinging an IP address:

$ ping gentoo.org
ping: unknown host gentoo.org 
$ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=48 time=74.0 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=48 time=73.7 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=48 time=73.7 ms
^C
--- 8.8.8.8 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 73.708/73.810/74.012/0.344 ms 

tcpdump:

$ tcpdump -i wlp3s0 port 53
dropped privs to tcpdump
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on wlp3s0, link-type EN10MB (Ethernet), capture size 262144 bytes
^C
0 packets captured
0 packets received by filter
0 packets dropped by kernel 
$ tcpdump -i wlp3s0
dropped privs to tcpdump
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on wlp3s0, link-type EN10MB (Ethernet), capture size 262144 bytes
07:05:55.807483 IP 192.168.25.11 > 8.8.8.8: ICMP echo request, id 5903, seq 1, length 64
07:05:55.881446 IP 8.8.8.8 > 192.168.25.11: ICMP echo reply, id 5903, seq 1, length 64
07:05:56.808617 IP 192.168.25.11 > 8.8.8.8: ICMP echo request, id 5903, seq 2, length 64
07:05:56.882287 IP 8.8.8.8 > 192.168.25.11: ICMP echo reply, id 5903, seq 2, length 64
07:05:57.810421 IP 192.168.25.11 > 8.8.8.8: ICMP echo request, id 5903, seq 3, length 64
07:05:57.884089 IP 8.8.8.8 > 192.168.25.11: ICMP echo reply, id 5903, seq 3, length 64
^C
6 packets captured
6 packets received by filter
0 packets dropped by kernel 

ifconfig on the ipv4 router:

 wlp3s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500                   
    inet 192.168.25.11  netmask 255.255.255.0  broadcast 192.168.25.255     
    inet6 fe80::16ec:71f7:dcc5:f175  prefixlen 64  scopeid 0x20<link>       
    ether 00:07:c8:82:a2:96  txqueuelen 1000  (Ethernet)                   
    RX packets 6  bytes 568 (568.0 B)                                       
    RX errors 0  dropped 0  overruns 0  frame 0                             
    TX packets 24  bytes 4038 (3.9 KiB)                                     
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0             

ip route:

$ ip route
default via 192.168.25.1 dev wlp3s0
169.254.0.0/16 dev wlp3s0  proto kernel  scope link  src 169.254.144.184  metric 304
192.168.25.0/24 dev wlp3s0  proto kernel  scope link  src 192.168.25.11

nsswitch:

# /etc/nsswitch.conf:                                                           
# $Header: /var/cvsroot/gentoo/src/patchsets/glibc/extra/etc/nsswitch.conf,v 1.1 2006/09/29 23:52:23 vapier Exp $

passwd:      compat                                                             
shadow:      compat                                                             
group:       compat                                                             

# passwd:    db files nis                                                       
# shadow:    db files nis                                                       
# group:     db files nis                                                       

hosts:       files dns                                                         
networks:    files dns                                                         

services:    db files                                                           
protocols:   db files                                                           
rpc:         db files                                                           
ethers:      db files                                                           
netmasks:    files                                                             
netgroup:    files                                                             
bootparams:  files                                                             

automount:   files                                                             
aliases:     files 

I also ran strace -e open dig @8.8.8.8 gentoo.org and the last thing it does is open /etc/resolv.conf (successfully).

  • Can You ping any website from router? I suspect your router configuration got a problem.Did you define nameserver on your router? – supriady Jan 4 '17 at 11:46
  • iptables -L only shows the filter table; is there anything hiding in the nat or mangle tables? e.g. iptables -t nat -n -L – thrig Jan 4 '17 at 14:59
  • @thrig Yes, that was it! There were nat rules from a previous tor config to prevent DNS leaks, they were redirecting all traffic to localhost on port 9053, where of course there wasn't anything running. IPV6 worked because there were no ip6tables rules. If you add an answer I'll accept it. – afarah Jan 5 '17 at 9:21
  • *all DNS traffic – afarah Jan 5 '17 at 9:33
2

iptables -L gives an incomplete view; in particular, it does not show the NAT nor mangle tables, which can and do influence how packets flow. For complete debugging these various tables will also need to be inspected

iptables -t nat -n -L

or the entire firewall ruleset dumped e.g. with

iptables-save

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.