4

I am having a very odd DNS issue. I live on-campus and the university provides Internet access with my rent, but I can not get access to the university websites. I am hoping to get direction on how to diagnosis my specific DNS issue as described below. Thanks a ton!

I have an OpenWRT base router/firewall - 10.3.1-rc4 that works just grand. I have no issues what so ever, except when I use the campus network, I can no resolve the university's domain.

I have verified that OpenWRT is using the campus name servers:

root@tdwrt:~# cat /tmp/resolv.conf.auto 
    nameserver 10.35.60.8
    nameserver 10.25.60.2
    search resnet.uwyo.edu
    root@tdwrt:~# wget http://google.com
    Connecting to google.com (209.85.225.105:80)
    Connecting to www.google.com (209.85.225.147:80)
    index.html           100% |**************************************************************|  8746  --:--:-- ETA
    root@tdwrt:~# wget http://uwyo.edu  
    wget: bad address 'uwyo.edu'
    root@tdwrt:~# ping -c5 uwyo.edu
    ping: bad address 'uwyo.edu'
    root@tdwrt:~#

I signed up for 3rd party ISP for two months and when using the cable co as my ISP, I can resolve the university site just fine. But why pay $40 per mo, when it is suppose to be included in my rent?!

I have also re-flashed the device to get rid of any potential malformed configs.

I run "tcpdump -n -i br-lan | grep .53 | grep domain.com" and then try to access the domain, but I do not get any output. When I run the same (with different interface) on my workstation, it shows the router being queried for address.

05:01:12.516403 IP 192.168.1.5.59064 > 192.168.1.1.53: 64580+ AAAA? uwyo.edu. (26)
05:01:12.521326 IP 192.168.1.5.57653 > 192.168.1.1.53: 31772+ AAAA? uwyo.edu. (26)
05:01:12.528271 IP 192.168.1.5.41321 > 192.168.1.1.53: 17466+ A? uwyo.edu. (26)
05:01:12.537111 IP 192.168.1.5.47016 > 192.168.1.1.53: 50397+ A? uwyo.edu. (26)

I started a trouble ticket back in May 2009 and updated it through out the summer. I can not get the university support to touch it. Its easy to think its a problem with my router, but I say it is not so easy since EVERY other domain is just fine and even uwyo.edu works just fine when using 3rd party ISP. The problem seems to be a combo of how UW does there stuff and OpenWRT..

Improve this question

4 Answers 4

Reset to default
2

It seems that the campus has a special configuration for its own domain.
The UDP name resolution queries are probably not handled the same way when coming from the local private network (10...*) or from the public networks (Internet).

Did you try 

  dig uwyo.edu

or 

  host -a uwyo.edu

Anyway, if you use the Google DNS servers, you are likely to get your problem fixed, since the NS is outside the campus on the public side.

Change /tmp/resolv.conf.auto with

nameserver 8.8.8.8
nameserver 8.8.4.4
search resnet.uwyo.edu
Improve this answer
6
  • Hi ring0, Here is dig and host (thanks for mentioning the tools): pastebin.mozilla.org/918599 As you can see host resolves an IP. I also ran nmap -p 80 on 172.26.4.49 and the port is open, but if I run it on uwyo.edu i get "failed to resolve hostname". When I put the IP address in to my browser, i get "uwyo.edu can not be found". change the nameservers and now when i run host -a uwyo.edu i get "connection timed out; no servers could be reached"
    – Tom
    Commented Jan 9, 2011 at 21:51
  • 1
    hold on now... thats a private block. if i use the public IP of 129.72.61.21 i can access the website. So, im thinking UW runs a split horizon DNS and blocks out going on port 53 to force the use of their DNS. Could this explain it? What are other explanations?
    – Tom
    Commented Jan 9, 2011 at 22:01
  • The problem is not the routing to the IP address, but only the name resolution. Again, I suggest to use the Google DNS as nameserver (see my answer) since seemingly the campus server does not serve local clients from the private segment 10.*.
    – Déjà vu
    Commented Jan 10, 2011 at 0:06
  • Thanks again. "change the nameservers (to google [sic]) and now when i run host -a uwyo.edu i get "connection timed out; no servers could be reached" in the past I had also tired OpenDNS. I was actually thinking that trying non-UW NS is what started the mess, but since then, I have flashed the router.
    – Tom
    Commented Jan 10, 2011 at 4:09
  • check this out, -p 53 is open for the local dns but filtered when using google: tom@sue:~$ sudo nmap -p 53 10.35.60.8 Starting Nmap 5.00 ( nmap.org ) at 2011-01-09 21:41 MST Interesting ports on 10.35.60.8: PORT STATE SERVICE 53/tcp open domain Nmap done: 1 IP address (1 host up) scanned in 0.41 seconds tom@sue:~$ sudo nmap -p 53 8.8.8.8 Starting Nmap 5.00 ( nmap.org ) at 2011-01-09 21:41 MST Interesting ports on google-public-dns-a.google.com (8.8.8.8): PORT STATE SERVICE 53/tcp filtered domain Nmap done: 1 IP address (1 host up) scanned in 4.89 seconds
    – Tom
    Commented Jan 10, 2011 at 4:43
0

If I well understand, you are filtered when you try to output DNS request to outside, did you try to use directly public NS from your domain (129.72.60.8 or 129.72.60.2) ?

If it's working you can specify forward on theses IP's for domain uwyo.edu, and use of campus DNS for all others domains.

If not, the only way is to bypass the filtering rules with a VPN connection on a dedicated server (you can find some one cheaper than 40$/month).

Improve this answer
1
  • When attempting via IP, my browser is redirected to the domain - which doesn't work. The only thing I have been able to do is VPN... actual I set up SSH forwarding and proxy when Im desperate enough.
    – Tom
    Commented May 6, 2011 at 6:30
0

Could it be that the DNS server/browser problem responds oddly based on some host header weirdness? Try going straight for the internal IP instead of the domain name(get it from another computer if you have to) and set it statically in your hosts file just to test. The internal facing website and external facing website might be on the same host with two different IPs(NAT) as well. Then, the outside DNS resolution to a global IP probably fails to get hair-pinned at the edge router.

Improve this answer
0

It's a fairly common configuration for a university to block outgoing DNS. They probably run caching recursive servers, and there's no need to fill up their outgoing bandwidth with DNS requests that should be cached locally.

Have you tried calling their help desk about this issue??

Improve this answer
1
  • "I started a trouble ticket back in May 2009 and updated it through out the summer. I can not get the university support to touch it." Even if I wanted to us external DNS, the problem is something else - I can not load *.uwyo.edu
    – Tom
    Commented May 6, 2011 at 6:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .