1

I cannot nslookup github:

nslookup github 8.8.8.8
;; connection timed out; no servers could be reached

nslookup github.com
;; connection timed out; no servers could be reached

nb: default ns server = gw = router 4g = 192.168.0.1 (a cache dns server I guess). I am on a 192.168.0.0/24, my ip = 192.168.0.130, bcast = 192.168.0.255, ip given by router via dhcp.

my nslookup seems to be working:

nslookup google.com 
Server:     8.8.8.8
Address:    8.8.8.8#53
Non-authoritative answer:
Name:   google.com
Address: 142.250.187.206
Name:   google.com
Address: 2a00:1450:4009:81f::200e

I can tlslookup github.com

tlslookup github.com 
140.82.113.4

nb: I dont know why resolution works with this tool and not with nslookup. I tried to grab infos regarding tlslookup over google but nothing.

I check with dig (just in case my nslookup does not work fine). Unfortunately the pb remains with this tool.

dig github.com
; <<>> DiG 9.16.27-Debian <<>> github.com
;; global options: +cmd
;; connection timed out; no servers could be reached

dig @8.8.8.8 github.com
; <<>> DiG 9.16.27-Debian <<>> @8.8.8.8 github.com
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

Obviously all commands relying on name resolution wont work, but for the sake of the post, I tried some of them:

ping $(tlslookup github.com)
PING 140.82.114.3 (140.82.114.3) 56(84) bytes of data.
64 bytes from 140.82.114.3: icmp_seq=1 ttl=50 time=259 ms
64 bytes from 140.82.114.3: icmp_seq=2 ttl=50 time=317 ms
64 bytes from 140.82.114.3: icmp_seq=3 ttl=50 time=238 ms
^C
--- 140.82.114.3 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 237.514/271.189/316.968/33.546 ms

but

ping github.com
ping: github.com: Temporary failure in name resolution
openssl s_client -connect github.com:443
140311527400768:error:2008F002:BIO routines:BIO_lookup_ex:system lib:../crypto/bio/b_addr.c:730:Temporary failure in name resolution
connect:errno=11

wget github.com 
--2022-04-28 09:52:02--  http://github.com/
Resolving github.com (github.com)... failed: Temporary failure in name resolution.
wget: unable to resolve host address ‘github.com’

I tried to wget website ip address:

wget 140.82.113.3
--2022-04-28 10:01:13--  http://140.82.113.3/
Connecting to 140.82.113.3:80... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: https://140.82.113.3/ [following]
--2022-04-28 10:01:13--  https://140.82.113.3/
Connecting to 140.82.113.3:443... connected.
The certificate's owner does not match hostname ‘140.82.113.3’

if I browse the ip address, I have got a warning message saying the cert is wrong, if I try to pass it over (accept risk), there is no way to access website.

nothing blocking in my hosts file:

cat /etc/hosts
127.0.0.1   localhost
127.0.1.1   zavata.circus.net   zavata
# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

Everything look fine in my routing table (192.168.0.1 beeing my default gw, a 4g router)

route -n 

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.0.1     0.0.0.0         UG    600    0        0 wlp1s0
169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0 wlp1s0
192.168.0.0     0.0.0.0         255.255.255.0   U     600    0        0 wlp1s0

Many thanx folks !!

4
  • what is the content of /etc/resolv.conf ?
    – Archemar
    Apr 28, 2022 at 15:24
  • The obvious suggestion is that your ISP is blocking DNS queries. This is consistent with tlslookup working but dig and nslookup failing. You say that this is a 4g router. It might be that you are stuck behind "carrier grade nat". You can try downloading using the --no-check-certificate argument to wget after you have read the manual.
    – icarus
    Apr 28, 2022 at 15:25
  • Are you using linux (the banner in dig suggests you are), and if so can you edit /etc/systemd/resolv.conf to change #DNSOverTLS=no to DNSOverTLS=yes (i.e. delete the # and change no to yes). then restart the resolver (simplest is a reboot, or else try systemctl restart NetworkManager) You should then be able to use 127.0.0.53 as the nameserver to query.
    – icarus
    Apr 28, 2022 at 15:37
  • nb. The result you get from tlsnslookup in the stand-alone command is 140.82.113.4, but when you use the output you get 140.82.114.3 - a typo perhaps?
    – icarus
    Apr 28, 2022 at 15:46

1 Answer 1

0

It looks like the problem comes from the operator. As soon as I change of FAI/operator, I can access github.com without any issue. I just made an entry in my hosts file to access the website when connected to the faulty FAI.

1
  • @icarus: a whois of both addresses show that 140.82.112.0/20 belongs to github.com.
    – achille
    Apr 29, 2022 at 13:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.