Strange issue - not sure how to fix
-
@johnpoz said in Strange issue - not sure how to fix:
dig feedly.com +trace
This is the output:
; <<>> DiG 9.12.2-P1 <<>> feedly.com +trace
;; global options: +cmd
. 86247 IN NS b.root-servers.net.
. 86247 IN NS e.root-servers.net.
. 86247 IN NS l.root-servers.net.
. 86247 IN NS g.root-servers.net.
. 86247 IN NS f.root-servers.net.
. 86247 IN NS i.root-servers.net.
. 86247 IN NS k.root-servers.net.
. 86247 IN NS d.root-servers.net.
. 86247 IN NS a.root-servers.net.
. 86247 IN NS m.root-servers.net.
. 86247 IN NS h.root-servers.net.
. 86247 IN NS c.root-servers.net.
. 86247 IN NS j.root-servers.net.
. 86247 IN RRSIG NS 8 0 518400 20200306170000 20200222160000 33853 . OllzbzJsOGxkm+P/Ey6qfFo8aQAw2uj4myYKF8VK5wW/2wxfpUNvRpfR zqrknCl2bYIuW/NtVVqrfD/u8NxeMEqOf44O7SjHj6xEvEVlDnb+L3tU rb2q3yUOKROLKd4hsjNWqzYqX8ceP9ZfFnSMGrDEZLgS64/SK3QRHY74 XEGj1knstNH7iRjvUt/DH851ViURrJ+sQCnw0eXWqkKsgF27arrQES3T vgnW7VvEal5bPgLNImafvgmiHmjL74No2QlRUtWl2KpspZqqiXZOe3lr HIMnZJhY5ku8QB35u9Yxb/YX6b5yo0u9xv4akOB8rYKlzwLRw9/ilQ2a vhDQRQ==
;; Received 525 bytes from 127.0.0.1#53(127.0.0.1) in 0 ms;; connection timed out; no servers could be reached
What does this tell me?
-
Tells me you are not able to talk to any of the roots!! So nothing going to resolve.. Only stuff you have cached already is going to be able to resolve.
-
That is strange. Because I am having no trouble accessing any other sites, including sites where I have never browsed before.
How do I solve that issue? Any pointers?
-
Well why can you not query the roots... Try to query one..
[2.4.4-RELEASE][admin@sg4860.local.lan]/root: dig @h.root-servers.net com NS ; <<>> DiG 9.12.2-P1 <<>> @h.root-servers.net com NS ; (2 servers found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 54900 ;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 13, ADDITIONAL: 27 ;; WARNING: recursion requested but not available ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;com. IN NS ;; AUTHORITY SECTION: com. 172800 IN NS a.gtld-servers.net. com. 172800 IN NS b.gtld-servers.net. com. 172800 IN NS c.gtld-servers.net. com. 172800 IN NS d.gtld-servers.net. com. 172800 IN NS e.gtld-servers.net. com. 172800 IN NS f.gtld-servers.net. com. 172800 IN NS g.gtld-servers.net. com. 172800 IN NS h.gtld-servers.net. com. 172800 IN NS i.gtld-servers.net. com. 172800 IN NS j.gtld-servers.net. com. 172800 IN NS k.gtld-servers.net. com. 172800 IN NS l.gtld-servers.net. com. 172800 IN NS m.gtld-servers.net. ;; ADDITIONAL SECTION: a.gtld-servers.net. 172800 IN A 192.5.6.30 b.gtld-servers.net. 172800 IN A 192.33.14.30 c.gtld-servers.net. 172800 IN A 192.26.92.30 d.gtld-servers.net. 172800 IN A 192.31.80.30 e.gtld-servers.net. 172800 IN A 192.12.94.30 f.gtld-servers.net. 172800 IN A 192.35.51.30 g.gtld-servers.net. 172800 IN A 192.42.93.30 h.gtld-servers.net. 172800 IN A 192.54.112.30 i.gtld-servers.net. 172800 IN A 192.43.172.30 j.gtld-servers.net. 172800 IN A 192.48.79.30 k.gtld-servers.net. 172800 IN A 192.52.178.30 l.gtld-servers.net. 172800 IN A 192.41.162.30 m.gtld-servers.net. 172800 IN A 192.55.83.30 a.gtld-servers.net. 172800 IN AAAA 2001:503:a83e::2:30 b.gtld-servers.net. 172800 IN AAAA 2001:503:231d::2:30 c.gtld-servers.net. 172800 IN AAAA 2001:503:83eb::30 d.gtld-servers.net. 172800 IN AAAA 2001:500:856e::30 e.gtld-servers.net. 172800 IN AAAA 2001:502:1ca1::30 f.gtld-servers.net. 172800 IN AAAA 2001:503:d414::30 g.gtld-servers.net. 172800 IN AAAA 2001:503:eea3::30 h.gtld-servers.net. 172800 IN AAAA 2001:502:8cc::30 i.gtld-servers.net. 172800 IN AAAA 2001:503:39c1::30 j.gtld-servers.net. 172800 IN AAAA 2001:502:7094::30 k.gtld-servers.net. 172800 IN AAAA 2001:503:d2d::30 l.gtld-servers.net. 172800 IN AAAA 2001:500:d937::30 m.gtld-servers.net. 172800 IN AAAA 2001:501:b1f9::30 ;; Query time: 45 msec ;; SERVER: 198.97.190.53#53(198.97.190.53) ;; WHEN: Sat Feb 22 16:49:09 CST 2020 -
@johnpoz said in Strange issue - not sure how to fix:
dig @h.root-servers.net com NS
; <<>> DiG 9.12.2-P1 <<>> @h.root-servers.net com NS
; (2 servers found)
;; global options: +cmd
;; connection timed out; no servers could be reached -
your not even getting an IP? dig to IP.
[2.4.4-RELEASE][admin@sg4860.local.lan]/root: dig h.root-servers.net ; <<>> DiG 9.12.2-P1 <<>> h.root-servers.net ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31354 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;h.root-servers.net. IN A ;; ANSWER SECTION: h.root-servers.net. 85798 IN A 198.97.190.53 ;; Query time: 0 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Sat Feb 22 16:51:18 CST 2020 ;; MSG SIZE rcvd: 63Then try and dig to that IP..
dig @198.97.190.53 com ns
If your not getting back IPs from unbound for roots - then yeah your going to have all kinds of issues!! You would only be able to resolve stuff that you have IPs to be able to ask those NS.
-
@johnpoz said in Strange issue - not sure how to fix:
dig h.root-servers.net
I just rebooted, so I am able to access feedly.com again. But who knows for how long?
This is the output:
; <<>> DiG 9.12.2-P1 <<>> h.root-servers.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8969
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;h.root-servers.net. IN A;; ANSWER SECTION:
h.root-servers.net. 86400 IN A 198.97.190.53;; Query time: 3199 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sat Feb 22 17:57:27 EST 2020
;; MSG SIZE rcvd: 63; <<>> DiG 9.12.2-P1 <<>> @198.97.190.53 com ns
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49732
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 13, ADDITIONAL: 27
;; WARNING: recursion requested but not available;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;com. IN NS;; AUTHORITY SECTION:
com. 172800 IN NS a.gtld-servers.net.
com. 172800 IN NS b.gtld-servers.net.
com. 172800 IN NS c.gtld-servers.net.
com. 172800 IN NS d.gtld-servers.net.
com. 172800 IN NS e.gtld-servers.net.
com. 172800 IN NS f.gtld-servers.net.
com. 172800 IN NS g.gtld-servers.net.
com. 172800 IN NS h.gtld-servers.net.
com. 172800 IN NS i.gtld-servers.net.
com. 172800 IN NS j.gtld-servers.net.
com. 172800 IN NS k.gtld-servers.net.
com. 172800 IN NS l.gtld-servers.net.
com. 172800 IN NS m.gtld-servers.net.;; ADDITIONAL SECTION:
a.gtld-servers.net. 172800 IN A 192.5.6.30
b.gtld-servers.net. 172800 IN A 192.33.14.30
c.gtld-servers.net. 172800 IN A 192.26.92.30
d.gtld-servers.net. 172800 IN A 192.31.80.30
e.gtld-servers.net. 172800 IN A 192.12.94.30
f.gtld-servers.net. 172800 IN A 192.35.51.30
g.gtld-servers.net. 172800 IN A 192.42.93.30
h.gtld-servers.net. 172800 IN A 192.54.112.30
i.gtld-servers.net. 172800 IN A 192.43.172.30
j.gtld-servers.net. 172800 IN A 192.48.79.30
k.gtld-servers.net. 172800 IN A 192.52.178.30
l.gtld-servers.net. 172800 IN A 192.41.162.30
m.gtld-servers.net. 172800 IN A 192.55.83.30
a.gtld-servers.net. 172800 IN AAAA 2001:503:a83e::2:30
b.gtld-servers.net. 172800 IN AAAA 2001:503:231d::2:30
c.gtld-servers.net. 172800 IN AAAA 2001:503:83eb::30
d.gtld-servers.net. 172800 IN AAAA 2001:500:856e::30
e.gtld-servers.net. 172800 IN AAAA 2001:502:1ca1::30
f.gtld-servers.net. 172800 IN AAAA 2001:503:d414::30
g.gtld-servers.net. 172800 IN AAAA 2001:503:eea3::30
h.gtld-servers.net. 172800 IN AAAA 2001:502:8cc::30
i.gtld-servers.net. 172800 IN AAAA 2001:503:39c1::30
j.gtld-servers.net. 172800 IN AAAA 2001:502:7094::30
k.gtld-servers.net. 172800 IN AAAA 2001:503:d2d::30
l.gtld-servers.net. 172800 IN AAAA 2001:500:d937::30
m.gtld-servers.net. 172800 IN AAAA 2001:501:b1f9::30;; Query time: 27 msec
;; SERVER: 198.97.190.53#53(198.97.190.53)
;; WHEN: Sat Feb 22 17:57:53 EST 2020
;; MSG SIZE rcvd: 828Does it matter that my DNS is set to 127.0.0.1?
-
That was after you rebooted.. Or was that before you rebooted... You shouldn't have to reboot - just restart unbound.
-
if you are resolving - then yes your dns should be set to loopback! That is unbound directly..
-
This was after I rebooted. Prior to that, I did in fact restart unbound manually, but it did not fix the problem. Rebooting always solves this issue, for some length of time, but then it always recurs
It occurs to me that the reason I can access sites in the browser that I have never accessed before even when I am experiencing this issue is that I am using Firefox, which internally sets its own DNS to cloudfare DNS. So it is probably bypassing the pfSense DNS and allowing me to access these sites. So it was masking the issue. Strangely though, it was still not allowing me to access feedly.com. So something is still being blocked somewhere at some point.
-
Other than rebooting, is there anything else I can try to get Unbound connected to the root servers when this occurs again?
-
@pfguy2018 said in Strange issue - not sure how to fix:
which internally sets its own DNS to cloudfare DNS
Mine doesn't - I have that shit turned off!! F that going to hand everything to cloudflare..
I would validate the query is actually going out, or not... Do a sniff on your wan - are you seeing dns going out.. Up the logging of unbound to see if you can see errors, etc.
If your saying restarting unbound doesn't fix it but reboot, then points to something with the connection... Sniff to see if your dns goes out and your just not getting an answer.
-
I don't see any errors in the unbound log at level 2 or 3 logging. I am not sure how to sniff the WAN traffic - can you point me to some instructions for how to do that?
-
Go to diag menu, packet capture - pick your wan interface.
-
Doing that, how do I check if the root servers are being queried?
-
Well query something ;) While your sniffing..
-
OK, now I just have to wait for the DNS resolution to start failing again before I sniff the traffic. Will report back later.
-
You sniff now right to get a feel for what sort of traffic you see, etc. When its working...
You might want to grab say wireshark for your pc, so you can load the capture into that - download on the diag page.. This will give you way more insight and details of what is going on.. But really your just wanting to see that hey the query went out.. Did you or did you not get an answer..
What you were showing you were having timeouts..
-
I am trying to post the traffic output, but it is being flagged as spam by the software running the forum, and I can't post it.
-
08:57:57.060415 ARP, Request who-has 99.228.243.128 tell 99.228.242.1, length 46 08:57:57.071807 IP xxx.xxx.xxx.xxx > 99.228.144.1: ICMP echo request, id 42349, seq 6292, length 8 08:57:57.082227 IP 99.228.144.1 > xxx.xxx.xxx.xxx: ICMP echo reply, id 42349, seq 6292, length 8 08:57:57.084566 IP xxx.xxx.xxx.xxx.23495 > 24.156.130.43.80: tcp 442 08:57:57.092988 IP 24.156.130.43.80 > xxx.xxx.xxx.xxx.23495: tcp 0 08:57:57.097414 ARP, Request who-has 206.188.75.254 tell 206.188.75.225, length 46 08:57:57.100039 IP 24.156.130.43.80 > xxx.xxx.xxx.xxx.23495: tcp 1448 08:57:57.100058 IP 24.156.130.43.80 > xxx.xxx.xxx.xxx.23495: tcp 572 08:57:57.101500 IP xxx.xxx.xxx.xxx.23495 > 24.156.130.43.80: tcp 0 08:57:57.115341 ARP, Request who-has 99.228.195.183 tell 99.228.194.1, length 46 08:57:57.132347 ARP, Request who-has 209.142.43.80 tell 209.142.43.65, length 46 08:57:57.136346 ARP, Request who-has 104.158.199.48 tell 104.158.199.33, length 46 08:57:57.153353 ARP, Request who-has 72.53.212.137 tell 72.53.212.129, length 46 08:57:57.155347 ARP, Request who-has 99.228.150.0 tell 99.228.150.1, length 46 08:57:57.157348 ARP, Request who-has 135.23.223.90 tell 135.23.223.65, length 46 08:57:57.176453 ARP, Request who-has 108.168.98.253 tell 108.168.98.225, length 46 08:57:57.183379 ARP, Request who-has 99.228.197.247 tell 99.228.196.1, length 46 08:57:57.189359 ARP, Request who-has 99.228.237.142 tell 99.228.236.1, length 46 08:57:57.190311 IP xxx.xxx.xxx.xxx.24725 > 151.101.126.99.443: tcp 111 08:57:57.192357 ARP, Request who-has 99.228.237.217 tell 99.228.236.1, length 46 08:57:57.202537 IP 151.101.126.99.443 > xxx.xxx.xxx.xxx.24725: tcp 1448 08:57:57.202631 IP 151.101.126.99.443 > xxx.xxx.xxx.xxx.24725: tcp 1340 08:57:57.202682 IP 151.101.126.99.443 > xxx.xxx.xxx.xxx.24725: tcp 1448 08:57:57.202876 IP 151.101.126.99.443 > xxx.xxx.xxx.xxx.24725: tcp 1340
