Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Can't resolve names after blocking rfc1918

    Scheduled Pinned Locked Moved DHCP and DNS
    5 Posts 2 Posters 556 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      Jarhead
      last edited by

      So I just finished setting up a new box. Pretty much just default 2.4.4 firewall rules except for OpenVPN.
      Our old ISP used private addresses so I wasn't blocking them on the WAN. Our new ISP is a straight public address, so after I got it running with the new IP's, I went through and did a check for any settings that I could tweak and the only thing I did was block the private addresses on the WAN port.
      Now things are really screwed up. Clients say name resolution error on any webpage, but I can dig www.google.com from the console just fine. Can't ping google or anything other than 8.8.8.8.
      Is there any known bugs that would cause this?
      Can't post details now, but I will.
      And I did try to unblock the private addresses on the WAN with no change.
      I'm thinking something just got hosed in the OS itself but I don't know what.
      Any ideas?

      1 Reply Last reply Reply Quote 0
      • J
        Jarhead
        last edited by

        Here's a few things I tried.

        "/etc/resolv.conf"
        nameserver 8.8.8.8
        nameserver 8.8.4.4
        search localdomain

        traceroute -nI 8.8.8.8
        traceroute to 8.8.8.8 (8.8.8.8), 64 hops max, 48 byte packets
        1 144.121.52.201 1.568 ms 1.450 ms 1.443 ms
        2 104.207.214.233 11.748 ms 8.506 ms 9.067 ms
        3 144.121.35.31 8.654 ms 8.679 ms 8.402 ms
        4 144.121.35.39 8.379 ms 8.459 ms 8.325 ms
        5 4.30.132.253 8.882 ms 8.857 ms 8.858 ms
        6 * * *
        7 72.14.213.34 8.776 ms 8.718 ms 8.712 ms
        8 108.170.248.97 8.706 ms 8.686 ms 8.733 ms
        9 209.85.245.195 8.813 ms 8.819 ms 8.813 ms
        10 8.8.8.8 9.320 ms 9.315 ms 9.329 ms

        ping www.google.com
        PING www.google.com (172.217.10.68): 56 data bytes
        ping: sendto: No route to host
        ping: sendto: No route to host
        ping: sendto: No route to host
        ping: sendto: No route to host
        ping: sendto: No route to host
        ping: sendto: No route to host

        Starting to wonder if it's my ISP.

        1 Reply Last reply Reply Quote 0
        • J
          Jarhead
          last edited by

          I can also VPN into the box but I keep getting disconnected.

          1 Reply Last reply Reply Quote 0
          • KOMK
            KOM
            last edited by

            Block rfc1918 only applies to unsolicited inbound traffic, not replies to your outbound traffic. Are your clients dynamic or static? From your client, if you try to resolve manually, does it work? For example:

            kom@kimono:~$ nslookup
            > server 10.10.4.1
            Default server: 10.10.4.1
            Address: 10.10.4.1#53
            > www.google.com
            Server:         10.10.4.1
            Address:        10.10.4.1#53
            
            Non-authoritative answer:
            Name:   www.google.com
            Address: 172.217.2.164
            Name:   www.google.com
            Address: 2607:f8b0:400b:80d::2004
            
            J 1 Reply Last reply Reply Quote 0
            • J
              Jarhead @KOM
              last edited by

              @kom said in Can't resolve names after blocking rfc1918:

              Block rfc1918 only applies to unsolicited inbound traffic, not replies to your outbound traffic.

              Yes, I know, that's why I don't understand why making that one changed caused this.
              Clients are both, can't resolve anything from any of them.
              I've since replaced the router with a spare I had and everything is working again.
              Something got screwed up in the config, kinda wish I can figure out what it is but I'll probably just reset it and see if it works again.

              1 Reply Last reply Reply Quote 0
              • First post
                Last post
              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.