onderwerp Re: DNS resolution issue, possible filtering? in Archief

DNS resolution issue, possible filtering?

alex91 — Thu, 26 Jan 2023 21:21:45 GMT

Hello!

I recently faced with a weird DNS resolution issue. It seemed to start after I switched from an old white cable modem to a new black one, but I'm not entirely sure.

My employer has some publicly hosted DNS records that point to their internal network IPs, that I use when connect to VPN. For example, backlog.semrush.net which resolves to 10.101.3.2 (https://who.is/dns/backlog.semrush.net). When I try to resolve it from my home network, I get this

$ nslookup backlog.semrush.net
;; connection timed out; no servers could be reached

When I use any other internet connection (cellphone wifi hotspot, for example), it works fine

$ nslookup backlog.semrush.net
Server: 8.8.8.8
Address: 8.8.8.8#53

Non-authoritative answer:
Name: backlog.semrush.net
Address: 10.101.3.2

All other domain names resolve fine as well (and the internet connection in general does not have problems). The issue seems to be just with DNS records that point to private networks (10.0.0.0/8).

The DNS servers I use seem to be irrelevant. I tried a dozen (ISP-assigned, 8.8.8.8, 1.1.1.1, 9.9.9.9, and bunch of more obscure ones) but none seem to work.

This used to work before, the only change I made is replaced the modem.

Re: DNS resolution issue, possible filtering?

tt14111 — Thu, 26 Jan 2023 22:25:43 GMT

DNS rebind protection may cause this behavior. However, this is usually configured on a DNS forwarder within the LAN, while Ziggo's modem routers distribute public DNS server by DHCP. Also, setting up DNS servers on the local host would circumvent this protection.

Does disabling the eRouter firewall on the modem (temporarily!) make a difference? Firewall settings may be altered on the Advanced settings, Security, Firewall page after logging in to the modem's web interface at 192.168.178.1.

I just attempted resolving the domain on both my PC behind my Ziggo connection (UBC1318ZG in bridge mode + ER-4 w/ dnsmasq, round-robin forwarding to 1.1.1.1 and 8.8.8.8) and an access point behind the Ziggo connection at a different location (via SSH, CH7465LG-ZG in router mode, 'Firewall protection' only, access point statically configured to use 1.1.1.1 and 8.8.8.8). No nslookup issues in both cases.

Re: DNS resolution issue, possible filtering?

Karel. — Fri, 27 Jan 2023 10:09:27 GMT

I have a FRITZ!Box 6690 cable as modem/router and a Pihole localy setup as a recusive DNS server. I tried your problem, DNS servers like 1.1.1.1 and 8.8.8.8 can resolve but my Pihole can’t.

pi@Raspi3B:~ $ nslookup backlog.semrush.net 1.1.1.1
Server: 1.1.1.1
Address: 1.1.1.1#53

Non-authoritative answer:
Name: backlog.semrush.net
Address: 10.101.3.2

pi@Raspi3B:~ $ nslookup backlog.semrush.net 2606:4700:4700::1111
Server: 2606:4700:4700::1111
Address: 2606:4700:4700::1111#53

Non-authoritative answer:
Name: backlog.semrush.net
Address: 10.101.3.2

pi@Raspi3B:~ $ nslookup backlog.semrush.net 192.168.178.152
Server: 192.168.178.152
Address: 192.168.178.152#53

Non-authoritative answer:
*** Can't find backlog.semrush.net: No answer

pi@Raspi3B:~ $ nslookup backlog.semrush.net
Server: fd00::c390:9896:edce:7a54
Address: fd00::c390:9896:edce:7a54#53

Non-authoritative answer:
*** Can't find backlog.semrush.net: No answer

Results on ziggo DNS servers:

pi@Raspi3B:~ $ nslookup backlog.semrush.net 84.116.46.22
Server: 84.116.46.22
Address: 84.116.46.22#53

Non-authoritative answer:
Name: backlog.semrush.net
Address: 10.101.3.2

pi@Raspi3B:~ $ nslookup backlog.semrush.net 84.116.46.23
Server: 84.116.46.23
Address: 84.116.46.23#53

Non-authoritative answer:
Name: backlog.semrush.net
Address: 10.101.3.2

Re: DNS resolution issue, possible filtering?

efok — Fri, 27 Jan 2023 19:04:27 GMT

This is the second case reporting this.
https://community.ziggo.nl/t5/Internet/Resolven-interne-IP-adressen-werkt-niet/m-p/1124703#M191588

I think it needs further investigation. I’ll have a look when I’m at home.

Re: DNS resolution issue, possible filtering?

efok — Fri, 27 Jan 2023 20:38:53 GMT

It resolves fine with the Ziggo DNS servers used by my router (with bridged ubee1318)

Re: DNS resolution issue, possible filtering?

S4R — Fri, 27 Jan 2023 20:50:34 GMT

1318ZG in Bridge

172.16.10.41 is Pi-Hole met Unbound

172.16.10.43 is Adguard

Re: DNS resolution issue, possible filtering?

Karel. — Sat, 28 Jan 2023 09:23:12 GMT

If i commented out private-address: 10.0.0.0/8 in /etc/unbound/unbound.conf.d/pi-hole.conf and by-passes unbound DNS rebind protection then my Pi-hole resolves fine. The issue looks like to caused by the new modem of topic starter.

Re: DNS resolution issue, possible filtering?

alex91 — Sat, 28 Jan 2023 14:37:53 GMT

Thank you all for the suggestions, I appreciate your help!

@tt14111Disabling firewall protection in the modem didn't change anything, unfortunately. It was enabled in the old modem and that didn't cause problems.

@efokyes, that other user seems to have exactly the same problem as I do. I asked a couple of my coworkers who use Ziggo at home, and people with black Sagem modems have the same issue as well.

For now as a workaround I put the domains I use in my local /etc/hosts, but it's not very convenient because our IT-department may move stuff around and change IP addresses without notifying us (well, that's what DNS is for, when it works).

I guess the next thing I try is to setup a local DNS server on my RaspberryPi. But I doubt it would work without encrypting outgoing connections.

Re: DNS resolution issue, possible filtering?

mvgijssel — Wed, 22 Feb 2023 14:00:14 GMT

Running into the exact same issue where the DNS resolution of private IP addresses is timing out. Documented all the steps I took to debug this here https://github.com/mvgijssel/setup/issues/168. It could be dns rebind protection or hairpinning, but it started happening when we got the Sagemcom F3896LG modem.

Re: DNS resolution issue, possible filtering?

tt14111 — Wed, 22 Feb 2023 14:06:22 GMT

@mvgijssel Since you are using your own router (USG), having the modem configured in bridge mode (by filling out this form, for example) should resolve this issue. Using bridge mode is recommended any way when using a separate router.

Re: DNS resolution issue, possible filtering?

mvgijssel — Wed, 22 Feb 2023 14:11:09 GMT

Thanks for the quick reply @tt14111! I thought I already had that setup, nevertheless I'll submit the form and see if this makes a difference and post back here!

Re: DNS resolution issue, possible filtering?

tt14111 — Wed, 22 Feb 2023 14:13:33 GMT

The screenshots posted to your GitHub issue indicate that the modem is in router mode.

Re: DNS resolution issue, possible filtering?

mvgijssel — Wed, 22 Feb 2023 14:17:17 GMT

Ah sweet, then hopefully this change will fix it! Submitted the request for bridge mode, eagerly awaiting what will happen. For now I can stop pulling my hair out 🤣

Re: DNS resolution issue, possible filtering?

mvgijssel — Wed, 22 Feb 2023 16:29:35 GMT

Works! Setting the modem in bridge mode now enables me to ping dns names containing private IPs like `lvh.me`! Thanks for all the help @tt14111! ❤️

Re: DNS resolution issue, possible filtering?

Lgrossi — Wed, 01 Nov 2023 19:17:52 GMT

I'm facing exactly the same issue, but putting the domains statically in /etc/hosts is not an option. Is there any alternative to fix this problem other than buying my own router and setting it in bridge mode?

Re: DNS resolution issue, possible filtering?

tt14111 — Wed, 01 Nov 2023 19:24:12 GMT

No other alternative/workaround known at this time.

Re: DNS resolution issue, possible filtering?

Patsie — Mon, 06 Nov 2023 12:48:38 GMT

I seem to have the exact same issue as the Opening Poster. Employer is running DNS with resolving to private space IP addresses (10.x.x.x) which are used over VPN.

Since fairly recently I have been upgraded from the white modem to the black Sagemcom one and eversince I have issues resolving time-out. This is true when using my default setup where resolving goes to the IPv6 addresses of our resolvers. When I try the exact same lookup via the IPv4 address of the resolvers, then it works just fine.

patsie@HX90G:~$ dig +short +tcp ziggo1.patsie.nl @213.193.210.2
10.1.2.3
patsie@HX90G:~$ dig +short +tcp ziggo2.patsie.nl @213.193.210.2
87.1.2.3
patsie@HX90G:~$ dig +short +tcp ziggo1.patsie.nl @2001:9a8:0:10::2
;; communications error to 2001:9a8:0:10::2#53: timed out
;; communications error to 2001:9a8:0:10::2#53: timed out
;; communications error to 2001:9a8:0:10::2#53: timed out
;; no servers could be reached

patsie@HX90G:~$ dig +short +tcp ziggo2.patsie.nl @2001:9a8:0:10::2
87.1.2.3

Capturing the traffic shows that a Standard Query is being sent, but no response is sent back and after 1.5secs the DNS server closes the connection (TCP FIN)
(screenshot attached, pcap file doesn't seem to be allowed by the upload filter of this forum 😞 )

Can this DNS Rebinding Defence be turned off in the Sagemcom modem, or is this something only Ziggo kan do, somewhere on their network?

Re: DNS resolution issue, possible filtering?

hvhvnet — Mon, 06 Nov 2023 13:19:28 GMT

I had dit probleem ook. (DNS rebind protection in Sagemcom modem)

Was opgelost door modem in bridge mode te laten zetten.

zie: https://community.ziggo.nl/t5/Internet/Sagemcom-ziggo-blockt-DNS-replies-met-adressen-lokale-ip-ranges/m-p/1281766#M250788

Re: DNS resolution issue, possible filtering?

Patsie — Tue, 07 Nov 2023 14:16:29 GMT

Since I don't want to have more and more devices in the livingroom, I decided to start using DNS over TLS. The Sagemcom doesn't seem to be able to inspect the traffic anymore and just let is pass right on through.

A simple guide for systems using Systemd (like Ubuntu) can be found here -> https://medium.com/@jawadalkassim/enable-dns-over-tls-in-linux-using-systemd-b03e44448c1c

Re: DNS resolution issue, possible filtering?

Illarion Borts — Wed, 22 Nov 2023 15:44:09 GMT

+1 also experiencing this problem