I'm having a small issue with dnsmsasq on debian-jessie, it seems to forward incoming DNS queries to 2 ports instead of 1.
Background:
Runs on a machine whose LAN IP is 192.168.0.10. Sits behind a home router. The home router is configured to forward DNS traffic to 192.168.0.10. That part works, I do see incoming traffic from the LAN onto this machine.
dnsmasq configuration:
>cat /etc/dnsmasq.conf | grep -v ^# | grep -v ^\s*$
domain-needed
bogus-priv
server=127.0.0.1#5053
cache-size=10000
My resolv.conf tells local processes to send DNS queries to dnsmasq
>cat /etc/resolv.conf
# Generated by resolvconf
nameserver 127.0.0.1
And dnsmasq, if it can't answer from its cache, then forwards incoming DNS traffic to another service running locally and listening on port 5053 via the server=127.0.0.1#5053 config. That service is something I build myself and it does not forward DNS queries to 8.8.8.8
This works but not the way I intended. DNS queries get answered properly. As expected, port 5053 shows traffic and even provides answers (though slower than GoogleDNS)
>tcpdump -l -n -i any '(port 5053) and (port 53)'
13:57:53.817522 IP 127.0.0.1.47207 > 127.0.0.1.53: 7494+ [1au] A? www.example.com. (44) # dnsmasq receives a query from `dig www.example.com` running locally
13:57:53.818609 IP 127.0.0.1.5258 > 127.0.0.1.5053: UDP, length 44 # dnsmasq forwards to local DNS Server listening on 5053
13:57:53.818970 IP 192.168.0.10.5258 > 8.8.8.8.53: 50849+ [1au] A? www.example.com. (44) # dnsmasq forwards to 8.8.8.8 on port 53 (Google DNS)
13:57:53.862170 IP 8.8.8.8.53 > 192.168.0.10.5258: 50849$ 1/0/1 A 93.184.216.34 (60) # dnsmasq receives answer from 8.8.8.8
13:57:53.862559 IP 127.0.0.1.53 > 127.0.0.1.47207: 7494 1/0/1 A 93.184.216.34 (60) # dnsmasq forwards answer to dig running locally
13:57:53.980238 IP 127.0.0.1.5053 > 127.0.0.1.5258: UDP, length 49 # dnsmasq receives answer from local DNS Server
So it appears dnsmasq tee's DNS queries to both
127.0.0.1 on port 5053, and almost immediately after also forwards to
8.8.8.8 on port 53
Why, what's wrong with my dnsmasq configuration, I expected traffic only on port 5053?
And where is that 8.8.8.8 coming from. Yes I know that's Google DNS, but where is dnsmasq or linux getting that IP from and which config file can I edit to change that?
>grep -r 8\.8\.8\.8 /etc/*.conf
returns nothing.
Related
I am using DNSMasq as a service on my network. The machine that has DNSMasq installed has two network cards. (the IP addresses are 192.168.1.5 and 192.168.1.6).
The issue I have run into is that I have a pod container running PiHole on the the same machine. When I reboot, PiHole fails to start because DNSMasq is using the ports required. PiHole is set to specifically use 192.168.1.6 (ports 80, 443, 52, 67). When I run # lsof - :67, I see that DNSMasq is listening to port 67 on both IP addresses when I have it specifically set to listen to only 192.168.1.5.
Is there another way to restrict DNSMasq to a single IP address (not loopback or localhost) and make it ignore a specific IP address (in this case, 192.168.1.6 is not touched by DNSMasq)?
Here is my /etc/dnsmasq.d/default.conf
no-resolv
no-poll
server=1.1.1.1
server=8.8.8.8
listen-address=192.168.1.5
interface=eno2
bind-interfaces
I am trying to run a coredns plugin https://github.com/coredns/demo that returns 1.1.1.1 for 172.0.0.0/8 or 127.0.0.0/8 and 8.8.8.8 for everything else.
I run the binary and try to make a request from dig using dig example.org #localhost -p1053 +short which returns 1.1.1.1 since the request is sent from localhost
Is there anyway I can send a request from dig to coredns that it might look like to the DNS server that it is sent from another IP and it will return 8.8.8.8 instead?
From dig manual:
-b address[#port]
Set the source IP address of the query. The address must be a valid address on one of the host's network interfaces, or "0.0.0.0" or "::". An optional port may be
specified by appending "#<port>"
Otherwise, if the server supports ECS (EDNS Client Subnet) you can use dig option +subnet=addr to give it to the server and see how its reply changes.
I set my linux as an access point, and then run simple web-server that print "hello world" at port 3000.
and connect it with my smart phone successfully.
in linux terminal, http://localhost:3000 works well.
But in smart phone,
If I access to http://172.24.1.105:3000, can't connect to it. (172.24... is ap's ip)
the chrome's error message is
This site can't be reached. 172.24.1.105 refused to connect
I searched Google (https://serverfault.com/questions/725262/what-causes-the-connection-refused-message) and I suspicious linux's firewall.
pi#raspberrypi:~/prj/ap_server $ sudo tcpdump -n icmp
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
... when I access to port 3000,
15:07:13.102750 IP 192.168.0.3 > 168.126.63.2: ICMP 192.168.0.3 udp port 42531 unreachable, length 386
the log is above. so I couldn't reach ap's webserver.
so I wonder two things...
1. How can I disable to its port block?
2. in tcpdump log, I access to port 3000 actually, why the log print port 42531?
Plus)
even I type sudo service iptables stop, the problem is not solved
sudo netstat -ntlp | grep 3000 logs:
**tcp6 0 0 :::3000 :::* LISTEN 1999/nodejs**
+I followed this tutorial-> https://frillip.com/using-your-raspberry-pi-3-as-a-wifi-access-point-with-hostapd/ .
and there is ipv4 setting.
If you want to run it on your mobile it will work on Live IP (externel) address
if it is working fine on local address (localhost) and not on live IP then
enable routing from your router
and allow that specific port it will work fine.
I found the issue.
my dhcp set was
interface=wlan0 # Use interface wlan0
listen-address=172.24.1.1 # Explicitly specify the address to listen on
bind-interfaces # Bind to the interface to make sure we aren't sending things elsewhere
server=8.8.8.8 # Forward DNS requests to Google DNS
domain-needed # Don't forward short names
bogus-priv # Never forward addresses in the non-routed address spaces.
dhcp-range=172.24.1.50,172.24.1.150,12h # Assign IP addresses between 172.24.1.50 and 172.24.1.150 with a 12 hour lease time
like above.
I tried to connect the external ip(172.24.1.105) that I can see on mobile continuously but got failed. but when I tried with 172.24.1.1, then success.
I don't know why. maybe there is accurate ip address and something in mobile is temporal.
See similar topic at Node JS not listening to port 1337 on server
Your web server is not listening remote address.
I have 2 local networks (2 offices connected with openvpn)
Network 1:
network 192.168.1.0/24
gateway 192.168.1.101
Network 2:
network 192.168.2.0/24
gateway 192.168.2.10
in network 192.168.1.0/24 I have 2 servers - 192.168.1.180 and 192.168.1.183
first run on Debian 6 and second one on Archlinux (yes, I know it is bad choice for servers). I have no firewall on the servers.
everything works fine, clients from 192.168.2.0 can connect to computers in 192.168.1.0 and back. Except one of servers - 192.168.1.180 (Archlinux). I can't connect to it and can't connect from it to any computer in 192.168.2.0. No ping, no traceroute.
output from 192.168.1.180:
route -n
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.1.101 0.0.0.0 UG 0 0 0 eth0
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
i run tcpdump on the gateway (192.168.1.101) and ping on 192.168.1.180 and get this:
tcpdump src 192.168.1.180
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
14:23:57.354061 arp who-has 172.19.155.1 tell 192.168.1.180
14:23:58.357354 arp who-has 172.19.155.1 tell 192.168.1.180
...
why it looks for 172.19.155.1? I don't know what this strange IP means. I have no networks like this, no GW, nothing.
if I run ping on all other computer (for example ping from 192.168.1.183) I get:
tcpdump icmp
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
14:29:36.834731 IP 192.168.1.183 > 192.168.2.10: ICMP echo request, id 3216, seq 1, length 64
14:29:36.956211 IP 192.168.2.10 > 192.168.1.183: ICMP echo reply, id 3216, seq 1, length 64
No one looks for this strange IP except 192.168.1.180. I cleaned arp table on 192.168.1.180 but nothing helps.
it looks like you have a default gw configuration exists on your server x.180/24 which points to 172.19.155.1. So, the server assumes all the traffic has to go via 172.19.155.1 and trying to resolve the gw. Look for a default gw configuration in your system, something like this
0.0.0.0 0.0.0.0 172.19.155.1
use ip route xxx
You are able to see the packets in x.101/24 because it is an ARP request, which is broadcast MAC and you will see it on all directly connected devices.
Things I would do/check:
Make absolutely sure that I don't have a second interface going somewhere (ifconfig -a should do it)
I know, it's unlikely... but any chance a routing protocol is enabled on that server? You would see the routes in your routing table, though... which I understand is not the case.
Run a grep on /etc and wherever you have config files for 172.19.55.1
Just my 2c.
I've solved the problem. Not really solved, but at least it works now. The server must work 24/7 but it was my last chance and I rebooted it )) All work was stopped for 30 min but it was worthy of it.
I really don't understand wat happened with it. Some mystic problem.
I am creating GRE Tunnel between two Linux (CentOS6) servers using below steps.
On the master server:
chkconfig iptables off
service iptables stop
sysctl -w net.ipv4.conf.default.rp_filter=0
modprobe ip_gre
ip tunnel add tun1 mode gre remote 98.123.87.97 local 106.61.58.98 ttl 255
ip addr add 10.0.1.0/24 dev tun1
ip link set dev tun1 up
ip addr add 98.123.87.95/27 dev eth0
On the slave server:
chkconfig iptables off
service iptables stop
sysctl -w net.ipv4.ip_forward=1
sysctl -w net.ipv4.conf.all.forwarding=1
sysctl -w net.ipv4.conf.proxy_arp=1
sysctl -w net.ipv4.conf.all.proxy_arp=1
sysctl -w net.ipv4.conf.eth0.rp_filter=0
sysctl -w net.ipv4.conf.default.rp_filter=0
modprobe ip_gre
ip tunnel add tunx mode gre remote 106.61.58.98 local 98.123.87.97 ttl 255
ip addr add 10.0.2.0/24 dev tun0
ip link set tunx up
ip route add 98.123.87.95/27 dev tun0
I need to add slave server's IP into the on my master server, I am getting the ping response form tunnelled IPs (Slave Server's IP) and when I am trying to SSH the tunnelled IP (Slave IP) I am reaching to Masters(this is what I want).
Problem is when I am trying to send outgoing traffic like DNS query by Tunnelled IP(Slave IP) I am getting time out request.
I guess this is routing issue of one of my server. Any idea what should i do to get through my outgoing traffic by tunnelled IPs?
Thanks,
Are you really adding 10.0.1.0/24 address? This is a network address, looks like mistake.
Also, you shuold add default route(or route to dns servers or whatever you want) on client machine through your tunnel with gateway=another_end_of_tunnel.
Don't forget to add static route to your machine if you don't want to loose connection, before adding default route!