Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 2 subscribers
  • Views 1225 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

[9.104.17] Weird DNS issue

wingman
Hi All

I am facing a weird DNS issue. I am connecting via PPPoE to my ISP and instead of using their DNS I am using opendns (attached). However, the DNS proxy seems to be trying to resolve via other dns servers

2013:08:21-00:17:23 ****** named[974]: error (unexpected RCODE REFUSED) resolving '67.10.203.183.in-addr.arpa/PTR/IN': 211.136.20.201#53
2013:08:21-00:17:23 ****** named[974]: error (unexpected RCODE REFUSED) resolving '67.10.203.183.in-addr.arpa/PTR/IN': 211.136.17.105#53
2013:08:21-00:32:19 ****** named[974]: error (unexpected RCODE REFUSED) resolving '67.10.203.183.in-addr.arpa/PTR/IN': 211.136.20.201#53
2013:08:21-00:32:19 ****** named[974]: error (unexpected RCODE REFUSED) resolving '67.10.203.183.in-addr.arpa/PTR/IN': 211.136.17.105#53
2013:08:21-00:47:27 ****** named[974]: error (unexpected RCODE REFUSED) resolving '67.10.203.183.in-addr.arpa/PTR/IN': 211.136.17.105#53
2013:08:21-00:47:28 ****** named[974]: error (unexpected RCODE REFUSED) resolving '67.10.203.183.in-addr.arpa/PTR/IN': 211.136.20.201#53
2013:08:21-01:02:31 ****** named[974]: error (unexpected RCODE REFUSED) resolving '67.10.203.183.in-addr.arpa/PTR/IN': 211.136.17.105#53
2013:08:21-01:02:31 ****** named[974]: error (unexpected RCODE REFUSED) resolving '67.10.203.183.in-addr.arpa/PTR/IN': 211.136.20.201#53


DNS above are:
ns.cnmobile.net (211.136.17.105)
ns2.cnmobile.net (211.136.20.201)

Also I can't find host "183.203.10.67" defined anywhere on my UTM (183.203.10.67 is in china -db-ip.com/183.203.10.67)

I am also getting the relevant messages in the System log which I guess is because of the errors above

2013:08:21-00:18:22 ****** dns-resolver[4234]: DNS server failed to contact!
2013:08:21-00:19:03 ****** dns-resolver[4234]: DNS server failed to contact!


performing a iftop I can't see any strange DNS request to port 53 (internally they all go to my UTM as they should have).

filter I am using is: iftop -i ethx -n -P -f "dst port 53 || src port 53"


This thread was automatically locked due to age.
Parents
  • 0
    Hey Wingman,

    That looks like the UTM is doing a reverse lookup on the IP's. It's trying to see if there's a DNS name attached to that IP, probably for reporting.
  • 0 in reply to TheDrew
    Hey Wingman,

    That looks like the UTM is doing a reverse lookup on the IP's. It's trying to see if there's a DNS name attached to that IP, probably for reporting.


    But it should have used the openDNS and not random ones right? Also I am not able to find the relevant ip to any of the reports
Reply
  • 0 in reply to TheDrew
    Hey Wingman,

    That looks like the UTM is doing a reverse lookup on the IP's. It's trying to see if there's a DNS name attached to that IP, probably for reporting.


    But it should have used the openDNS and not random ones right? Also I am not able to find the relevant ip to any of the reports
Children
No Data