[SOLVED]Can't resolve certain domain names

jacopastorius · 2019-01-07 16:34:58

Hi all. I am facing a strange issue: firefox on linux can't load certain websites. One of them is internet banking and some other random sites like this https://sx.xecuter.com/

I tried to set google DNS but the problem still persist.

Thank you for your help

EDIT:
Solution in post #17:
"Try removing 192.168.1.1 from resolve.conf or placing it last."

Last edited by jacopastorius (2019-01-08 09:17:38)

Trilby · 2019-01-07 16:43:28

Are you using any ad blocking or related plugins? Have you tried other browsers and/or curl? If curl fails, please post the error it generates.

Also, what are the actual symptoms in firefox? Do you get an error page, or just no/slow loading?

Last edited by Trilby (2019-01-07 16:43:55)

jacopastorius · 2019-01-07 17:07:15

I am using Ad Block plus but trying to disable it does not fix. I also tried other browser such as chromium with no luck. Din't tried curl.
Firefox shows the "unable to connect" page like happens when you're not connected to the internet

Trilby · 2019-01-07 17:10:05

jacopastorius wrote:

Din't tried curl.

Please do so. While you are at it, try pinging the host. You may want to revise your title too as this isn't specific to firefox.

Are you behind any firewall (corporate or university, etc)?

Last edited by Trilby (2019-01-07 17:31:13)

jacopastorius · 2019-01-07 17:20:23

I am not behind firewalls. Would you please explain how use curl? Never did it, sorry

loqs · 2019-01-07 17:29:13

`man curl` `curl --help`

Trilby · 2019-01-07 17:30:06

The simplest would be the following:

curl https://sx.xecuter.com/

If that spits out a bunch of html code, (with some javascript at the bottom) then it would appear to have worked. If it doesn't, any error message it produces would be informative. Assuming it fails, add the -I flag and/or -v flag may be useful:

curl -Iv https://sx.xecuter.com/

Ping is just ping:

ping sx.xecuter.com

jacopastorius · 2019-01-07 17:32:25

Thank you Trilby.

[du@du ~]$ curl https://sx.xecuter.com/
curl: (7) Failed to connect to sx.xecuter.com port 443: Connection refused

[du@du ~]$ ping sx.xecuter.com
PING sx.xecuter.com (127.0.0.1) 56(84) bytes of data.
64 bytes from localhost (127.0.0.1): icmp_seq=1 ttl=64 time=0.023 ms
64 bytes from localhost (127.0.0.1): icmp_seq=2 ttl=64 time=0.046 ms
64 bytes from localhost (127.0.0.1): icmp_seq=3 ttl=64 time=0.051 ms
64 bytes from localhost (127.0.0.1): icmp_seq=4 ttl=64 time=0.045 ms

Last edited by jacopastorius (2019-01-07 17:32:52)

loqs · 2019-01-07 17:35:15

What is the output of

curl -v https://sx.xecuter.com/ -o /dev/null

Trilby · 2019-01-07 17:38:17

Long shot, but by any chance are all the sites that are failing https?

seth · 2019-01-07 17:39:16

[du@du ~]$ ping sx.xecuter.com
PING sx.xecuter.com (127.0.0.1) 56(84) bytes of data.

DNS.
Post th outputs of

dig sx.xecuter.com
dig @8.8.8.8 sx.xecuter.com
cat /etc/resolve.conf
cat /etc/nsswitch.conf
ps aux | grep resolve

jacopastorius · 2019-01-07 17:51:57

loqs wrote:

What is the output of
curl -v https://sx.xecuter.com/ -o /dev/null

[du@du ~]$ curl -v https://sx.xecuter.com/ -o /dev/null
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying 127.0.0.1...
* TCP_NODELAY set
* connect to 127.0.0.1 port 443 failed: Connection refused
* Failed to connect to sx.xecuter.com port 443: Connection refused
* Closing connection 0
curl: (7) Failed to connect to sx.xecuter.com port 443: Connection refused

Until now i found just two sites that does not work and both are https

du@du ~]$ dig sx.xecuter.com

; <<>> DiG 9.13.5 <<>> sx.xecuter.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31574
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;sx.xecuter.com.                        IN      A

;; ANSWER SECTION:
sx.xecuter.com.         801     IN      A       127.0.0.1

;; Query time: 1 msec
;; SERVER: 192.168.1.1#53(192.168.1.1)
;; WHEN: Mon Jan 07 18:52:51 CET 2019
;; MSG SIZE  rcvd: 48

[du@du ~]$ dig @8.8.8.8 sx.xecuter.com

; <<>> DiG 9.13.5 <<>> @8.8.8.8 sx.xecuter.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49009
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;sx.xecuter.com.                        IN      A

;; ANSWER SECTION:
sx.xecuter.com.         161     IN      A       104.27.131.246
sx.xecuter.com.         161     IN      A       104.27.130.246

;; Query time: 30 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Mon Jan 07 18:53:39 CET 2019
;; MSG SIZE  rcvd: 75

[du@du ~]$ cat /etc/resolv.conf
# Generated by NetworkManager
search homenet.telecomitalia.it
nameserver 192.168.1.1
nameserver 8.8.4.4
nameserver 8.8.8.8

[du@du ~]$ cat /etc/nsswitch.conf
# Name Service Switch configuration file.
# See nsswitch.conf(5) for details.

passwd: files mymachines systemd
group: files mymachines systemd
shadow: files

publickey: files

hosts: files mymachines myhostname resolve [!UNAVAIL=return] dns
networks: files

protocols: files
services: files
ethers: files
rpc: files

netgroup: files

[du@du ~]$ ps aux | grep resolve
du        2951  0.0  0.0   8052   860 pts/1    S+   18:55   0:00 grep resolve

Last edited by jacopastorius (2019-01-07 17:55:46)

Trilby · 2019-01-07 17:54:23

OOPS! See seth's post. I completely missed the IP in the output from ping.

loqs · 2019-01-07 18:01:41

You added the google DNS servers but after nameserver 192.168.1.1 which is replying that 127.0.0.1 which is the loopback address of your machine is the address of the domain name.

jacopastorius · 2019-01-07 18:05:59

loqs wrote:

You added the google DNS servers but after nameserver 192.168.1.1 which is replying that 127.0.0.1 which is the loopback address of your machine is the address of the domain name.

i am sorry but i think i can't get your answer. Are you saying that it is pinging my localhost?

Last edited by jacopastorius (2019-01-07 18:09:22)

Trilby · 2019-01-07 18:12:02

Yes, it is, that's what 127.0.0.1 is (that's a local IP address, basically on any machine that points to the machine itself).

loqs · 2019-01-07 18:12:07

cat /etc/resolv.conf
# Generated by NetworkManager
search homenet.telecomitalia.it
nameserver 192.168.1.1
nameserver 8.8.4.4
nameserver 8.8.8.8

The first entry is 192.168.1.1 which is why in the following

dig sx.xecuter.com

; <<>> DiG 9.13.5 <<>> sx.xecuter.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31574
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;sx.xecuter.com.                        IN      A

;; ANSWER SECTION:
sx.xecuter.com.         801     IN      A       127.0.0.1

;; Query time: 1 msec
;; SERVER: 192.168.1.1#53(192.168.1.1)
;; WHEN: Mon Jan 07 18:52:51 CET 2019
;; MSG SIZE  rcvd: 48

dig first queried 192.168.1.1 and received the response that sx.xecuter.com has the address 127.0.0.1. So the google DNS servers are not used as an answer has been found.
The address 127.0.0.1 is defined as being the loopback address your machine. curl / firefox are doing the same asking 192.168.1.1 and getting the address 127.0.0.1 back.
Edit:
Try removing 192.168.1.1 from resolve.conf or placing it last.
Edit2:
If you could not touch resolv.conf (which in this case you can) another option would be DNS over HTTPS e.g. `curl -v https://sx.xecuter.com/ --doh-url https://cloudflare-dns.com/dns-query -o /dev/null`

Last edited by loqs (2019-01-07 18:16:36)

jacopastorius · 2019-01-07 18:27:34

Thank you very much loqs. Moving gateway address to the end of resolv.conf fixed my issue. I'd like to understand what was happening, let's see if i am correct (sorry i am trying to explain with very not specific terms):

1. My machine was asking for connection in internet
2. /etc/resolv.conf is checked for DNS
3. 192.168.1.1 is found as the beginning of that file and being my machine connected to that gateway my localhost is found but obviously cannot give to the initial query any answer.

progandy · 2019-01-07 18:44:01

3.: 192.168.1.1 is found at the beginning of the file, so it is used for DNS queries. It being the gateway is irrelevant, only that it responds to a request.

192.168.1.1 most likely is your router and requests a DNS server IP from your internet provider and uses that to resolve all requests. ISPs are notorious for doing funky things with DNS requests like filtering, blacklisting, redirecting non-existing domains to a search engine or advertisements, ...

You can try to set custom dns servers in your router/gateway.

jacopastorius · 2019-01-07 19:08:54

progandy wrote:

3.: 192.168.1.1 is found at the beginning of the file, so it is used for DNS queries. It being the gateway is irrelevant, only that it responds to a request.
192.168.1.1 most likely is your router and requests a DNS server IP from your internet provider and uses that to resolve all requests. ISPs are notorious for doing funky things with DNS requests like filtering, blacklisting, redirecting non-existing domains to a search engine or advertisements, ...
You can try to set custom dns servers in your router/gateway.

ok, but i can't understand why i ping to a website and it try to resolv to my local hostname

Trilby · 2019-01-07 19:34:31

It doesn't resolve to your local host name, it resolves to a generic IP address of 127.0.0.1. That IP address is not really for your machine, but rather is more like 'self': every machine points to itself (or the lo device specifically) at IP 127.0.0.1.

So basically your DNS is telling you to 'go browse yourself' when you try to connect to sx.xecuter.com.

EDIT: ah, the ping output does say "localhost" but that is after the fact. You try to ping sx.xecuter.com, your DNS says (incorrectly) that that's at 127.0.0.1, ping follows up by trying to connect to 127.0.0.1, the lo device replies with it's identity as "localhost" and that's what ping prints on the screen. You should be able to ping sx.xecuter.com directly with their actual IP address:

ping 104.27.131.246

You could also put that IP address directly into your browser bar and you'd view the site correctly (notwithstanding the https redirect, so use https://104.27.131.26 in your browser and it should work). EDIT 2: scratch that - it could work in theory, but that host doesn't respond to direct IP access.

Last edited by Trilby (2019-01-07 19:40:24)

loqs · 2019-01-07 20:12:14

The site needs SNI to know what certificate to serve `curl -v -o /dev/null --resolve sx.xecuter.com:443:104.27.130.26 https://sx.xecuter.com`

jacopastorius · 2019-01-07 23:06:57

Thank you very much for your explanations. But still I can't get the reason why my machine resolves to "itselfs" instead of dns

loqs · 2019-01-07 23:17:42

cat /etc/resolv.conf
# Generated by NetworkManager
search homenet.telecomitalia.it
nameserver 192.168.1.1
nameserver 8.8.4.4
nameserver 8.8.8.8

That resolve.conf as the comment notes is generated by NetworkManager and the first nameserver in that resolv.conf is returning the bad results.
In order to resolve the issue you need to stop using that nameserver or stop that nameserver from providing bad results.
Is NetworkManager obtaing the list of domain name servers with its DHCP lease from the router or something else?

jacopastorius · 2019-01-07 23:22:23

loqs wrote:

cat /etc/resolv.conf
# Generated by NetworkManager
search homenet.telecomitalia.it
nameserver 192.168.1.1
nameserver 8.8.4.4
nameserver 8.8.8.8
That resolve.conf as the comment notes is generated by NetworkManager and the first nameserver in that resolv.conf is returning the bad results.
In order to resolve the issue you need to stop using that nameserver or stop that nameserver from providing bad results.
Is NetworkManager obtaing the list of domain name servers with its DHCP lease from the router or something else?

I have a modem provided by ISP and a router connected to it to expand Wi-Fi range. Reading that line "homenet.telecomitalia.net let me think network manager takes the list of domain name and DHCP from that modem. May be I have to delete that line and set Google public DNS in that modem?

Last edited by jacopastorius (2019-01-07 23:24:03)

Arch Linux

#1 2019-01-07 16:34:58

[SOLVED]Can't resolve certain domain names

#2 2019-01-07 16:43:28

Re: [SOLVED]Can't resolve certain domain names

#3 2019-01-07 17:07:15

Re: [SOLVED]Can't resolve certain domain names

#4 2019-01-07 17:10:05

Re: [SOLVED]Can't resolve certain domain names

#5 2019-01-07 17:20:23

Re: [SOLVED]Can't resolve certain domain names

#6 2019-01-07 17:29:13

Re: [SOLVED]Can't resolve certain domain names

#7 2019-01-07 17:30:06

Re: [SOLVED]Can't resolve certain domain names

#8 2019-01-07 17:32:25

Re: [SOLVED]Can't resolve certain domain names

#9 2019-01-07 17:35:15

Re: [SOLVED]Can't resolve certain domain names

#10 2019-01-07 17:38:17

Re: [SOLVED]Can't resolve certain domain names

#11 2019-01-07 17:39:16

Re: [SOLVED]Can't resolve certain domain names

#12 2019-01-07 17:51:57

Re: [SOLVED]Can't resolve certain domain names

#13 2019-01-07 17:54:23

Re: [SOLVED]Can't resolve certain domain names

#14 2019-01-07 18:01:41

Re: [SOLVED]Can't resolve certain domain names

#15 2019-01-07 18:05:59

Re: [SOLVED]Can't resolve certain domain names

#16 2019-01-07 18:12:02

Re: [SOLVED]Can't resolve certain domain names

#17 2019-01-07 18:12:07

Re: [SOLVED]Can't resolve certain domain names

#18 2019-01-07 18:27:34

Re: [SOLVED]Can't resolve certain domain names

#19 2019-01-07 18:44:01

Re: [SOLVED]Can't resolve certain domain names

#20 2019-01-07 19:08:54

Re: [SOLVED]Can't resolve certain domain names

#21 2019-01-07 19:34:31

Re: [SOLVED]Can't resolve certain domain names

#22 2019-01-07 20:12:14

Re: [SOLVED]Can't resolve certain domain names

#23 2019-01-07 23:06:57

Re: [SOLVED]Can't resolve certain domain names

#24 2019-01-07 23:17:42

Re: [SOLVED]Can't resolve certain domain names

#25 2019-01-07 23:22:23

Re: [SOLVED]Can't resolve certain domain names

Board footer