[SOLVED] dns is grabbed over dhcp instead of the hardcoded one

Bladtman242 · 2012-07-07 12:14:07

Hi, for some reason I'm using my ISP's dns, even though I've specified otherwise in wicd.
From what I can read, it might be that dhcpd is getting the addresses over dhcp and writing them to /etc/resolv.conf.
Any takes on what I can do about this?
Optimally, the settings in wicd should count, but I'll settle for configuring dhcp or resolv.conf if those are the options.

EDIT: I hope I'm posting in the right sub forum?

Last edited by Bladtman242 (2012-07-07 18:22:23)

stevepa · 2012-07-07 18:02:42

Bladtman242 wrote:

Hi, for some reason I'm using my ISP's dns, even though I've specified otherwise in wicd.
From what I can read, it might be that dhcpd is getting the addresses over dhcp and writing them to /etc/resolv.conf.
Any takes on what I can do about this?
Optimally, the settings in wicd should count, but I'll settle for configuring dhcp or resolv.conf if those are the options.
EDIT: I hope I'm posting in the right sub forum?

can you please post your /etc/rc.conf file in code tags?
thanks

Zancarius · 2012-07-07 18:03:47

Try removing "domain_name_servers" from the option declaration in /etc/dhcpcd.conf. If it's still getting overwritten, you can add your DNS servers manually to /etc/resolv.conf.tail or check the dhcpcd.conf manpage for the "static" option, e.g.:

static domain_name_servers=192.168.1.1

(This assumes you're running dhcpcd, of course.)

Last edited by Zancarius (2012-07-07 18:08:49)

Bladtman242 · 2012-07-07 18:22:00

Stevepa: resolv.conf just contained my ISP's name server adresses.
Zancarius: removing the domain_name_servers options did the trick.
Now wicd decides.

Thanks a lot, both of you

Bladtman242 · 2012-07-13 12:22:41

For completeness:
removing the option only helped until next reboot.
apparently the

domain_name_servers

requests the DNS addresses over dhcp, but removing the option does not prevent the addresses from being used when they are still supplied by the dhcp server.
In order to ignore them, even when they are supplied, use

noption domain_name_servers

At least that works for me

Last edited by Bladtman242 (2012-07-13 12:26:15)

Leonid.I · 2012-07-13 16:42:28

Bladtman242 wrote:

For completeness:
removing the option only helped until next reboot.
apparently the
domain_name_servers
requests the DNS addresses over dhcp, but removing the option does not prevent the addresses from being used when they are still supplied by the dhcp server.
In order to ignore them, even when they are supplied, use
noption domain_name_servers
At least that works for me

So... you want to prevent dhcpcd from overwriting /etc/resolv.conf, correct? Why not just add "nohook resolv.conf" to /etc/dhcpcd.conf. This way dhcpcd still will request all standard info from the router, but won't commit it to resolv.conf. From the manpage:

nohook script
             Don't run this hook script.  Matches full name, or prefixed with 2 numbers optionally ending with .sh.

             So to stop dhcpcd from touching your DNS or MTU settings you would do:-
                   nohook resolv.conf, mtu

Bladtman242 · 2012-07-13 18:06:11

What would the difference be exactly?

Zancarius · 2012-07-13 18:42:00

Removing domain_name_servers (or using noption) prevents it from pulling the info via DHCP.

Removing the hook via nohook is the cleaner solution because it prevents the hook that overwrites resolv.conf from running (but still receives the configuration from the DHCP server).

Bladtman242 · 2012-07-13 18:51:02

I see.
Is the information needed for something else, or why is it cleaner?
I'm not trying to argue, I just want to understand

Leonid.I · 2012-07-13 18:53:11

Exactly.

At some point I figured that using DNS from various public (like hotel) networks is not too secure. So I configured dhcpcd, put Google public DNS (you can use Comodo SecureDNS, OpenDNS -- depending on your bias toward security or speed) into resolv.conf, and made the entire / read-only. Another reason is this whole story about minimizing writes to /etc...

Although I use netcfg, I don't see why you have to set DNS from wicd as opposed to editing resolv.conf directly.

EDIT: With the "nooption... " way, dhcpcd still writes to /etc/resolv.conf. However, these writes are empty -- it simply overwrites the file with an empty one. When using "nohook..." dhcpcd does not touch resolv.conf at all. I'm on wifi ATM, but:

-bluemoon-13:15-~$ ll /etc/resolv.conf 
-rw-r--r-- 1 root root 59 Jan  3  2012 /etc/resolv.conf

note the timestamp... Hope this helps

Last edited by Leonid.I (2012-07-13 18:56:18)

Bladtman242 · 2012-07-13 20:16:07

What on gods green earth..
Even with noption, dhcpcd writes my isp's dns adresses into resolv.conf.
I'm trying nohook now.

Leonid.I: I'd like wicd to handle it because it allows for different profiles for different networks, without needing to change resolv.conf manually
Isn't it a bit strange that dhcpcd still overwrites resolv.conf with my ISP's adresses, when yours simply writes out an empty file?

Leonid.I · 2012-07-13 23:53:03

Bladtman242 wrote:

What on gods green earth..
Even with noption, dhcpcd writes my isp's dns adresses into resolv.conf.
I'm trying nohook now.

It is nooption with three o.

Bladtman242 wrote:

Leonid.I: I'd like wicd to handle it because it allows for different profiles for different networks, without needing to change resolv.conf manually
Isn't it a bit strange that dhcpcd still overwrites resolv.conf with my ISP's adresses, when yours simply writes out an empty file?

Why do you want to change DNS servers for different network? How do you decide which ones to use with a given network? A fixed set of nameservers will work just fine...

Bladtman242 · 2012-07-14 09:36:47

It is nooption with three o.

Ahh, I guess the missing 'o' would explain it.

Why do you want to change dns servers for different network? How do you decide which ones to use with a given network? A fixed set of nameservers will work just fine...

Well, like you said yourself; there are different reasons to choose different dns providers.
As I carry my laptop with me, my preferences might change for each network.
At home there are a couple of websites my isp blocks, so I use googles dns instead.
At campus that doesn't matter, but speed and security might.
At work I need to use the local dns, as they provide some local-only services.
I will admit I have not given it much thought. I just did a dns speed test at home and picked the fastest that did not block the sites I use.
Is there some reason I should not have different profiles for dns?
If its a small inconvenience to set up, and it obviates the need for manually editing resolv.conf all the time, it seems like a win/win

Leonid.I · 2012-07-14 18:27:51

I agree that editing resolv.conf all the time is a PITA But if you switch DNS depending on the network, wouldn't it be better to let the DHCP protocol to hadle that automatically? Or else, why this can't work:

nameserver x.x.x.x
nameserver x.x.y.y
...
nameserver 10.10.10.1

so the last nameserver will catch local services, no?

The issue of DNS security is a bit exaggerated IMHO: noone uses DNSSec, and the remaining attack vectors are hacked DNS servers (which is unlikely with google/comodo/your ISP) or router (more likely). The latter was my motivation to not use DNS servers provided by the DHCP.

The speed also depeds on many variables. Most public DNS servers cache, so "dig" is slow only 1st time, and then gives me 25-45 ms lookup time on all sites. ISP's DNS are different because they optimize -- microsoft.com will always load much faster than debian.org (for comcast it is 15ms vs ~170ms).

Bladtman242 · 2012-07-14 20:28:25

Or else, why this can't work:

I guess that would work
But now that it is set up, I still don't see why the profiles are a bad thing? Again, not really arguing, just trying to understand what I currently do not.

Using the dhcp-supplied dns is not an option because they are usually not the name servers I want to use.
ISP's are required by law to block certain pages on dns level here, but it is handled most unprofessionally.
A few weeks back they accidentally dumped 10.000 sites in the filter, including some of google's services. Unacceptable.

I realise the dns speed is hard to measure. But if I remember correctly, there was a notable difference when testing for some of the sites I frequent

EDIT: Just thought I'd add that circumventing the dns blocks is not illegal. So you're not helping me break the law or anything

Last edited by Bladtman242 (2012-07-14 21:10:20)

Arch Linux

#1 2012-07-07 12:14:07

[SOLVED] dns is grabbed over dhcp instead of the hardcoded one

#2 2012-07-07 18:02:42

Re: [SOLVED] dns is grabbed over dhcp instead of the hardcoded one

#3 2012-07-07 18:03:47

Re: [SOLVED] dns is grabbed over dhcp instead of the hardcoded one

#4 2012-07-07 18:22:00

Re: [SOLVED] dns is grabbed over dhcp instead of the hardcoded one

#5 2012-07-13 12:22:41

Re: [SOLVED] dns is grabbed over dhcp instead of the hardcoded one

#6 2012-07-13 16:42:28

Re: [SOLVED] dns is grabbed over dhcp instead of the hardcoded one

#7 2012-07-13 18:06:11

Re: [SOLVED] dns is grabbed over dhcp instead of the hardcoded one

#8 2012-07-13 18:42:00

Re: [SOLVED] dns is grabbed over dhcp instead of the hardcoded one

#9 2012-07-13 18:51:02

Re: [SOLVED] dns is grabbed over dhcp instead of the hardcoded one

#10 2012-07-13 18:53:11

Re: [SOLVED] dns is grabbed over dhcp instead of the hardcoded one

#11 2012-07-13 20:16:07

Re: [SOLVED] dns is grabbed over dhcp instead of the hardcoded one

#12 2012-07-13 23:53:03

Re: [SOLVED] dns is grabbed over dhcp instead of the hardcoded one

#13 2012-07-14 09:36:47

Re: [SOLVED] dns is grabbed over dhcp instead of the hardcoded one

#14 2012-07-14 18:27:51

Re: [SOLVED] dns is grabbed over dhcp instead of the hardcoded one

#15 2012-07-14 20:28:25

Re: [SOLVED] dns is grabbed over dhcp instead of the hardcoded one

Board footer