-
-
Notifications
You must be signed in to change notification settings - Fork 492
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Unstable systemd-resolved with multiple DNS servers #1040
Comments
Im not sure where @gustavo-iniguez-goya is but ill try to help. From what I can tell its trying to resolve your main DNS server then using 1.1.1.1 when it fails or there could be malware logging your DNS requests to that localhost IP Either way this isnt a opensnitch problem And for securitys sake, please configure your router properly and use wireshark to insure your traffic isnt being leaked |
Looks to me like you are blocking some connections that PS: Why do you have both a LAN and external DNS? (If they supply conflicting answers you will have other problems also later.)
TIP: You can try https://gitlab.com/TriMoon/dnsdig to check your DNS responses... |
Hi all,
I had never seen this error before, but reviewing the logs I've realized that I have some. I usually allow systemd-resolved connect to a port, how did you create the rule for systemd-resolved? Do you also see any delay or error with nslookup or dig? They will query directly to the DNS servers without using systemd-resolved. |
Describe the bug
I realized that my DNS was unstable from my machine for a while when I was connected to my home network where my router advertised multiple DNS servers. I found out that my current DNS server was constantly switching due to the systemd-resolved rules defined in OpenSnitch.
Include the following information:
1.6.3-1
Arch Linux
KDE
Linux personal 6.4.12-arch1-1 #1 SMP PREEMPT_DYNAMIC Thu, 24 Aug 2023 00:38:14 +0000 x86_64 GNU/Linux
To Reproduce
First, I enabled the debug logs of systemd-resolved,
ends up in the
override.conf
viasudo systemctl edit systemd-resolved
.I observed that the DNS resolver was timing out, then it was forever switching to the alternative in the circular buffer. After I saw the host
detectportal.firefox.com
in the logs, I realized that OpenSnitch causes it.Screenshots
![Peek 2023-09-08 10-32](https://private-user-images.githubusercontent.com/25015317/266561569-674678ee-e765-4d4d-a783-dab08af295f5.gif?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQ4MDcwOTAsIm5iZiI6MTcyNDgwNjc5MCwicGF0aCI6Ii8yNTAxNTMxNy8yNjY1NjE1NjktNjc0Njc4ZWUtZTc2NS00ZDRkLWE3ODMtZGFiMDhhZjI5NWY1LmdpZj9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA4MjglMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwODI4VDAwNTk1MFomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTJmMTExMjU5OGZkODg3YTNkZTZkNTc2MGIyMjFlYmUxNWM3YmNkZDA0ZjBmOWQ0MzhiYmNiMDU3MzM4ZDAxNDImWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.3lnlyEXn539aHjZEvsL9mrPW91JghhDuKKn_exbUttw)
Additional context
Solutions I've found to remediate:
Disable OpenSnitch (duh!!!)
Disable any rules touching systemd-resolved (duh!!)
In the systemd-resolved, hard-code the current the DNS server (duh!)
I'm not sure if this can be considered a bug in the end, because that's how systemd-resolved works(?); however, it caused some trouble to me so I'd be happy if there's a better way to fix it.
The text was updated successfully, but these errors were encountered: