Solved Not resolving domains from jails, but networking seems fine

gessel

gessel

I can # ping 8.8.8.8 (or any other IP), but not www.google.com. I can dig, drill, or nslookup and get the expected results. I can't fetch ports (lookup failures). Strange.

Code: 
# ping www.google.com
ping: cannot resolve www.google.com: Host name lookup failure

Code: 
# ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: icmp_seq=0 ttl=53 time=75.661 ms
64 bytes from 8.8.8.8: icmp_seq=1 ttl=53 time=206.993 ms

Code: 
# nslookup www.google.com
Server: 8.8.8.8
Address: 8.8.8.8#53

Non-authoritative answer:
Name: www.google.com
Address: 216.58.192.36

Code: 
# drill www.google.com
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 7581
;; flags: qr rd ra ; QUERY: 1, ANSWER: 15, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;; www.google.com. IN A

;; ANSWER SECTION:
www.google.com. 170 IN A 50.0.2.241
www.google.com. 170 IN A 50.0.2.219
www.google.com. 170 IN A 50.0.2.222
www.google.com. 170 IN A 50.0.2.230
www.google.com. 170 IN A 50.0.2.249
www.google.com. 170 IN A 50.0.2.236
www.google.com. 170 IN A 50.0.2.215
www.google.com. 170 IN A 50.0.2.245
www.google.com. 170 IN A 50.0.2.251
www.google.com. 170 IN A 50.0.2.221
www.google.com. 170 IN A 50.0.2.226
www.google.com. 170 IN A 50.0.2.237
www.google.com. 170 IN A 50.0.2.211
www.google.com. 170 IN A 50.0.2.234
www.google.com. 170 IN A 50.0.2.207

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 0 msec
;; SERVER: 10.3.69.133
;; WHEN: Tue Dec 15 01:08:57 2015
;; MSG SIZE rcvd: 272

Code: 
drill @8.8.8.8 www.google.com
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 14634
;; flags: qr rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;; www.google.com. IN A

;; ANSWER SECTION:
www.google.com. 239 IN A 216.58.192.36

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 27 msec
;; SERVER: 8.8.8.8
;; WHEN: Tue Dec 15 01:09:22 2015
;; MSG SIZE rcvd: 48


Code: 
# less /etc/resolv.conf
search mydomain.com
nameserver 8.8.8.8
nameserver 10.3.69.133
nameserver 208.201.224.11

Code: 
# portsnap fetch update
Looking up portsnap.FreeBSD.org mirrors... 7 mirrors found.
Fetching public key from isc.portsnap.freebsd.org... failed.
Fetching public key from your-org.portsnap.freebsd.org... failed.
Fetching public key from sourcefire.portsnap.freebsd.org... failed.
Fetching public key from ec2-eu-west-1.portsnap.freebsd.org... failed.
Fetching public key from ec2-ap-northeast-1.portsnap.freebsd.org... failed.
Fetching public key from ec2-ap-southeast-2.portsnap.freebsd.org... failed.
Fetching public key from ec2-sa-east-1.portsnap.freebsd.org... failed.

Code: 
# truss ping google.com > & truss.test
# grep ERR truss.test
lstat("/usr/local/etc/libmap.d",0x7fffffffc698)  ERR#2 'No such file or directory'
readlink("/etc/malloc.conf",0x7fffffffd7a0,1024) ERR#2 'No such file or directory'
ioctl(4,TIOCGETA,0xfffedd10)  ERR#25 'Inappropriate ioctl for device'
access("/lib/nss_compat.so.1",0)  ERR#2 'No such file or directory'
access("/usr/lib/nss_compat.so.1",0)  ERR#2 'No such file or directory'
access("/usr/lib/compat/nss_compat.so.1",0)  ERR#2 'No such file or directory'
access("/usr/local/lib/nss_compat.so.1",0)  ERR#2 'No such file or directory'
access("/lib/nss_compat.so.1",0)  ERR#2 'No such file or directory'
access("/usr/lib/nss_compat.so.1",0)  ERR#2 'No such file or directory'
access("/lib/nss_nis.so.1",0)  ERR#2 'No such file or directory'
access("/usr/lib/nss_nis.so.1",0)  ERR#2 'No such file or directory'
access("/usr/lib/compat/nss_nis.so.1",0)  ERR#2 'No such file or directory'
access("/usr/local/lib/nss_nis.so.1",0)  ERR#2 'No such file or directory'
access("/lib/nss_nis.so.1",0)  ERR#2 'No such file or directory'
access("/usr/lib/nss_nis.so.1",0)  ERR#2 'No such file or directory'
access("/lib/nss_files.so.1",0)  ERR#2 'No such file or directory'
access("/usr/lib/nss_files.so.1",0)  ERR#2 'No such file or directory'
access("/usr/lib/compat/nss_files.so.1",0)  ERR#2 'No such file or directory'
access("/usr/local/lib/nss_files.so.1",0)  ERR#2 'No such file or directory'
access("/lib/nss_files.so.1",0)  ERR#2 'No such file or directory'
access("/usr/lib/nss_files.so.1",0)  ERR#2 'No such file or directory'
access("/lib/nss_dns.so.1",0)  ERR#2 'No such file or directory'
access("/usr/lib/nss_dns.so.1",0)  ERR#2 'No such file or directory'
access("/usr/lib/compat/nss_dns.so.1",0)  ERR#2 'No such file or directory'
access("/usr/local/lib/nss_dns.so.1",0)  ERR#2 'No such file or directory'
access("/lib/nss_dns.so.1",0)  ERR#2 'No such file or directory'
access("/usr/lib/nss_dns.so.1",0)  ERR#2 'No such file or directory'
ioctl(4,TIOCGETA,0xfffedce0)  ERR#25 'Inappropriate ioctl for device'
recvfrom(5,0x80144c000,65536,0x0,0x7ffffffec990,0x7ffffffec98c) ERR#61 'Connection refused'
socket(PF_INET6,0x10000002,0)  ERR#43 'Protocol not supported'
recvfrom(5,0x80144c000,65536,0x0,0x7ffffffec990,0x7ffffffec98c) ERR#61 'Connection refused'
socket(PF_INET6,0x10000002,0)  ERR#43 'Protocol not supported'
 
Are you firewalling the outgoing DNS requests? Make sure you allow both TCP and UDP to port 53. A lot of people only open UDP.
 
No pf running, I run pfSense upstream of the DNS (though not of 8.8.8.8, obviously). Similarly configured jails have no problem (no inbound DNS, but no issues with outbound). This is the first new jail built since 10.1, so I'm experiencing a few novel kinks. I'm somewhat suspect, though without any really good reason, of my lapses in keeping up with current versions. I had a problem with my Perl 5.20 specification that broke security/ca_root_nss. It is a tenuous association to extend that complication to nss_dns and compounds the unfounded extension to extend not finding nss_dns.so.1 to a failure to resolve, but grasping at unfounded word associations seems as solid a lead as I have.

I wiped the jail as little time was spent configuring it, returned to the host for a refresh and to the base for an update and will try again.

If I'm chasing the obviously wrong tail, any hints will be appreciated. I'll update with any results, positive or negative.
 
Last edited by a moderator:
Ok, jail is rebuilt, but with exactly the same symptoms. I've rebooted the jail (even rebuilt it from scratch). I see other people have had similar resolver issues, but none of the solutions seem to make any difference and I have working examples on the same system to compare and haven't yet found any difference...
 
It appears to be:

Code: 
# nsswitch.conf(5) - name service switch configuration file
# $FreeBSD: release/10.1.0/etc/nsswitch.conf 224765 2011-08-10 20:52:02Z dougb $
#
group: compat
group_compat: nis
hosts: files dns
networks: files
passwd: compat
passwd_compat: nis
shells: files
services: compat
services_compat: nis
protocols: files
rpc: files
 
ERROR: Leading space before nameserver definition in resolv.conf.
leading space removed, problem solved.
SOLVED.
 
  • Thanks
Reactions: jdb
You must log in or register to reply here.
Back
Top