DNS server Status broken

[linuxgeek (Nad)]

I have the same issue with DNS server Status broken. Below is the summary with what I have done:

I have a main router pfsense that is connected to the optical modem. If I connect the ipfire to the pfsense the ipfire can browse the internet without any issue. However, if I connect the ipfire directly to the modem, any devices connected to the ipfire can not browse the internet. Checking the ipfire it did get the public ip address, gateway, and dns from the isp provider. However pinging the assigned gateway and the dns by the isp, it failed. I tried using the google dns 8.8.8.8 for testing still it failed. “rDNS = Reverse lookup failed” I tried re-installing it and still the same issue. I am using ipfire 2.27 core update 162.

I found this error in the log: “Jan 18 11:24:49 ipfire unbound: [13479:0] error: SERVFAIL <localdomain.localdomain. A IN>: all the configured stub or forward servers failed, at zone . no server to query nameserver addresses not usable have no nameserver names”
This the hardware:
PC engine APU
3 NIC Realtek
mSata drive
2G RAM

Please help I am pretty new with ipfire. Thanks.

[jon]

Hello Nad Okob - welcome to the IPFire Community!

Can you attach a screen shot?

This is my DNS Servers page:

[linuxgeek (Nad)]

Here it is. This is if I use the default config after fresh install. Below is similar to your dns nameserver.

[jon]

Click on the pencil. Is the TLS Hostname filled in?

[jon]

EDIT:

See:

Assign DNS Servers - The IPFire Wiki

and

List of Public DNS Servers - The IPFire Wiki

[linuxgeek (Nad)]

Yes , I filled it in too.

[jon]

click on Check DNS Server and hover the mouse over the Status word (the result):

[linuxgeek (Nad)]

If you noticed on the image I sent there is no column about status. And the status of the DNS server itself says “Broken”.

[jon]

it will appear after clicking on Check DNS Servers

[linuxgeek (Nad)]

It says" can’t connect to 9.9.9.9@853(TCP);
It looks like the firewall is not letting any outbound. the ipfire itself can not ping the gateway, dns nameservers, host unreachable.

[jon]

Very odd. These are the only suggestions I have. Sorry.

Hopefully someone smarter will jump in and add their comments!

[linuxgeek (Nad)]

Thanks for your help. Hopefully others might chip in their knowledge with ipfire.

[jon]

@linuxgeek

the ipfire itself can not ping the gateway, dns nameservers, host unreachable.

do you remember how the RED was setup?

Step 6: Internet Connection Setup - The IPFire Wiki

can you share those settings?

[linuxgeek (Nad)]

It is setup as DHCP, so it receives an public ip address, gateway and DNS provided by isp.

[jon]

what does the Home / Main Page look like?

Does the Internet address and the Gateway address look right?

Home - The IPFire Wiki

[linuxgeek (Nad)]

Take a look at the routing table that was created, it looks right to me.
Here is the status of the red port:

[jon]

I tried both of the DNS servers and they did not work for me. Maybe because I am located in the US. The error is:
connection timed out; no servers could be reached

MBP:~ jcm$ dig @75.153.176.1 ipfire.org

; <<>> DiG 9.16.12 <<>> @75.153.176.1 ipfire.org
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

MBP:~ jcm$ dig @75.153.176.9 ipfire.org

; <<>> DiG 9.16.12 <<>> @75.153.176.9 ipfire.org
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

MBP:~ jcm$ dig @8.8.8.8 ipfire.org

; <<>> DiG 9.16.12 <<>> @8.8.8.8 ipfire.org
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43346
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;ipfire.org.			IN	A

;; ANSWER SECTION:
ipfire.org.		21600	IN	A	81.3.27.38

;; Query time: 434 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Tue Jan 18 20:44:45 CST 2022
;; MSG SIZE  rcvd: 55

[jon]

Hopefully someone else can assist

[linuxgeek (Nad)]

I dont think you will be able to use the provided dns by my isp, it is only those who are subscribe to them. Those ip addresses that belongs to their public ip address allotment are the only ones that can use those dns nameserver.

[jon]

One other thought.

My modem (a Arris Cable Modem) must be unplugged and restarted when connecting to a new device (like a different firewall). If I connect without the power-down & up, then I cannot connect to the Internet.

Maybe try that for your gateway?