Subject: Gateway problem: was Resolv.conf Help Needed
To: None <netbsd-help@netbsd.org>
From: Michael Owens <owensmk@earthlink.net>
List: netbsd-help
Date: 06/28/2001 15:49:51
Ok, this is not a resolver problem. It is a gateway problem I think.
I can ping outside of the gateway, but I cannot telnet or anything else,
which explains the resolver failure: nothing is getting routed out. Locally,
everything works, but if I try to telnet to a machine outside the nework, I
get:
telnet: Unable to connect to remote host: Can't assign requested address.
But I _can_ ping out. And I can telnet out from another machine on the same
network using the same gateway.
So I must have not configured NetBSD's default gateway properly. I set the
default route in installation, and in rc.local. I also deleted and reset it
using "route add default 10.10.10.101", but to no avail.
Any ideas? When I tried the FTP install, the installer had the same problem
--- said it could not connect to the FTP site.
The NetBSD machine is behind an OpenBSD firewall running NAT and IPF. There
are no restrictions for outgoing connections. I can assure you though that
the gateway and name servers are working properly. All of our staff are using
the OpenBSD NAT box for Internet access. I am emailing this message through
it from a FreeBSD machine sitting on the same network. So I know I've
improperly configured or messed up the NetBSD box's routing somehow, I just
don't know what or where.
Here is some information on the current settings:
bash-2.04# route get 204.152.186.171
route get 204.152.186.171
route to: 204.152.186.171
destination: default
mask: default
gateway: 10.10.10.101
local addr: mike
interface: sip0
flags: <UP,GATEWAY,DONE,STATIC>
recvpipe sendpipe ssthresh rtt,msec rttvar hopcount mtu
expire
0 0 0 0 0 0 1500
0
bash-2.04# telnet 204.152.186.171
telnet 204.152.186.171
Trying 204.152.186.171...
telnet: Unable to connect to remote host: Can't assign requested address
bash-2.04# telnet 10.10.10.205
telnet 10.10.10.205
Trying 10.10.10.205...
Connected to 10.10.10.205.
Escape character is '^]'.
backup login:
-------<quit>-----------
bash-2.04# netstat -rn
netstat -rn
Routing tables
Internet:
Destination Gateway Flags Refs Use Mtu Interface
default 10.10.10.101 UGS 0 0 1500 sip0
10.10.10/24 link#1 UC 0 0 1500 sip0
10.10.10.99 00:d0:b7:18:5f:6c UHL 0 0 1500 sip0
10.10.10.101 00:00:c5:83:95:58 UHL 1 7 1500 sip0
10.10.10.200 00:50:04:f1:c8:d6 UHL 2 4466 1500 sip0
10.10.10.203 00:90:27:f6:96:e2 UHL 0 7 1500 sip0
10.10.10.205 00:02:b3:07:ac:43 UHL 1 43 1500 sip0
127 127.0.0.1 UGRS 0 0 33228 lo0
127.0.0.1 127.0.0.1 UH 1 8 33228 lo0
XNS:
Destination Gateway Flags Refs Use Mtu Interface
ISO:
Destination Gateway Flags Refs Use Mtu Interface
X.25:
Destination Gateway Flags Refs Use Mtu Interface
AppleTalk:
Destination Gateway Flags Refs Use Mtu Interface
Internet6:
Destination Gateway Flags Refs
Use Mtu Interface
::/104 ::1 UGRS 0
0 33228 sip0 =>
::/96 ::1 UGRS 0
0 33228 sip0
::1 ::1 UH 12
0 33228 lo0
::127.0.0.0/104 ::1 UGRS 0
0 33228 sip0
::224.0.0.0/100 ::1 UGRS 0
0 33228 sip0
::255.0.0.0/104 ::1 UGRS 0
0 33228 sip0
::ffff:0.0.0.0/96 ::1 UGRS 0
0 33228 sip0
2002::/24 ::1 UGRS 0
0 33228 sip0
2002:7f00::/24 ::1 UGRS 0
0 33228 sip0
2002:e000::/20 ::1 UGRS 0
0 33228 sip0
2002:ff00::/24 ::1 UGRS 0
0 33228 sip0
fe80::/10 ::1 UGRS 0
0 33228 sip0
fe80::%sip0/64 link#1 UC 0
0 1500 sip0
fe80::1%sip0 ::1 UH 0
0 33228 lo0
fe80::%lo0/64 fe80::1%lo0 U 0
0 33228 lo0
fec0::/10 ::1 UGRS 0
0 33228 sip0
ff01::/32 ::1 U 0
0 33228 lo0
ff02::%sip0/32 link#1 UC 0
0 1500 sip0
ff02::%lo0/32 fe80::1%lo0 UC 0
0 33228 lo0
bash-2.04# ifconfig -a
ifconfig -a
sip0:
flags=fbff<UP,BROADCAST,DEBUG,LOOPBACK,POINTOPOINT,NOTRAILERS,RUNNING,NOARP,PROMISC,ALLMULTI,SIMPLEX,LINK0,LINK1,LINK2,MULTICAST>
mtu 1500
address: 9c:67:73:cd:98:a8
media: Ethernet autoselect (100baseTX full-duplex)
status: active
inet 10.10.10.167 -> 10.10.10.255 netmask 0xffffff00 broadcast
10.10.10.255
inet6 fe80::1%sip0 -> :: prefixlen 64 scopeid 0x1
inet6 ::1 -> ::1 prefixlen 128
lo0: flags=8009<UP,LOOPBACK,MULTICAST> mtu 33228
inet 127.0.0.1 netmask 0xff000000
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x2
inet6 ::1 prefixlen 128
ppp0: flags=8010<POINTOPOINT,MULTICAST> mtu 1500
ppp1: flags=8010<POINTOPOINT,MULTICAST> mtu 1500
sl0: flags=c010<POINTOPOINT,LINK2,MULTICAST> mtu 296
sl1: flags=c010<POINTOPOINT,LINK2,MULTICAST> mtu 296
strip0: flags=0<> mtu 1100
strip1: flags=0<> mtu 1100
tun0: flags=10<POINTOPOINT> mtu 1500
tun1: flags=10<POINTOPOINT> mtu 1500
gre0: flags=8010<POINTOPOINT,MULTICAST> mtu 1450
gre1: flags=8010<POINTOPOINT,MULTICAST> mtu 1450
ipip0: flags=8010<POINTOPOINT,MULTICAST>
ipip1: flags=8010<POINTOPOINT,MULTICAST>
gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
gif1: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
gif2: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
gif3: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
On Thursday 28 June 2001 13:40, Michael Owens wrote:
> Yes, I tried tcpdump, and there are no packets sent out. Nothing. nslookup
> just returns with the "Can't find server name . . ." without even trying. I
> even looked up the name server names using whois and put them in /etc/hosts
> as it seems that it wants to reverse DNS their addresses.
>
> One thing that did work, oddly enough, is if I used a caching nameserver on
> the same subnet (10.10.10.203). And it showed up on tcpdump. Then NetBSD
> would resolve names using that nameserver. It's only if the name servers
> are outside of the local network that name resolution doesn't work. I don't
> understand. I modified the networks line in nsswitch.conf to
>
> networks: files [notfound=continue] dns
>
> and also removed the domain line from resolv.conf as someone else
> suggested. But this doesn't change anything.
>
> It is true that the name servers are behind a firewall, but none of the
> other systems have trouble reaching/using them, as the firewall allows port
> 53 TCP and UDP.
>
> On Thursday 28 June 2001 12:31, you wrote:
> > On Thu, Jun 28, 2001 at 10:37:44AM -0500, Michael Owens wrote:
> > > I modified the nsswitch.conf, but to no avail. But I can ping the name
> > > servers fine. When I do nslookup, the exact error is
> > >
> > >
> > > root@mike> nslookup yahoo.com.
> > > nslookup yahoo.com.
> > > *** Can't find server name for address 216.140.16.254: No response from
> > > server *** Can't find server name for address 216.140.17.254: No
> > > response from server *** Default servers are not available
> >
> > Hum, isn't there some kind of filtering router between the
> > nameserevers and your host, which could block UDP packets ?
> >
> > Did you try running 'tcpdump -n' when running nslookup, to see what
> > happens on the wire ?
> >
> > --
> > Manuel Bouyer <bouyer@antioche.eu.org>
> > --