(FR) Problème de bouclage / épinglage du routeur - (EN) Router loopback / hairpinning issue?

Zinkie · August 24, 2018, 4:08pm

Français (Désolé pour Google Translate!):
Donc, je suis allé et acheté le gros paquet cher de mon fournisseur de services Internet afin que mon serveur fonctionne mieux. ISP a répondu en m’envoyant un nouveau routeur coûteux que je devais apparemment utiliser, mais ne prend pas en charge le bouclage / épinglage.

Maintenant, je ne suis pas un expert, mais d’après ce qu’on m’a dit, il me semble que je dois mettre en place un service DNS et y indiquer les dns de mon routeur (certains appareils comme mon téléphone ne sont pas enracinés, donc je peux le faire) Il suffit de modifier hosts.conf). Le problème est que tous les tutoriels de configuration DNS que je peux trouver semblent être écrits pour des cas d’utilisation beaucoup plus compliqués que “Je veux que ce nom de domaine pointe vers cette adresse IP”.

Donc, mes questions sont les suivantes:

Y a-t-il une application Yunohost pour installer un service DNS?
Sinon, est-ce que quelqu’un connaît un didacticiel qui montre simplement comment faire en sorte que le service DNS pointe quelques domaines spécifiques vers l’IP interne et obtienne tous les autres domaines du service DNS externe normal?

English:
So, I went and bought the big expensive package from my ISP so my server would run better. ISP responded by sending me a new, expensive router which I apparently have to use, but doesn’t support loopback / hairpinning.

Now, I’m no expert, but from what I’ve been told, it sounds like I need to set up a dns service and point my router’s dns to it (some devices like my phone aren’t rooted, so I can’t just modify hosts.conf). The trouble is, all of the DNS configuration tutorials I can find seem to be written for far more complicated use cases than just “I want this domain name to point to this IP address”.

So my questions are these:

Is there any Yunohost app to install a DNS service?
If not, does anyone know of a tutorial somewhere that shows, simply, how to have the DNS service point a couple of specific domains to the internal IP, and get all other domains from the normal, external DNS service?

Thanks!

Aleks · August 24, 2018, 4:13pm

Pour le point 2, il y a apriori deja dnsmasq qui est intégré de base dans YunoHost et qui réalise ce genre de fonctionnalité (à voir pour les détails exacts). Normalement tu peux utiliser le dnsmasq de ton instance yunohost en ouvrant le port 53 dans le firewall du serveur (par contre, il n’est pas conseillé d’ouvrir/router le port 53 au niveau de ta box !). Ensuite, tu peux configurer tes autres machines pour utiliser ton serveur comme résolveur DNS, via son IP locale.

Zinkie · August 28, 2018, 4:56pm

Français:
Je viens de lire sur DNSmasq en ligne pour la première fois. Alors est-il possible de simplement:

Installez DNSmasq
Ajoutez mes noms de domaine auto-hébergés à / etc / hosts de Yunohost
Dites à DNSmasq la connexion réseau pour écouter
Pointez la recherche DNS de mon routeur sur l’adresse IP interne de Yunohost?

… ou est-ce plus compliqué que ça?

French:
I just read about DNSmasq online for the first time. So is it possible to just:

Install DNSmasq
Add my selfhosted domain names to Yunohost’s /etc/hosts
Tell DNSmasq the network connection to listen to
Point my router’s DNS lookup to the Yunohost internal IP address?

…or is it more complicated than that?

gannonwoto · August 29, 2018, 12:42pm

So, you have a new router at home and you have a Yunohost selfhosted.
And now, are you looking to configure your yunohost server as a DNS resolver for your machine on your local network. And this only from your local network (not in 4G for example).

That’s it ?

If, yes

You are right, except that as Aleks says, dnsmasq is already installed by yunohost. To convince you: dpkg -l |grep dnsmasq
So,

Add your selfhosted domain names to Yunohost’s /etc/hosts;
192.168.1.100 toto.com for example.
Tell DNSmasq the network connection to listen to
Restart dnsmasq service
Add nameserver @ip_yunohost in /etc/resolvconf.conf on your router.

And it’s ok.

to check dig toto.com on your pc.

PS :
if you want to simplify / have a GUI, use the pi-hole application for yunohost (it’s a Lying DNS for advertising)
Vou will have several questions during the install.
Add your domain name in the file / etc / hosts of your yunohost server.
and execute:
pihole restartdns

Zinkie · August 31, 2018, 12:27pm

Perfect! Since I posted that last reply, I realized that yes, DNSmasq is already installed and that I already had the domains set up in /etc/hosts (to save bandwidth and speed up transfers).

So now to experiment with the last two steps. Hope I don’t have any issues with the last one. My router is a closed source box supplied by the ISP, but I think I should be able to just enter the network IP address in it’s DNS lookup config gui…

Thanks so much @gannonwoto and @Aleks!

Zinkie · August 31, 2018, 2:08pm

Sorry, I realized I missed answering some questions, @gannonwoto:

Yes, I have a new router at home with Yunohost selfhosted.

Yes, I’m looking to set DNSmasq up as a DNS resolver on my local network, however…

I want to make it the DNS resolver for the router itself, so when my phone is connected via wifi, that it will still resolve the domain name for my yunohost site correctly.

Currently I did the steps in your bullet points, except I put in the ip adress for my Yunohost box (192.168.1.99) in as the router’s primary DNS. I also added my router’s IP address to dnsmasq.conf ( listen-address=127.0.0.1, 192.168.1.1)

I’ve restarted the router and the yunohost box. Visiting my domain name though still just seems to time out.

gannonwoto · August 31, 2018, 6:15pm

Nop, in your yunohost dnsmasq server listen-address=127.0.0.1
dnsmasq will want to listen to an interface of your yunohost server having for address “192.168.1.1”

Zinkie · September 4, 2018, 10:28am

I’m sorry, I don’t understand… do you mean change:

listen-address=127.0.0.1, 192.168.1.1

to:

listen-address=127.0.0.1
interface=eth0

?

Essentially, what I can change is:

The routers primary and secondary DNS IP’s (primary is currently 192.168.1.99 - my Yunohost box internal IP, secondary is my ISP’s dns service)
DNSmasq.conf. Currently:

domain-needed
expand-hosts

listen-address=127.0.0.1,192.168.1.1
interface=eth0
resolv-file=/etc/resolv.dnsmasq.conf
cache-size=256

/etc/hosts has a list of my domain names, all pointing to 192.168.1.99 - I know this is correct, as I can use my websites locally, even when the internet goes down.

What could possibly be changed, so my router gets the correct (internal) IP adress, when a connected device asks for my domain name?

Thanks for your patience! I’m new to DNSmasq!

gannonwoto · September 13, 2018, 2:47pm

Hey,

Sorry for the response time.
Quickly.

Yes.

listen-address=127.0.0.1

leave the list of your domain names in /etc/hosts, restart dnsmasq : sudo service dnsmasq restart

and tell us if it works.

Zinkie · October 7, 2018, 8:21am

@gannonwoto No problem. It still doesn’t work, though. All sites resolve correctly outside my network. When I use my phone though (using the router’s wifi) self hosted domains time out.

If I point my routers primary and secondary DNS server
IP addresses at my Yunohost internal IP address, then all domains (self hosted and otherwise) time out.

I wonder if DNSmasq is getting the DNS requests from my router?

gannonwoto · October 9, 2018, 10:45am

1)
by the way, what do you have as a router? (the file /etc/resolv.conf exist ?)
2) do you want something like that?

                            +-------------+
                            |             |
                            |             |
                            |    W W W    |
                            |             |
                            +------+------+
                                   |
                                   |                                /etc/resolv.conf :
+--------------+            +------+------+
|srv1          |            |your router  |   ------------------->  nameserver 192.168.1.99
|192.192.1.101 |            |192.168.1.1  |
|              |            |             |
+----+---------+            +------+------+
     |                             |
     +-------------+---------------+-------------------+
                   |                                   |
             +-----+-------+                    +------+-------+
             |             |                    |your yunohost |   +---->  /etc/hosts :
             |your PC      |                    |192.168.1.99  |          [...]
             |192.168.1.100|                    |              |          192.168.1.100 mypc mypc
             +-------------+                    +--------------+

                     1.srv1  @ip ? +---------->

                     2. <------ srv1 @ip = 192.168.1.101

execute the following command on your PC (on linux).
(on windows it must be : nslookup )

dig srv1 @192.168.1.99

the answer should be

[...]

;; QUESTION SECTION:
;srv1.				IN	A

;; ANSWER SECTION:
srv1.			0	IN	A	192.168.1.101

[...]

if you do not have an answer:

In the menu administration of your yunohost:

tools -> Diagnosis. -> service section -> “dnsmasq”: “running (enabled)”,
tools -> firewall -> tcp and udp port 53 -> checked

Zinkie · November 15, 2018, 2:04am

Ok, sorry for the delay. I ended up having to move house. Anyway, the network map looks a bit more like this:

Doing dig srv1 192.168.1.99 on my PC gives:
~$ dig srv1 192.168.1.99

; <<>> DiG 9.11.3-1ubuntu1.2-Ubuntu <<>> srv1 192.168.1.99
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 35059
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;srv1.                          IN      A

;; Query time: 19 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Wed Nov 14 20:38:45 EST 2018
;; MSG SIZE  rcvd: 33                                                                                                                                                                                                                                                          
                                                                                                                                                                                                                                                                               
;; Got answer:                                                                                                                                                                                                                                                                 
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21341                                                                                                                                                                                                                      
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1                                                                                                                                                                                                           
                                                                                                                                                                                                                                                                               
;; OPT PSEUDOSECTION:                                                                                                                                                                                                                                                          
; EDNS: version: 0, flags:; udp: 65494                                                                                                                                                                                                                                         
;; QUESTION SECTION:                                                                                                                                                                                                                                                           
;192.168.1.99.                  IN      A                                                                                                                                                                                                                                      
                                                                                                                                                                                                                                                                               
;; ANSWER SECTION:                                                                                                                                                                                                                                                             
192.168.1.99.           0       IN      A       192.168.1.99                                
                                                                                            
;; Query time: 1 msec                                                                       
;; SERVER: 127.0.0.53#53(127.0.0.53)                                                        
;; WHEN: Wed Nov 14 20:38:45 EST 2018                                                       
;; MSG SIZE  rcvd: 57

Diagnosis gives:
"dnsmasq": "running (enabled)",

Port 53 is open to both TCP and UDP in Yunohost firewall.

Zinkie · February 11, 2019, 3:03am

Two month bump… Still trying to get this figured out… Is there really no-one else stuck using an ISP issued router without NAT loopback/hairpinning?

SohKa · March 16, 2019, 1:11pm

Hi,

Give us the output of this command, please :

sudo netstat -tulpn | grep dnsmasq

Edit:
Also, could you paste the content of /etc/dnsmasq.conf, please ? I know you already did it, but that’s a few months ago and I prefer to make sure there is no wrong parameter.

Zinkie · July 24, 2019, 6:17am

[FR] OK, ça fait un moment, mais je n’ai toujours pas trouvé ça. Voici les informations que vous avez demandées pour @SohKa. J’ai remplacé le nom du domaine par “mydomain”:

[EN] OK, it’s been a while, but I still haven’t figured this out. Here’s the information you asked for @SohKa. I replaced the name of the domain with “mydomain”:

sudo netstat -tulpn | grep dnsmasq:
tcp 0 0 0.0.0.0:53 0.0.0.0:* LISTEN 751/dnsmasq
tcp6 0 0 :::53 :::* LISTEN 751/dnsmasq
udp 0 0 0.0.0.0:53 0.0.0.0:* 751/dnsmasq
udp6 0 0 :::53 :::* 751/dnsmasq

cat /etc/dnsmasq.conf:
#domain-needed
#expand-hosts

#listen-address=127.0.0.1
#interface=eth0
#resolv-file=/etc/resolv.dnsmasq.conf
#cache-size=256
no-dhcp-interface=
server=208.67.222.222
address=/files.mydomain.com/mydomain.com/yuno.mydomain.com/home.mydomain.com/yunohost/192.168.0.100

no-hosts
addn-hosts=/etc/dnsmasq.hosts

cat /etc/dnsmasq.hosts:
192.168.1.100 yunohost files.mydomain.com mydomain.com yuno.mydomain.com

Zinkie · August 26, 2019, 11:00am

So I created a fresh install of the latest Yunohost. I still have the same hairpinning problem with my router, so here’s the info you asked for @SohKa / @gannonwoto :

sudo netstat -tulpn | grep dnsmasq
tcp 0 0 0.0.0.0:53 0.0.0.0:* LISTEN 718/dnsmasq
tcp6 0 0 :::53 :::* LISTEN 718/dnsmasq
udp 0 0 0.0.0.0:53 0.0.0.0:* 718/dnsmasq
udp6 0 0 :::53 :::* 718/dnsmasq

cat /etc/dnsmasq.conf
domain-needed
expand-hosts

listen-address=127.0.0.1
resolv-file=/etc/resolv.dnsmasq.conf
cache-size=256

So… any suggestions on how to configure DNSmasq to act as a DNS service that directs requests for my domains to my Yunohost server and everything else to a DNS service like openDNS?