0

The problem:

My DNS is getting hijacked by my ISP, when I enter a webpage, sometimes it redirects me to "Download Bill" page.

I've tried to see why this happens, then I found something else. I have DD-WRT in my router, with DNSMASQ for DHCP and DNS, with fixed DNS IPs (Open DNS).

But in Ubuntu, my resolv.conf shows it is using 127.0.0.1 (and so does nslookup), so not querying the router? But then Connection Info shows the right information.

What is wrong here?

enter image description here

enter image description here

2

NetworkManager is the program which (via the resolvconf utility) inserts address 127.0.1.1 into resolv.conf. NM inserts that address if an only if it is configured to start an instance of the dnsmasq program to serve as a local forwarding nameserver. That dnsmasq instance listens for queries at address 127.0.1.1.

If you wish to see witch DNS you use currently type command

nmcli device show <interfacename> | grep IP4.DNS

You can set different DNS param for each connection

If you do not want to use a local forwarding nameserver then configure NetworkManager not to start a dnsmasq instance and not to insert that address. In /etc/NetworkManager/NetworkManager.conf comment out the line dns=dnsmasq

sudo nano /etc/NetworkManager/NetworkManager.conf

[main]
plugins=ifupdown,keyfile,ofono
#dns=dnsmasq

and restart the NetworkManager service.

sudo service network-manager restart

In this mode, NetworkManager updates /etc/resolv.conf (still via resolvconf) to include the nameserver addresses NetworkManager has for active connections.

If you want to disable the resolvconf mechanism for updating resolv.conf and just use a static resolv.conf file, do the following.

sudo rm -f /etc/resolv.conf  # Delete the symbolic link
sudo nano /etc/resolv.conf   # Create static file

# Content of static resolv.conf
nameserver 8.8.4.4
nameserver 8.8.8.8
  • I don' t have any problem using dnsmasq, but I would like to know how it is configured. I mean, this is acting like a "cache" right? Then if it does not have an address cached, it should go to the DHCP specified DNS... so how do I check that this is in fact happening? – JorgeeFG May 15 '17 at 13:51
1

dnsmasq is a good thing; I wouldn't disable it: https://help.ubuntu.com/community/Dnsmasq

A local DNS cache can speed up internet browsing because the user's browser will not need to access a domain name server when it looks up a domain name the computer has visited before.

On the other hand, if the DNS nameserver that is provided by your ISP is getting hijacked, then, by all means, don't use it! You may specify alternate DNS nameservers in Network Manager like this:

enter image description here

  • The ISP's DNS are not getting hijacked, they are hijacking my DNS requests to OpenDNS... – JorgeeFG May 15 '17 at 13:49
  • I don' t have any problem using dnsmasq, but I would like to know how it is configured. I mean, this is acting like a "cache" right? Then if it does not have an address cached, it should go to the DHCP specified DNS... so how do I check that this is in fact happening?. Also, in the DHCP information I am sending the DNS that I want. I do not want to configure custom DNS in all PC's separately – JorgeeFG May 15 '17 at 13:51
  • Indeed; dnsmasq creates a local cache and first looks to the cache for DNS resolution. If it finds none, it then uses the DNS nameserver specified; in your case, the DNS nameservers in 192.168.20.1, your router. As to how or why the OpenDNS nameservers specified in your router are being highjacked, I haven't any idea. You should be able avoid specifying DNS in each computer by instead specifying it in the router. Why it isn't working at the router is unknown to me. – chili555 May 15 '17 at 14:10

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.