After upgrading to 17.10, Ubuntu is using systemd-resolved to handle all DNS requests, and it has a stub listener, but the listener only accept requests from local. I am using a Vultr VPS, this is what happened.

root@00:~# nslookup www.google.com

** server can't find www.google.com: SERVFAIL

In the errlog:

Dec 19 01:20:24 00.tokyo.jp.mole systemd-resolved[684]: Got packet on unexpected IP range, refusing.

I tried to dump the udp package and here is the result:

root@00:~# tcpdump -i lo udp port 53 -vv -X
tcpdump: listening on lo, link-type EN10MB (Ethernet), capture size 262144 bytes
01:20:24.230349 IP (tos 0x0, ttl 64, id 24187, offset 0, flags [none], proto UDP (17), length 60)
    45.xx.xx.xx.vultr.com.60360 > [bad udp cksum 0xbf8c -> 0xe032!] 58738+ A? www.google.com. (32)
    0x0000:  4500 003c 5e7b 0000 4011 5ce3 2dxx xxxx  E..<^{..@.\.-...
    0x0010:  7f00 0035 ebc8 0035 0028 bf8c e572 0100  ...5...5.(...r..
    0x0020:  0001 0000 0000 0000 0377 7777 0667 6f6f  .........www.goo
    0x0030:  676c 6503 636f 6d00 0001 0001            gle.com.....
01:20:24.230963 IP (tos 0x0, ttl 64, id 25931, offset 0, flags [DF], proto UDP (17), length 40) > localhost.60360: [bad udp cksum 0xfe5b -> 0xae9c!] 58738 ServFail [0q] 0/0/0 (12)
    0x0000:  4500 0028 654b 4000 4011 d743 7f00 0035  E..(eK@.@..C...5
    0x0010:  7f00 0001 0035 ebc8 0014 fe5b e572 8182  .....5.....[.r..
    0x0020:  0000 0000 0000 0000                      ........

It shows that it is sending the request using the public IP instead of, so systemd-resolved refuse to reply. Using systemd-resolve www.google.com could get the result and it shows that the service is functioning normally.

root@00:~# systemd-resolve www.google.com

-- Information acquired via protocol DNS in 6.6ms.
-- Data is authenticated: no

I temporarily changed the symlink of /etc/resolv.conf to /run/systemd/resolve/resolv.conf so the server could have access to the Internet, but I want to know how can I change the requesting IP to fix this problem?


I just had the same problem with an upgraded Ubuntu 16.04 to Ubuntu 18.04 server. My solution was to check my firewall settings and exclude the loopback device lo from masquerading the source IPs (D'oh!).

Be sure to check your routes and your firewall routing magic like POSTROUTING { MASQUERADE; }. It was working before since the old DNS resolver wasn't as picky with source IPs it seems.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.