Open DNS Resolver

KiKi

securityguy wrote: »

Not easily. It's quite a complex and unusual problem.

As a starting point:

Visit http://www.whatismyip.com and note down what your IP number is.

Then visit http://network-tools.com/nslook/ and paste your IP number into the "server" box, tick the "advanced output" box, and then hit "go".

Paste the output into a reply to this message.

Ah, this I can follow! Thank you. Output is here:


**********

IP returned a non-authoritative response in 141 ms:


Header

rcode: Success
id: 0 opcode: Standard query
is a response: True authoritative: False
recursion desired: True recursion avail: True
truncated: False
questions: 1 answers: 10
authority recs: 0 additional recs: 6
Questions

name class type
yahoo.com IN ANY
Answer records
name class type data time to live
yahoo.com IN A 98.138.253.109 99s (1m 39s)
yahoo.com IN A 206.190.36.45 99s (1m 39s)
yahoo.com IN A 98.139.183.24 99s (1m 39s)
yahoo.com IN NS ns4.yahoo.com 144654s (1d 16h 10m 54s)
yahoo.com IN NS ns5.yahoo.com 144654s (1d 16h 10m 54s)
yahoo.com IN NS ns8.yahoo.com 144654s (1d 16h 10m 54s)
yahoo.com IN NS ns1.yahoo.com 144654s (1d 16h 10m 54s)
yahoo.com IN NS ns2.yahoo.com 144654s (1d 16h 10m 54s)
yahoo.com IN NS ns3.yahoo.com 144654s (1d 16h 10m 54s)
yahoo.com IN NS ns6.yahoo.com 144654s (1d 16h 10m 54s)
Authority records
[none]
Additional records
name class type data time to live
ns5.yahoo.com IN A 119.160.247.124 299139s (3d 11h 5m 39s)
ns1.yahoo.com IN A 68.180.131.16 473244s (5d 11h 27m 24s)
ns2.yahoo.com IN A 68.142.255.16 132586s (1d 12h 49m 46s)
ns3.yahoo.com IN A 203.84.221.53 599111s (6d 22h 25m 11s)
ns6.yahoo.com IN A 202.43.223.170 171107s (1d 23h 31m 47s)
ns4.yahoo.com IN A 98.138.11.157 515331s (5d 23h 8m 51s)
-- end --



*******

KiKi

securityguy

OK, so Virgin aren't joking: you've got an open resolver. Ouch.

On your laptop, get a command prompt (google for how to do that if you don't know), and then run "nslookup https://www.google.com 127.0.0.1" It should say "No response from server". Having done that, turn off every other device other than your router and your laptop. That includes, as others have mentioned, Smart TVs, printers, X Boxes, etc: _everything_ Re-run the process using network-tools.com. If you still get a successful result akin to the one you pasted, then the problem's with your router and you should take it up with Virgin. Otherwise, turn the other devices back on one at a time, re-runnning the process, until it succeeds. That's the device with the problem.

KiKi

securityguy wrote: »

OK, so Virgin aren't joking: you've got an open resolver. Ouch.

On your laptop, get a command prompt (google for how to do that if you don't know), and then run "nslookup https://www.google.com 127.0.0.1" It should say "No response from server".

It said "server: unknown" then lots of "DNS request timed out"


I'll do the rest now. I don't have any other net devices other than the ones I mentioned, so that's easy to do. Thank you.

KiKi

securityguy wrote: »

Re-run the process using network-tools.com. If you still get a successful result akin to the one you pasted, then the problem's with your router and you should take it up with Virgin. Otherwise, turn the other devices back on one at a time, re-runnning the process, until it succeeds. That's the device with the problem.

With my laptop it still says "rcode: success", so does that make it a Virgin problem?

I thought 'router' referred to the the wireless router I have here, but I guess not...?

I will turn this laptop off, though, and check with another device in case it's the laptop!

securityguy

Ideally, your final move is to turn _everything_ off other than your router, and go to a cafe or your neighbour and try again.

KiKi

Trying it with my nexus...it says "rcode: success".

So I need to take this up with Virgin? Do I just tell them what I did here?

Thanks for all your help, by the way, I really appreciate it.
KiKi

KiKi

securityguy wrote: »

Ideally, your final move is to turn _everything_ off other than your router, and go to a cafe or your neighbour and try again.

I could do this from my phone on 3g... would that work? I'd switch WiFi off, obviously...
KiKi

ETA - same result on 3G. I will try at work tomorrow then call Virgin. Thanks so much for your help. Let's hope the VM tech team understand it!

securityguy

KiKi wrote: »

Trying it with my nexus...it says "rcode: success".

So I need to take this up with Virgin? Do I just tell them what I did here?

Thanks for all your help, by the way, I really appreciate it.
KiKi

So you're saying that you make use network tools to make a query back to your home IP number, which fails with your Nexus turned off, but succeeds with your Nexus turned on?

WTAF?

So (a) why is your Nexus running a DNS resolver and (b) why is your home router passing the traffic through to it?

First question. Go to Settings, WiFi, click on the name of your home network (it should say "Connected" next to it) and note down the IP number (probably 192.168.something.something or 10.something.something.something). Now on your laptop run "nslookup https://www.google.com 192.168.0.1" or whatever the IP number was. Did that work (ie, return something other than a timeout)?

KiKi

securityguy wrote: »

So you're saying that you make use network tools to make a query back to your home IP number, which fails with your Nexus turned off, but succeeds with your Nexus turned on?

No, I get the same message on every device (they all return results which say "rcode: success" at the top), and also when I do it from my work wifi. So that means it must be the router...?

First question. Go to Settings, WiFi, click on the name of your home network (it should say "Connected" next to it) and note down the IP number (probably 192.168.something.something or 10.something.something.something). Now on your laptop run "nslookup www.google.com 192.168.0.1" or whatever the IP number was. Did that work (ie, return something other than a timeout)?

I'm at work, so can't do that now, but will when I get home.

I'm also going to call Virgin today - presumably asking for a new router might just fix the problem, or 'closing' port 53 as someone suggested above, would that work?

Thanks again.
KiKi

Ximian

I'm not familiar with the Virgin routers but you should be able to block port 53 inbound, or block all inbound traffic. The router I have has a built in firewall that blocks all inbound traffic unless I explicitly allow inbound traffic to an IP Address and port.