Multiroute with Failover DNS not resolving correctly

D0zer · 08-15-2014, 07:37 AM

Hi All

I am fairly new to linux. I am maintaining a gentoo box, which is running arno iptables, with multi routing plugin enabled, plus a fail over script that swaps over to a different line if one goes down.

Currently we have a line down, the swap over worked correctly but something is wrong with dns.
ping -I eth2 google.com
ping: unknown host google.com
ping -I eth2 8.8.8.8
PING 8.8.8.8 (8.8.8.8) from eth2: 56(84) bytes of data.

I am not sure where the problem lies. I have checked the resolv.conf, it has 127.0.0.1, 168.210.2.2, 8.8.8.8.

I have commented out the 127.0.0.1 to see if that made any difference.

I am hoping somebody can point me in the right direction to resolve this.

solarisguy · 08-24-2014, 12:47 AM

Can you post the contents of /etc/nsswitch.conf?

Also, try the following and post output:

Code:

ping 8.8.8.8
dig @8.8.8.8 www.google.com

D0zer · 09-01-2014, 02:44 AM

Hi solarisguy

Thank you for the reply.

Currently both lines are working. Next time I go to the client, I can disconnect the one router causing the fail over and do the same if necessary?

The output of /etc/nsswitch.conf

Code:

# /etc/nsswitch.conf:
# $Header: /var/cvsroot/gentoo/src/patchsets/glibc/extra/etc/nsswitch.conf,v 1.1 2006/09/29 23:52:23 vapier Exp $

passwd:      compat
shadow:      compat
group:       compat

# passwd:    db files nis
# shadow:    db files nis
# group:     db files nis

hosts:       files dns
networks:    files dns

services:    db files
protocols:   db files
rpc:         db files
ethers:      db files
netmasks:    files
netgroup:    files
bootparams:  files

automount:   files
aliases:     files

Code:

mail ~ # ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=42 time=179 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=42 time=179 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=42 time=179 ms
64 bytes from 8.8.8.8: icmp_seq=4 ttl=42 time=179 ms
64 bytes from 8.8.8.8: icmp_seq=5 ttl=42 time=179 ms
64 bytes from 8.8.8.8: icmp_seq=6 ttl=42 time=179 ms
64 bytes from 8.8.8.8: icmp_seq=7 ttl=42 time=179 ms
64 bytes from 8.8.8.8: icmp_seq=8 ttl=42 time=179 ms
64 bytes from 8.8.8.8: icmp_seq=9 ttl=48 time=428 ms
64 bytes from 8.8.8.8: icmp_seq=10 ttl=42 time=178 ms
64 bytes from 8.8.8.8: icmp_seq=11 ttl=42 time=179 ms
64 bytes from 8.8.8.8: icmp_seq=12 ttl=42 time=179 ms
64 bytes from 8.8.8.8: icmp_seq=13 ttl=42 time=179 ms
64 bytes from 8.8.8.8: icmp_seq=14 ttl=42 time=179 ms
64 bytes from 8.8.8.8: icmp_seq=15 ttl=42 time=178 ms
^C64 bytes from 8.8.8.8: icmp_seq=16 ttl=42 time=178 ms
64 bytes from 8.8.8.8: icmp_seq=17 ttl=42 time=179 ms
64 bytes from 8.8.8.8: icmp_seq=18 ttl=42 time=179 ms
64 bytes from 8.8.8.8: icmp_seq=20 ttl=42 time=179 ms
^C
--- 8.8.8.8 ping statistics ---
20 packets transmitted, 19 received, 5% packet loss, time 19005ms
rtt min/avg/max/mdev = 178.840/192.552/428.340/55.578 ms
mail ~ #

Code:

mail ~ # dig @8.8.8.8 www.google.com

; <<>> DiG 9.9.3-P2 <<>> @8.8.8.8 www.google.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20138
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;www.google.com.                        IN      A

;; ANSWER SECTION:
www.google.com.         288     IN      A       74.125.233.52
www.google.com.         288     IN      A       74.125.233.50
www.google.com.         288     IN      A       74.125.233.48
www.google.com.         288     IN      A       74.125.233.51
www.google.com.         288     IN      A       74.125.233.49

;; Query time: 192 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Mon Sep 01 09:41:10 SAST 2014
;; MSG SIZE  rcvd: 123

solarisguy · 09-03-2014, 06:29 PM

I'm assuming that eth2 is solely connected to one ISP? (Assuming no VLAN tags, etc)

If so, can you run tcpdump on that interface while running a ping to 8.8.8.8? I'm wondering if there's something odd about the way the source IP is populated. Possibly some asymmetric routing going on or something.

D0zer · 09-05-2014, 03:00 AM

Hi solarisguy.

Eth2 is connected to one ISP with no vlan tags that I know of.

Spoke to the guy who installed the server, today we had issues with the one line. He suggested I run a

Code:

 iptables -t mangle -F

After doing that I was able to ping google.com and 8.8.8.8

I assume its something to do with load balancing. I noticed in the script which runs the failover there was a line #iptables -t mangle -F, so I have removed the #.

solarisguy · 09-05-2014, 11:13 PM

Hmm, this makes me wonder what the mangle table was doing. I'm wondering if it was setting TCP MSS for a lower MTU link.

What type of connections are these? Cable? DSL? Dedicated?

Are there any entries in /etc/sysconfig/iptables for the mangle table?

D0zer · 09-06-2014, 01:12 AM

The one connection is a fiber connection, the other is a 2048mb dsl. The 2048mb line runs the mail.

There is no /etc/sysconfig/ folder on this box. The guy who installed the box wanted me to look at arno iptables originally, but he could not remember where it was installed, and said flush the iptables and see if it works.

There is a file called Mangle_rules which runs as part if the fail over script.

Code:

/sbin/iptables -A PREROUTING  -t mangle -p tcp --sport 3389 -j MARK --set-mark 1
/sbin/iptables -A PREROUTING  -t mangle -p tcp --dport 3389 -j MARK --set-mark 1
/sbin/iptables -A POSTROUTING  -t mangle -p tcp --sport 3389 -j MARK --set-mark 1
/sbin/iptables -A POSTROUTING  -t mangle -p tcp --dport 3389 -j MARK --set-mark 1
/sbin/iptables -A FORWARD  -t mangle -p tcp --sport 3389 -j MARK --set-mark 1
/sbin/iptables -A FORWARD  -t mangle -p tcp --dport 3389 -j MARK --set-mark 1
/sbin/iptables -A PREROUTING  -t mangle -p udp --sport 500 -j MARK --set-mark 1
/sbin/iptables -A POSTROUTING  -t mangle -p udp --sport 500 -j MARK --set-mark 1
/sbin/iptables -A PREROUTING  -t mangle -p udp --sport 4500 -j MARK --set-mark 1
/sbin/iptables -A PREROUTING  -t mangle -p esp -j MARK --set-mark 1
/sbin/iptables -A PREROUTING  -t mangle -p ah -j MARK --set-mark 1
/sbin/iptables -A PREROUTING  -t mangle -p tcp --sport 873 -j MARK --set-mark 1
/sbin/iptables -A PREROUTING  -t mangle -p tcp --sport 443 -j MARK --set-mark 2
/sbin/iptables -A FORWARD  -t mangle -p tcp --sport 443 -j MARK --set-mark 2
/sbin/iptables -A FORWARD  -t mangle -p tcp --dport 443 -j MARK --set-mark 2
/sbin/iptables -A PREROUTING  -t mangle -p tcp --sport 143 -j MARK --set-mark 1
/sbin/iptables -A PREROUTING  -t mangle -p tcp --sport 1723 -j MARK --set-mark 1
/sbin/iptables -A PREROUTING  -t mangle -p 47 -j MARK --set-mark 1