[Dnsmasq-discuss] The strange dns query error observed for fiber optic modem bridge mode.

[Hongyi Zhao]

I've an FTTH network at home with the following topology:

ISP <----> fiber-optic modem operates in bridge mode (LAN1 slot)
<-----> (WAN slot) router <----> (all available LAN slots) all kinds
of terminals in the home, say, pc, phone, laptop, and so on.

On the fiber-optic modem, I noticed the following running dnsasq process:

/ # ps aux | egrep 'dnsmasq -r' |grep -v grep
  817 root        632 S   dnsmasq -r /var/tmp/default_resolv.conf -M 0 -T 6 -P

The content of the conf file is as follows:

/ # cat /var/tmp/default_resolv.conf
wancid
IPMode

The router can successfully dial the ISP using my PPPoE account and
obtain a public IP address.

On my PC connected to one of the router's LAN slot, dnsmasq is running
as a local stub resolver/forwarder. All the upstream servers used by
dnsmasq are shown below:

114.114.114.114
114.114.115.115
114.114.114.119
114.114.115.119
114.114.114.110
114.114.115.110
223.5.5.5
223.6.6.6
180.76.76.76
112.124.47.27
114.215.126.16


But I noticed that the dnsmasq will always return the IP address of
the fiber optic modem's LAN1 slot, as shown below:

$ dig www.baidu.com @127.0.0.1

; <<>> DiG 9.16.6-Ubuntu <<>> www.baidu.com @127.0.0.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13898
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.baidu.com.            IN    A

;; ANSWER SECTION:
www.baidu.com.        1882    IN    A    192.168.1.1

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Wed Jan 13 11:00:09 CST 2021
;; MSG SIZE  rcvd: 58

Furthermore, I try to check the upstream DNS servers as below:

werner at X10DAi:~$ dig www.baidu.com @114.114.114.114
;; Warning: Message parser reports malformed message packet.

; <<>> DiG 9.16.6-Ubuntu <<>> www.baidu.com @114.114.114.114
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13314
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; QUESTION SECTION:
;www.baidu.com.            IN    A

;; ANSWER SECTION:
.            0    CLASS4096 OPT    10 8 LQMKhVv5ODQ=

;; ADDITIONAL SECTION:
www.baidu.com.        3600    IN    A    192.168.1.1

;; Query time: 0 msec
;; SERVER: 114.114.114.114#53(114.114.114.114)
;; WHEN: Wed Jan 13 11:08:20 CST 2021
;; MSG SIZE  rcvd: 70


As you can see, it will fail too. But I noticed that the mandatory TCP
query will succeed:

$ dig www.baidu.com @114.114.114.114 +tcp

; <<>> DiG 9.16.6-Ubuntu <<>> www.baidu.com @114.114.114.114 +tcp
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 55026
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;www.baidu.com.            IN    A

;; ANSWER SECTION:
www.baidu.com.        741    IN    CNAME    www.a.shifen.com.
www.a.shifen.com.    174    IN    A    220.181.38.150
www.a.shifen.com.    174    IN    A    220.181.38.149

;; Query time: 32 msec
;; SERVER: 114.114.114.114#53(114.114.114.114)
;; WHEN: Wed Jan 13 11:10:37 CST 2021
;; MSG SIZE  rcvd: 101


I'm very confused on the above problem. Any hints/comments/suggestions
will be highly appreciated.

Regards
-- 
Assoc. Prof. Hongyi Zhao <hongyi.zhao at gmail.com>
Theory and Simulation of Materials
Hebei Polytechnic University of Science and Technology engineering
NO. 552 North Gangtie Road, Xingtai, China