J'utilise mes propres DNS (unbound sous FreeBSD sur le LAN derrière une livebox).
Je n'ai pas de résolution de ns1.francetelecom.net et dns.francetelecom.net depuis une livebox v4 Fibre/ADSL (testé dans les Yvelines et en Savoie)
Si j'utilise le réseau Orange pour la résolution: (derrière une Livebox v4)
# mtr -4r -c 5
www.orange.frStart: 2020-08-15T14:55:54+0200
HOST: rgw Loss% Snt Last Avg Best Wrst StDev
1.|-- livebox 0.0% 5 2.4 0.8 0.4 2.4 0.9
2.|--

100.0 5 0.0 0.0 0.0 0.0 0.0
3.|-- 193.253.80.38 0.0% 5 2.7 3.1 2.2 6.0 1.6
4.|-- 193.252.98.94 0.0% 5 2.3 2.5 2.3 2.7 0.2
5.|-- 193.252.101.213 0.0% 5 8.0 8.1 8.0 8.3 0.1
6.|-- 193.252.101.225 0.0% 5 8.3 8.2 8.0 8.3 0.1
7.|-- 193.253.13.42 0.0% 5 15.9 15.8 15.6 16.1 0.2
8.|-- fw-bae01-v2999.echo.net.s 0.0% 5 16.0 16.0 15.8 16.2 0.2
9.|-- vip1.dyn.hpo.s1.fti.net 0.0% 5 16.0 16.3 16.0 17.3 0.5
Je vais donc prendre comme exemple la résolution du reverse pour 193.252.98.94
# dig +trace 94.98.252.193.in-addr.arpa
; <<>> DiG 9.16.5 <<>> +trace 94.98.252.193.in-addr.arpa
;; global options: +cmd
. 518170 IN NS a.root-servers.net.
. 518170 IN NS b.root-servers.net.
. 518170 IN NS c.root-servers.net.
. 518170 IN NS d.root-servers.net.
. 518170 IN NS e.root-servers.net.
. 518170 IN NS f.root-servers.net.
. 518170 IN NS g.root-servers.net.
. 518170 IN NS h.root-servers.net.
. 518170 IN NS i.root-servers.net.
. 518170 IN NS j.root-servers.net.
. 518170 IN NS k.root-servers.net.
. 518170 IN NS l.root-servers.net.
. 518170 IN NS m.root-servers.net.
. 518170 IN RRSIG NS 8 0 518400 20200828050000 20200815040000 46594 . gTxeJL73vMgMe35nmqGaiYawwDZkLH4fZsNpELvO1TFQdmI+wnGsGo51 Nky1l/D/6/qVsmeeJT8nCU3LxtBJz2MUzz0xOVpbVxvjzDtZl8rytxx/ 44PxWhY8fF/nyWkDhBJIuqSzvNOBbZKfVjNonSMRSyxjmQx9UR007vj+ E3SnS1ZBcvcY3ahlAXTBxDVj9Rq9ZJUQ+ZhI6lf7IeazxI54RNzcv1bk uzvOrJHHlJZhvFWHcW2iqsoVMD5l8EZOdJEFvnPNU05DNu1iHfPns1aQ HNsDs+CE++kr1aYRXZ6+5ggHWrSTXLkiiFUGgEt5Fnd3AZWBw1gHIFm/ S9L4CQ==
;; Received 525 bytes from 192.168.0.61#53(192.168.0.61) in 0 ms
in-addr.arpa. 172800 IN NS c.in-addr-servers.arpa.
in-addr.arpa. 172800 IN NS e.in-addr-servers.arpa.
in-addr.arpa. 172800 IN NS d.in-addr-servers.arpa.
in-addr.arpa. 172800 IN NS a.in-addr-servers.arpa.
in-addr.arpa. 172800 IN NS b.in-addr-servers.arpa.
in-addr.arpa. 172800 IN NS f.in-addr-servers.arpa.
in-addr.arpa. 86400 IN DS 53696 8 2 13E5501C56B20394DA921B51412D48B7089C5EB6957A7C58553C4D4D 424F04DF
in-addr.arpa. 86400 IN DS 63982 8 2 AAF4FB5D213EF25AE44679032EBE3514C487D7ABD99D7F5FEC3383D0 30733C73
in-addr.arpa. 86400 IN DS 47054 8 2 5CAFCCEC201D1933B4C9F6A9C8F51E51F3B39979058AC21B8DF1B1F2 81CBC6F2
in-addr.arpa. 86400 IN RRSIG DS 8 2 86400 20200828120000 20200815110000 57156 arpa. P0r9Ruc8yrZp5xbF4SuK2ZfdgS2rDYeD9pf3GHPhXlTlCSt/Rkuqss72 c6PGo9jq+QXl3xKZ7KbwfQRSCBUUP8t+bSCbte3EWj7yo+/qecED6Psu Ugm3Iu4mSMWq7h0eBE8OrJjoj+/3AqmCgfqSalXD+jKtVhfnhlyrU4fC rYrbQ1ClKAcY+KJWe4E/pu4sTypxFG1TpLtkRlTY9h20/9Z9E5Yiczjq 4g8EOVGVKlApmLmTQEAbcE5tBdVVoNLpbAN3mLaPJdOuK/pmX+ZnjdVQ iiPDWiXNxdBox/w+uyf+VmKGnp+cwEQdTMP/84ke5q8Ksvu/wDQenCHS fhI/Cw==
;; Received 895 bytes from 192.112.36.4#53(g.root-servers.net) in 28 ms
193.in-addr.arpa. 86400 IN NS ns3.lacnic.net.
193.in-addr.arpa. 86400 IN NS ns3.afrinic.net.
193.in-addr.arpa. 86400 IN NS ns4.apnic.net.
193.in-addr.arpa. 86400 IN NS pri.authdns.ripe.net.
193.in-addr.arpa. 86400 IN NS tinnie.arin.net.
193.in-addr.arpa. 86400 IN DS 5834 8 2 DC63ED42B4BDCE7325FF54FC712284A1D0CA5478C0F23DC5B69EAB75 8E60A947
193.in-addr.arpa. 86400 IN RRSIG DS 8 3 86400 20200824202029 20200803185732 49608 in-addr.arpa. V3u/aqkdEhuoYvwEt9RqI8ZQAMMAGjtW3ustbPsD6SKuLBY/bRzHtgGt EbR8XXC/KAB3TUg77tVxBw0yccIaat3Cf6lV+bd9RXU+8037GsrxjY/T o/eKQlE8DqBQYJfDR2qQfKyrPz2bU68iGn3h59W6XLFvpji+Nf32sqP1 7KM=
;; Received 410 bytes from 2001:500:87::87#53(b.in-addr-servers.arpa) in 48 ms
252.193.in-addr.arpa. 172800 IN NS ns7.oleane.net.
252.193.in-addr.arpa. 172800 IN NS ns6.oleane.net.
252.193.in-addr.arpa. 3600 IN NSEC 253.193.in-addr.arpa. NS RRSIG NSEC
252.193.in-addr.arpa. 3600 IN RRSIG NSEC 8 4 3600 20200824215056 20200810202056 39823 193.in-addr.arpa. aWEiQ6IYdinwTQVc+8tg8ysXW+FnWGnIgffmTqsoJ7QkIxNFOCNTZdoS YQl34Slpf1/Ml/Yw3Y2DmVngok4ZJMBxHYJs8Q4JkdBGb8HezoL0Mkun U4DwputXx/d3H0FPgvXq3tl/6o/TvzKQtJupn5BPPKQy1GcMA/9JZ6LJ m7E=
;; Received 367 bytes from 202.12.31.53#53(ns4.apnic.net) in 15 ms
98.252.193.in-addr.arpa. 86400 IN NS ns1.francetelecom.net.
98.252.193.in-addr.arpa. 86400 IN NS dns.francetelecom.net.
couldn't get address for 'ns1.francetelecom.net': not found
couldn't get address for 'dns.francetelecom.net': not found
dig: couldn't get address for 'ns1.francetelecom.net': no moreSi j'utilise le réseau de Free pour la résolution: (derriere Freebox)
Je change le routage (via PF sur un FreeBSD) et je passe les résolutions DNS via une Freebox sur le même LAN, une règle PF de ce type:
pass out quick on $eth0 route-to ($eth0 $routeurfreebox) proto { tcp, udp } from any to any port { 53 }
# mtr -4rw -c 5
www.orange.frStart: 2020-08-15T15:07:57+0200
HOST: rgw Loss% Snt Last Avg Best Wrst StDev
1.|-- livebox 0.0% 5 0.4 0.4 0.2 0.4 0.1
2.|--

100.0 5 0.0 0.0 0.0 0.0 0.0
3.|-- ae117-0.ncidf103.Puteaux.francetelecom.net 0.0% 5 2.1 4.1 2.1 6.1 1.9
4.|-- ae51-0.nridf101.Paris3eArrondissement.francetelecom.net 0.0% 5 2.6 3.4 2.3 7.1 2.0
5.|-- ae41-0.nrlyo201.Lyon3eArrondissement.francetelecom.net 0.0% 5 8.2 8.1 7.9 8.2 0.1
6.|-- ae43-0.nolyo101.Lyon3eArrondissement.francetelecom.net 0.0% 5 8.3 10.5 7.9 15.5 3.5
7.|-- 193.253.13.42 0.0% 5 16.0 16.8 15.8 20.0 1.8
8.|-- fw-bae01-v2999.echo.net.s1.p.fti.net 0.0% 5 16.0 15.9 15.7 16.0 0.2
9.|-- vip1.dyn.hpo.s1.fti.net 0.0% 5 16.3 16.0 15.7 16.3 0.3
# dig +trace 94.98.252.193.in-addr.arpa
; <<>> DiG 9.16.5 <<>> +trace 94.98.252.193.in-addr.arpa
;; global options: +cmd
. 518229 IN NS a.root-servers.net.
. 518229 IN NS b.root-servers.net.
. 518229 IN NS c.root-servers.net.
. 518229 IN NS d.root-servers.net.
. 518229 IN NS e.root-servers.net.
. 518229 IN NS f.root-servers.net.
. 518229 IN NS g.root-servers.net.
. 518229 IN NS h.root-servers.net.
. 518229 IN NS i.root-servers.net.
. 518229 IN NS j.root-servers.net.
. 518229 IN NS k.root-servers.net.
. 518229 IN NS l.root-servers.net.
. 518229 IN NS m.root-servers.net.
. 518229 IN RRSIG NS 8 0 518400 20200828050000 20200815040000 46594 . gTxeJL73vMgMe35nmqGaiYawwDZkLH4fZsNpELvO1TFQdmI+wnGsGo51 Nky1l/D/6/qVsmeeJT8nCU3LxtBJz2MUzz0xOVpbVxvjzDtZl8rytxx/ 44PxWhY8fF/nyWkDhBJIuqSzvNOBbZKfVjNonSMRSyxjmQx9UR007vj+ E3SnS1ZBcvcY3ahlAXTBxDVj9Rq9ZJUQ+ZhI6lf7IeazxI54RNzcv1bk uzvOrJHHlJZhvFWHcW2iqsoVMD5l8EZOdJEFvnPNU05DNu1iHfPns1aQ HNsDs+CE++kr1aYRXZ6+5ggHWrSTXLkiiFUGgEt5Fnd3AZWBw1gHIFm/ S9L4CQ==
;; Received 525 bytes from 192.168.0.61#53(192.168.0.61) in 0 ms
in-addr.arpa. 172800 IN NS a.in-addr-servers.arpa.
in-addr.arpa. 172800 IN NS b.in-addr-servers.arpa.
in-addr.arpa. 172800 IN NS c.in-addr-servers.arpa.
in-addr.arpa. 172800 IN NS d.in-addr-servers.arpa.
in-addr.arpa. 172800 IN NS e.in-addr-servers.arpa.
in-addr.arpa. 172800 IN NS f.in-addr-servers.arpa.
in-addr.arpa. 86400 IN DS 47054 8 2 5CAFCCEC201D1933B4C9F6A9C8F51E51F3B39979058AC21B8DF1B1F2 81CBC6F2
in-addr.arpa. 86400 IN DS 53696 8 2 13E5501C56B20394DA921B51412D48B7089C5EB6957A7C58553C4D4D 424F04DF
in-addr.arpa. 86400 IN DS 63982 8 2 AAF4FB5D213EF25AE44679032EBE3514C487D7ABD99D7F5FEC3383D0 30733C73
in-addr.arpa. 86400 IN RRSIG DS 8 2 86400 20200828120000 20200815110000 57156 arpa. P0r9Ruc8yrZp5xbF4SuK2ZfdgS2rDYeD9pf3GHPhXlTlCSt/Rkuqss72 c6PGo9jq+QXl3xKZ7KbwfQRSCBUUP8t+bSCbte3EWj7yo+/qecED6Psu Ugm3Iu4mSMWq7h0eBE8OrJjoj+/3AqmCgfqSalXD+jKtVhfnhlyrU4fC rYrbQ1ClKAcY+KJWe4E/pu4sTypxFG1TpLtkRlTY9h20/9Z9E5Yiczjq 4g8EOVGVKlApmLmTQEAbcE5tBdVVoNLpbAN3mLaPJdOuK/pmX+ZnjdVQ iiPDWiXNxdBox/w+uyf+VmKGnp+cwEQdTMP/84ke5q8Ksvu/wDQenCHS fhI/Cw==
;; Received 867 bytes from 2001:500:1::53#53(h.root-servers.net) in 33 ms
193.in-addr.arpa. 86400 IN NS ns3.lacnic.net.
193.in-addr.arpa. 86400 IN NS ns3.afrinic.net.
193.in-addr.arpa. 86400 IN NS ns4.apnic.net.
193.in-addr.arpa. 86400 IN NS pri.authdns.ripe.net.
193.in-addr.arpa. 86400 IN NS tinnie.arin.net.
193.in-addr.arpa. 86400 IN DS 5834 8 2 DC63ED42B4BDCE7325FF54FC712284A1D0CA5478C0F23DC5B69EAB75 8E60A947
193.in-addr.arpa. 86400 IN RRSIG DS 8 3 86400 20200824202029 20200803185732 49608 in-addr.arpa. V3u/aqkdEhuoYvwEt9RqI8ZQAMMAGjtW3ustbPsD6SKuLBY/bRzHtgGt EbR8XXC/KAB3TUg77tVxBw0yccIaat3Cf6lV+bd9RXU+8037GsrxjY/T o/eKQlE8DqBQYJfDR2qQfKyrPz2bU68iGn3h59W6XLFvpji+Nf32sqP1 7KM=
;; Received 410 bytes from 2001:67c:e0::1#53(f.in-addr-servers.arpa) in 41 ms
252.193.in-addr.arpa. 172800 IN NS ns7.oleane.net.
252.193.in-addr.arpa. 172800 IN NS ns6.oleane.net.
252.193.in-addr.arpa. 3600 IN NSEC 253.193.in-addr.arpa. NS RRSIG NSEC
252.193.in-addr.arpa. 3600 IN RRSIG NSEC 8 4 3600 20200824215056 20200810202056 39823 193.in-addr.arpa. aWEiQ6IYdinwTQVc+8tg8ysXW+FnWGnIgffmTqsoJ7QkIxNFOCNTZdoS YQl34Slpf1/Ml/Yw3Y2DmVngok4ZJMBxHYJs8Q4JkdBGb8HezoL0Mkun U4DwputXx/d3H0FPgvXq3tl/6o/TvzKQtJupn5BPPKQy1GcMA/9JZ6LJ m7E=
;; Received 347 bytes from 200.3.13.14#53(ns3.lacnic.net) in 221 ms
98.252.193.in-addr.arpa. 86400 IN NS dns.francetelecom.net.
98.252.193.in-addr.arpa. 86400 IN NS ns1.francetelecom.net.
;; Received 136 bytes from 2a01:c910:8005:1c::7#53(ns7.oleane.net) in 24 ms
98.252.193.in-addr.arpa. 86400 IN SOA dns.francetelecom.net. admdnsft.francetelecom.net. 2019041001 10800 3600 604800 86400
;; Received 121 bytes from 193.252.96.4#53(dns.francetelecom.net) in 25 ms
Bingo, la résolution fonctionne.# host dns.francetelecom.net.
dns.francetelecom.net has address 193.252.96.4
(depuis le réseau via la Livebox):
# ping -c 5 193.252.96.4
PING 193.252.96.4 (193.252.96.4): 56 data bytes
--- 193.252.96.4 ping statistics ---
5 packets transmitted, 0 packets received,
100.0% packet lossSi je me log (ssh) sur une machine chez Free dans un datacenter:
% ping -c 5 193.252.96.4
PING 193.252.96.4 (193.252.96.4): 56 data bytes
64 bytes from 193.252.96.4: icmp_seq=0 ttl=245 time=1.417 ms
64 bytes from 193.252.96.4: icmp_seq=1 ttl=245 time=1.275 ms
64 bytes from 193.252.96.4: icmp_seq=2 ttl=245 time=1.447 ms
64 bytes from 193.252.96.4: icmp_seq=3 ttl=245 time=1.315 ms
64 bytes from 193.252.96.4: icmp_seq=4 ttl=245 time=1.297 ms
--- 193.252.96.4 ping statistics ---
5 packets transmitted, 5 packets received,
0.0% packet lossround-trip min/avg/max/stddev = 1.275/1.350/1.447/0.069 ms
Conclusion, il y a du filtrage IP derrière les Livebox qui interdit de joindre
dns.francetelecom.net et ns1.francetelecom.net (donc impossible de résoudre
les reverses d'orange).
Aucun problème de résolution si je route la résolution DNS via la Freebox.
Si quelqu'un d'Orange peut confirmer que ce filtrage est volontaire ? pourquoi ?