Can't use 2 Degrees DNS after Router Change

Forums › 2degrees (including Slingshot, Orcon, Flip, Stuff Fibre, MyRepublic, 2talk and Vocus) › Can't use 2 Degrees DNS after Router Change

woollettg

50 posts

Geek

#250619 19-May-2019 10:09

Recently I changed my Mikrotik Edge router out for another one. Setup the pppoe connection, but found only Android devices had internet.

As a stop gap I disabled the peer DNS setting and am now using Google DNS 8.8.8.8 & 8.8.4.4 for everything, now non Android machines have internet.

The 2Degrees server when queried gives this response -

dig @202.37.101.1 www.stuff.co.nz

; <<>> DiG 9.11.3-1ubuntu1.7-Ubuntu <<>> @202.37.101.1 www.stuff.co.nz
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 58919
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.stuff.co.nz. IN A

;; Query time: 5 msec
;; SERVER: 202.37.101.1#53(202.37.101.1)
;; WHEN: Sun May 19 09:57:42 NZST 2019
;; MSG SIZE rcvd: 44

Google gives me this-

dig @8.8.8.8 www.stuff.co.nz

; <<>> DiG 9.11.3-1ubuntu1.7-Ubuntu <<>> @8.8.8.8 www.stuff.co.nz
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18081
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;www.stuff.co.nz. IN A

;; ANSWER SECTION:
www.stuff.co.nz. 3230 IN CNAME fairfaxmedia.co.nz.edgekey.net.
fairfaxmedia.co.nz.edgekey.net. 134 IN CNAME e14449.dsce2.akamaiedge.net.
e14449.dsce2.akamaiedge.net. 19 IN A 23.43.156.140

;; Query time: 166 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Sun May 19 10:03:23 NZST 2019
;; MSG SIZE rcvd: 142

It looks like my new router is not in their whitelist or similar

When ringing the 2 Degrees helpdesk I get the standard "plug in your FritzBox" line which isn't helpful.

I would prefer to be able to use 2D DNS. Can anyone here from 2 Degrees offer some help?

Kind Regards

Graeme

fe31nz

1228 posts

Uber Geek

#2241055 19-May-2019 23:29

You could try telling the new router to spoof the MAC address of your FritzBox.

ripdog

548 posts

Ultimate Geek
Inactive user

#2241101 20-May-2019 00:35

There's no need to spoof MAC. I can use 2deg DNS, and my router is a custom box with pfsense.

cyril7

9058 posts

Uber Geek

ID Verified

Trusted

Subscriber

#2241105 20-May-2019 06:45

Hi Graeme, have you checked if your new router is undesirably responding to DNS requests on its WAN port, if so you might need to adjust the firewall rules.

From an outside connection use nmap or from in or outside use openresolver.com to test.

Only reason I mention that is the Warning in the first dig request.

Cyril

woollettg

50 posts

Geek

#2241139 20-May-2019 08:55

Thanks for the replies.

I've run GRC Shields up and all ports up to 1055 are stealth including port 53.

I'd prefer not to change the MAC of my PPPOE client unless I really have to.

I'll see if I can get hold of Nick Mack.

Graeme

Aredwood

3885 posts

Uber Geek

#2241214 20-May-2019 11:21

Have you actually tried testing with a Fritzbox? As that would be the easiest way to see if it actually is a router issue or not.

No point in spoofing the MAC address, as they are only visible at layer 2.

Maybe you have triggered the DDOS mitigation system that 2degrees have? Try accessing Google.com

woollettg

50 posts

Geek

#2241241 20-May-2019 11:52

I didn't try the Fritzbox. I sort of knew that because I could use Google DNS it was most likely a trust relationship that had been broken by swapping hardware.

In the meantime Nick from 2 Degrees has made a change at their end and dig now returns the expected result.

Will do some re-configuration when I have a moment to make sure things are really fixed, but looks good so far

Thanks

Graeme

sbiddle

30853 posts

Uber Geek

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#2241243 20-May-2019 11:56

Swapping hardware won't do it. You've potentially done something that has triggered DDOS mitigation or similar.

Equinox IT

Cloud spending continues to surge globally, but most organisations haven’t made the changes necessary to maximise the value and cost-efficiency benefits of their cloud investments. Download the whitepaper From Overspend to Advantage now.

woollettg

50 posts

Geek

#2241385 20-May-2019 13:19

Quite possibly triggered something like that. I know enough about networks to get myself into trouble. 😮

I love the flexibility of the mikrotik gear, but it can be pretty unforgiving when you get it wrong.

Nick didn't mention what had happened, just that it should be resolved.