I am connected, but I cannot connect to the Internet

[Nakaya_kita]

I have been able to connect to the internet for four days without any problems after the topic and support, but when I woke up this morning and was listening to music on Youtube, the internet disconnected. Same situation as the topic.

After that, I tried a loose security setting and was able to get to the DHCP address assignment, but I cannot connect to the internet. I didn’t touch the network settings, I was only browsing the internet, but is it possible to get into a situation where I can connect to the internet again?

It was a low security command,

Blockquote qvm-pci attach --persistent --option permissive=true --option no-strict-reset=true sys-usb dom0:xx_xx.x

This one goes through,

qvm-pci detach sys-net ‘qvm-pci attach -ono-strict-reset=True --persistent sys-net dom0:09_00.0’

Here there is no net connection, but only a connection, and after rebooting the network icon is crossed(x).

I am not sure why there is suddenly no internet connection, but I would like to know if there is a solution to this problem. The commands with lax security were registered in the DHCP Lerease of PFSense.

[solene]

@Nakaya_kita

After that, I tried a loose security setting and was able to get to the DHCP address assignment, but I cannot connect to the internet. I didn’t touch the network settings, I was only browsing the internet, but is it possible to get into a situation where I can connect to the internet again?

Did you try to ping the internet from your PfSense router to check if it’s not an ISP issue?

[Nakaya_kita]

Ping seems to be coming through, I haven’t changed the PFSense settings, but I will look at the firewall logs etc. Thanks.

[Nakaya_kita]

Communication seems to be possible in the FW logs. But the website does not appear and I get DNS_PROBE_POSSIBLE. Mystery…

[apparatus]

Maybe you have a problem with DNS configuration in PFSense.
Try to use some public DNS server (e.g. 9.9.9.9) in sys-net for a test when ping 9.9.9.9 works but you can’t access websites.

[Nakaya_kita]

Thanks. I set the additional DNS to 9.9.9.9.9 from the connection settings. 9.9.9.9/ICMP is still in the FW logs. 9.9.9.9.9/ICMP also passes in ping. DNS queries are also seen by PFSense, but 9.9.9.9.9 is not shown. I am not sure about that.

[apparatus]

Try to resolve the domain using specific DNS server, for example:

dig debian.org @9.9.9.9

And then try to resolve domain using your PFSense DNS server:

dig debian.org @192.168.1.1

[Nakaya_kita]

Hmm, I get a missing dig command. Is there any other way to do this?

[Nakaya_kita]

I don’t understand what it means, but the internet is back on now. The settings hadn’t been changed since before I went to bed yesterday, and I wonder if it can be fixed over time.

[apparatus]

You can install dig package in template if internet is working.
Or you can edit /etc/resolv.conf and remove or comment out all nameservers and then add specific nameserver:
nameserver 9.9.9.9
or
nameserver 192.168.1.1
And then try to resolve domain with browser or curl in this qube:
curl https://debian.org

@Nakaya_kita

I wonder if it can be fixed over time.

Maybe if it’s your ISP transient issue.
Or maybe something is wrong in PFSense DNS server configuration.

[solene]

I think there was a major change in DNS root servers in the last days (and it didn’t went well)

[Nakaya_kita]

Thank you, I have installed dig and will try to use it if there is another fault, I have a SoftbankAir contract, maybe there is something wrong with the line or on Softbank’s side.

[Nakaya_kita]

Thank you. When it comes to the root server, I am using CloudFlare addresses 1.1.1.1 and 1.0.0.1 (I think), but there may have been a fault with this address or a higher-level DNS server. The previous one was improved by detach/attach, but this time the problem may be considered to be caused by the DNS root server side.

[Nakaya_kita]

Further information. I’m not connected to the internet again,

Blockquote sudo nano In /etc/resolv.conf,

if I set the address to 9.9.9.9, it connects, but if I set it to 192.168.1.1, it does not seem to connect. The connection was not possible with the default address set, but 9.9.9.9 is ok.

I would like to continue with this setting, but I have a bit of a question, or rather I would like to know why I can no longer connect to the internet without changing the settings in this way.

I also tried to put dig in untrusted, but neither

sudo apt install dig
sudo apt-get install dig

could install it.

[apparatus]

@Nakaya_kita

if I set the address to 9.9.9.9, it connects, but if I set it to 192.168.1.1, it does not seem to connect. The connection was not possible with the default address set, but 9.9.9.9 is ok.

Did you change PFSense DNS configuration recently? You wanted to change its DNS to use DoT:

Is the AppVM DNS a DoT ? or shoud i set up DoT in PFSense

Perhaps all QubesOS AppVMs use encrypted DNS rather than DNS using 53, but even though VirtualDNS is used when communicating between AppVMs, I don’t know what is actually used in crypt / not crypt DNS when communicating with the internet. However, although VirtualDNS is used when communicating between AppVMs, it is not clear what is actually used in what DNS when communicating with the Internet. Therefore, I am thinking whether I should implement DoT on the PFSense side, so that DNS requests co…

Maybe your DoT configuration is a problem?

[Nakaya_kita]

Thanks for continuing, my PFSense DNS settings have always been set to 1.0.0.2 and 1.1.1.2. Yes, I was getting DNS Probe errors in Firefox on QubesOS, so there may be something wrong on the PFSense settings side, I’ll ask on the PFSense forums, although there may be a duplicate problem with DNSSEC being turned on. …

[apparatus]

You can try to set some other DNS servers instead of 1.0.0.2 and 1.1.1.2 in PFSense in case it’s a problem with these servers.

[Nakaya_kita]

Thank you! You were right, it seems that the DNS Server address set in PFSense was the cause, I left the DNS Server checkbox setting on the PFSense side as is, changed the address used to 1.1.1.1/1.0.0.1 and changed the nameserver setting to the default setting in QubesOS. nameserver has also been returned to the default settings, but communication is still possible without problems.

The 1.0.0.2 and 1.1.1.2 settings were used because they were introduced in a tutorial published by a Youtuber, but when I looked into it, I found that they are addresses used in malware blocking. As for me, I just want to be able to DoH/DoT, so I will continue with this setting.