[tlug] Ubuntu 14.04 bind9 local resolver problems

[Curt Sampson <cjs@example.com>]

My Linux boxes at home mostly are (or were) configured to use a local
bind9 instance for DNS resolution. Unfortunately, sometime in the last
few months, this has been failing badly.

The symptom is that a lot of web sites stop working. For example, I can
get as far as entering my Google authentication information when trying
to log in to trello.com, but then the web browser (Chrome, usually) just
sits and spins forever, or on Firefox I appear to be logged in but don't
see any of my boards.

I could provide a pile of other examples, but the key thing here is that
as soon as I change the "nameserver 127.0.0.1" in my /etc/resolv.conf to
"nameserver 192.168.187.1" (which is an Almond router, though I think
I've seen this issue with other routers as well), everything starts
working fine.

Looking at my logs, I get a lot of "network unreachable," messages,
such as:

  Nov 16 14:05:30 monotonic named[1365]: error (network unreachable) resolving 'mtalk.google.com.lan/A/IN': 198.41.0.4#53
  Nov 16 14:05:30 monotonic named[1365]: error (network unreachable) resolving 'mtalk.google.com.lan/A/IN': 192.228.79.201#53
  Nov 16 14:05:30 monotonic named[1365]: error (network unreachable) resolving 'mtalk.google.com.lan/A/IN': 192.33.4.12#53
  Nov 16 14:05:30 monotonic named[1365]: error (network unreachable) resolving 'mtalk.google.com.lan/A/IN': 199.7.91.13#53
  Nov 16 14:05:30 monotonic named[1365]: error (network unreachable) resolving 'mtalk.google.com.lan/A/IN': 192.203.230.10#53
  Nov 16 14:05:30 monotonic named[1365]: error (network unreachable) resolving 'mtalk.google.com.lan/A/IN': 192.5.5.241#53
  Nov 16 14:05:30 monotonic named[1365]: error (network unreachable) resolving 'mtalk.google.com.lan/A/IN': 192.112.36.4#53
  Nov 16 14:05:30 monotonic named[1365]: error (network unreachable) resolving 'mtalk.google.com.lan/A/IN': 128.63.2.53#53
  Nov 16 14:05:30 monotonic named[1365]: error (network unreachable) resolving 'mtalk.google.com.lan/A/IN': 192.36.148.17#53
  Nov 16 14:05:30 monotonic named[1365]: error (network unreachable) resolving 'mtalk.google.com.lan/A/IN': 192.58.128.30#53
  Nov 16 14:05:30 monotonic named[1365]: error (network unreachable) resolving 'mtalk.google.com.lan/A/IN': 193.0.14.129#53
  Nov 16 14:05:30 monotonic named[1365]: error (network unreachable) resolving 'mtalk.google.com.lan/A/IN': 199.7.83.42#53
  Nov 16 14:05:30 monotonic named[1365]: error (network unreachable) resolving 'mtalk.google.com.lan/A/IN': 202.12.27.33#53
  Nov 16 14:05:30 monotonic named[1365]: error (network unreachable) resolving 'mtalk.google.com.lan/A/IN': 2001:503:ba3e::2:30#53
  Nov 16 14:05:30 monotonic named[1365]: error (network unreachable) resolving 'mtalk.google.com.lan/A/IN': 2001:500:2d::d#53
  Nov 16 14:05:30 monotonic named[1365]: error (network unreachable) resolving 'mtalk.google.com.lan/A/IN': 2001:500:2f::f#53
  Nov 16 14:05:30 monotonic named[1365]: error (network unreachable) resolving 'mtalk.google.com.lan/A/IN': 2001:500:1::803f:235#53
  Nov 16 14:05:30 monotonic named[1365]: error (network unreachable) resolving 'mtalk.google.com.lan/A/IN': 2001:7fe::53#53
  Nov 16 14:05:30 monotonic named[1365]: error (network unreachable) resolving 'mtalk.google.com.lan/A/IN': 2001:503:c27::2:30#53
  Nov 16 14:05:30 monotonic named[1365]: error (network unreachable) resolving 'mtalk.google.com.lan/A/IN': 2001:7fd::1#53
  Nov 16 14:05:30 monotonic named[1365]: error (network unreachable) resolving 'mtalk.google.com.lan/A/IN': 2001:500:3::42#53
  Nov 16 14:05:30 monotonic named[1365]: error (network unreachable) resolving 'mtalk.google.com.lan/A/IN': 2001:dc3::35#53

Now, not being able to reach those IPv6 addresses is no surprise, given
that I don't have IPv6 Internet connectivity. But the claim of not being
able to reach these IPv4 addresses is both disturbing and implausible,
given who they are:

  4.0.41.198.in-addr.arpa domain name pointer a.root-servers.net.
  201.79.228.192.in-addr.arpa domain name pointer b.root-servers.net.
  12.4.33.192.in-addr.arpa domain name pointer c.root-servers.net.
  13.91.7.199.in-addr.arpa domain name pointer d.root-servers.net.
  10.230.203.192.in-addr.arpa domain name pointer e.root-servers.net.
  241.5.5.192.in-addr.arpa domain name pointer f.root-servers.net.
  4.36.112.192.in-addr.arpa domain name pointer G.ROOT-SERVERS.NET.
  53.2.63.128.in-addr.arpa domain name pointer h.root-servers.net.
  17.148.36.192.in-addr.arpa domain name pointer i.root-servers.net.
  30.128.58.192.in-addr.arpa domain name pointer j.root-servers.net.
  129.14.0.193.in-addr.arpa domain name pointer k.root-servers.net.
  42.83.7.199.in-addr.arpa domain name pointer l.root-servers.net.
  33.27.12.202.in-addr.arpa domain name pointer M.ROOT-SERVERS.NET.

Before I start diving more deeply into this using network traces and
other inconvenient things, anybody have any clues about what might
be going on?

cjs
-- 
Curt Sampson         <cjs@example.com>         +81 90 7737 2974

To iterate is human, to recurse divine.
    - L Peter Deutsch