DNS filtering issue

[gjf]

Strange situation with RT-AC66U.

A few days ago Comodo Dome Shield was released so I would like to use it in our office network.
I have switched off built-in DNS Filtering, added external IP of my router to Comodo Dome Shiled system and changed a security policy.
DNS servers were changed to 8.26.56.10 and 8.20.247.10.
Anyway Comodo Dome Shield does not show any connection from my IP. Performing nslookup at router I see:

Server: 127.0.0.1
Address 1: 127.0.0.1 localhost.localdomain

Name: www.google.com
Address 1: 2a00:1450:400d:807::2004 bud02s22-in-x04.1e100.net
Address 2: 173.194.113.212
Address 3: 173.194.113.211
Address 4: 173.194.113.210
Address 5: 173.194.113.209
Address 6: 173.194.113.208

Why DNS server IP is 127.0.0.1? Why it is not changed to my settings?

 

[ColinTaylor]

Performing nslookup at router I see:

Why DNS server IP is 127.0.0.1?

Because of what you just said.

 

[gjf]

Very funny.
If the router cannot show the real DNS IP it is using - what is the sense in

Query the nameserver for the IP address of the given host using a specified DNS server.

 

[ColinTaylor]

Query the nameserver for the IP address of the given host using a specified DNS server.

Because you haven't specified a DNS server. So by default the router will use the nameserver specified in /etc/resolv.conf, which is 127.0.0.1.

# cat /etc/resolv.conf
nameserver 127.0.0.1
nameserver ::1

Unspecified server:

# nslookup google.co.uk
Server:    127.0.0.1
Address 1: 127.0.0.1 localhost.localdomain

Name:      google.co.uk
Address 1: 2a00:1450:4009:80c::2003 lhr35s07-in-x03.1e100.net
Address 2: 216.58.204.3 lhr35s07-in-f3.1e100.net

Specified server:

# nslookup google.co.uk 8.8.8.8
Server:    8.8.8.8
Address 1: 8.8.8.8 google-public-dns-a.google.com

Name:      google.co.uk
Address 1: 2a00:1450:4009:813::2003 lhr26s04-in-x03.1e100.net
Address 2: 216.58.210.35 lhr25s11-in-f3.1e100.net

Edit: Or to put it another way; the nslookup command tells you what server it (the "nslookup" command) is using, not what server the router (dnsmasq) is using.

 

[john9527]

The router is acting as a caching DNS server via dnsmasq...so nslookup is returning correct information. The router internally will use the nameservers you specify to populate its cache and do the lookups. You can verify your nameservers are being used by looking in the syslog for 'using nameserver' logs. For example

Jan 27 05:17:34 dnsmasq[3844]: using nameserver 209.222.18.222#53
Jan 27 05:17:34 dnsmasq[3844]: using nameserver 209.222.18.218#53

 

[gjf]

Damn, didn't know the DNS should be specified in a string. Thank you.