My OpenDNS is not blocking web sites

[heintz_57]

I have reviewed the documentation and I am sill unable to get web sites blocked.  My dashboard shows IP address 97.121.160.114, but my updater box shows IP address 198.105.244.23.  I am sure i have a dynamic IP address which is why i have downloaded the updater.  The DNS O Matic box is unchecked.  Open DNS has worked for me for about a year and i recently discovered the web site protection is no longer functional.  It seems to be a dynamic IP address issue, but i cannot figure out how to solve the problem.  Thank you.

[rotblitz]

Yes, the complete outputs of these diagnostic commands are useful to indentify most problems with OpenDNS not working as expected.

[rcheetham]

I am having the same problem. This started happening a week or two ago.

I have checked my router - it's a D-Link DIR-859. IPv6 is not configured; the DNS 1 and 2 addresses are set to 208.67.220.220 and 208.67.222.222 respectively. There is no 3rd DNS address.

I hit the welcome.opendns.com page. It says I am using OpenDNS.

I checked the network address in my updater and it matches my actual address, and it shows on the settings for my network correctly on the OpenDNS dashboard.

I ran the nslookup -type=txt debug.opendns.com command: here's the output.

C:\Users\Mary>nslookup -type=txt debug.opendns.com
Server: resolver1.opendns.com
Address: 208.67.222.222

Non-authoritative answer:
debug.opendns.com text =

"server 9.yyz"
debug.opendns.com text =

"flags 20 0 70 5950800000000000000"
debug.opendns.com text =

"originid 0"
debug.opendns.com text =

"actype 0"
debug.opendns.com text =

"source 204.237.1.57:12628"

I have my filter set to block video sharing, but www.youtube.com and www.vimeo.com and others load up like nothing was wrong.

I then changed the DNS resolver addresses for the network adapters on my machine to directly reference the OpenDNS servers. 

C:\Users\Mary>netsh interface ip show dns

Configuration for interface "Wireless Network Connection"
Statically Configured DNS Servers: 208.67.222.222
208.67.220.220
Register with which suffix: Primary only

Configuration for interface "Local Area Connection"
Statically Configured DNS Servers: 208.67.222.222
208.67.220.220
Register with which suffix: Primary only

Configuration for interface "Loopback Pseudo-Interface 1"
Statically Configured DNS Servers: None
Register with which suffix: None

I'm confused. What am I missing in my config? 

[mark32467]

I have a similar situation, although OpenDNS had been configured and working until recently. My current IP address and my network IP address still match. Would appreciate some guidance. Diagnostic command results are:

C:\Users\mborr>nslookup -type=txt debug.opendns.com. 208.67.220.220
Server: resolver2.opendns.com
Address: 208.67.220.220

Non-authoritative answer:
debug.opendns.com text =

"server 1.sea"
debug.opendns.com text =

"flags 20 0 50 19500007C00400014C3"
debug.opendns.com text =

"originid 46933777"
debug.opendns.com text =

"actype 2"
debug.opendns.com text =

"bundle 8711365"
debug.opendns.com text =

"source 174.25.174.46:59651"

C:\Users\mborr> nslookup whoami.akamai.net.
Server: modem.domain
Address: 192.168.0.1

Non-authoritative answer:
Name: whoami.akamai.net
Address: 198.36.160.3

C:\Users\mborr>netsh interface ip show dns

Configuration for interface "Local Area Connection 3"
DNS servers configured through DHCP: None
Register with which suffix: Primary only

Configuration for interface "Local Area Connection* 32"
DNS servers configured through DHCP: None
Register with which suffix: Primary only

Configuration for interface "Local Area Connection 2"
DNS servers configured through DHCP: 192.168.0.1
192.168.0.1
208.67.222.222
Register with which suffix: Primary only

Configuration for interface "Loopback Pseudo-Interface 1"
Statically Configured DNS Servers: None
Register with which suffix: Primary only

[rotblitz]

Your router modem.domain at 192.168.0.1 uses QWest's resolver 198.36.160.3, not OpenDNS.  Ensure that you configured only OpenDNS addresses, and that you filled all DNS fields with OpenDNS addresses.

Btw, for you the first command would have been:  nslookup -type=txt debug.opendns.com.     (without 208.67.220.220)
It would have returned "non-existent domain".

[rotblitz]

"My current IP address and my network IP address still match. "

Fine, but this is irrelevant at this stage, as long as you don't use OpenDNS.  Your settings cannot take effect.  You must first use OpenDNS.

[mark32467]

@rotblitz: My modem settings have not changed. It's still set to use 208.67.220.220 & 208.67.222.222 as the primary and secondary DNS. OpenDNS blocking had been working for several months. Now, apparently QWest's resolver  at 198.36.160.3 is overriding OpenDNS. Any thoughts as to how I can correct this?

[rotblitz]

Maybe, if we knew the exact model you're using and had a link to its user manual...

[mattwilson9090]

Contact Qwest. It's very likely that they are hijacking your DNS traffic and redirecting it to their own DNS servers. If they are, and they won't stop doing this you should look into running DNSCrypt

[mark32467]

@rotblitz: The user manual can be found here - https://internethelp.centurylink.com/internethelp/modem-c2100t.html.

@mattwilson9090: I contacted CenturyLink and the rep said that would not be the case.

Thanks

[mark32467]

@rotblitz: I ran a second nslookup and got a different result on that IP:

C:\Users\mborr>nslookup whoami.akamai.net

Server: modem.domain
Address: 192.168.0.1

Non-authoritative answer:
Name: whoami.akamai.net.foxracing.com
Address: 146.20.29.44

[rotblitz]

That command was wrong, without the trailing dot.  Therefore you didn't query whoami.akamai.net, but whoami.akamai.net.foxracing.com, i.e. by adding some DNS suffix.  Therefore it returned the result for the wildcard domain foxracing.com.  This is of no use.

That user manual split over dozens of web pages is not handy enough for me.  Too lazy to work though it.  I was looking for a PDF document with a useful index.  You may want to post a screen shot instead of the page where the OpenDNS addresses are configured.

And no, your DNS is not hi-jacked, as can be clearly seen by one of your earlier command outputs.

[mark32467]

@rotblitz: Please see attached.

DHCP Settings.JPG

[rotblitz]

This looks good.  Can you also post the WAN status page if something like this exists?

[mark32467]

@rotblitz: Success! Looking at the WAN settings page for the Centurylink c2100t modem, the default set in the ISP Protocol dropdown was "Auto Select". At that level, no additional configurations are visible, but I noticed that it displayed "IPoE" as the protocol selected. So I chose IPoE from the menu and that opened up additional configuration options (see attached). By selecting the Static DNS button under IPv4 DNS Type, I was able to enter the OpenDNS IP addresses and after applying that change, I was back to using OpenDNS. Thanks for the help! 

WAN Settings.JPG

[rotblitz]

Excellent, well done!