My OpenDNS is not blocking web sites - Page 3

heintz_57 · ‎01-27-2015

I have reviewed the documentation and I am sill unable to get web sites blocked. My dashboard shows IP address 97.121.160.114, but my updater box shows IP address 198.105.244.23. I am sure i have a dynamic IP address which is why i have downloaded the updater. The DNS O Matic box is unchecked. Open DNS has worked for me for about a year and i recently discovered the web site protection is no longer functional. It seems to be a dynamic IP address issue, but i cannot figure out how to solve the problem. Thank you.

wrtdns · ‎06-30-2016

I have Successfully Configured OpenDN on OpenWRT Bleeding Edge r49296. The OpenDNS Welcome Page Confirms this with a Orange Checkmark and "Welcome to OpenDNS" message. However, The website blocks I have configured for youtube in the OpenDNS Dashboard are not effective. I did reboot my Router as well as restarted dnsmasq just to flush the cache. Still I can access youtube.However please do note, the sample domain www.internetbadguys.com is indeed blocked for me as it should be.

Can someone please help me shed some light here ?

Given bellow is the command output for the assorted commands requested above.

C:\Users>nslookup whoami.akamai.net.
5.c.2.5.4.8.e.f.f.f.b.4.a.a.2.2.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa
        primary name server = localhost
        responsible mail addr = nobody.invalid
        serial = 1
        refresh = 600 (10 mins)
        retry   = 1200 (20 mins)
        expire = 604800 (7 days)
        default TTL = 10800 (3 hours)
Server: UnKnown
Address: fe80::22aa:4bff:fe84:52c5

Non-authoritative answer:
Name:    whoami.akamai.net
Address: 208.69.36.11

C:\Users>netsh interface ip show dns

Configuration for interface "Local Area Connection* 4"
    DNS servers configured through DHCP: None
    Register with which suffix:           Primary only

Configuration for interface "Local Area Connection* 3"
    DNS servers configured through DHCP: None
    Register with which suffix:           Primary only

Configuration for interface "Ethernet"
    DNS servers configured through DHCP: 192.168.0.1
    Register with which suffix:           Primary only

Configuration for interface "Wi-Fi"
    DNS servers configured through DHCP: 192.168.0.1
    Register with which suffix:           Primary only

Configuration for interface "Loopback Pseudo-Interface 1"
    Statically Configured DNS Servers:    None
    Register with which suffix:           Primary only

C:\Users>nslookup -type=txt debug.opendns.com. 192.168.0.1
Server: Router.lan
Address: 192.168.0.1

Non-authoritative answer:
debug.opendns.com       text =

        "server 3.chi"
debug.opendns.com       text =

        "flags 20 0 50 1950000000000000000"
debug.opendns.com       text =

        "originid 50786617"
debug.opendns.com       text =

        "actype 2"
debug.opendns.com       text =

        "bundle 8884083"
debug.opendns.com       text =

        "source 63.153.220.194:52584"

rotblitz · ‎06-30-2016

As you can see, you use fe80::22aa:4bff:fe84:52c5 as your DNS resolver address which is not an OpenDNS address. So you use OpenDNS randomly at best.

As I said above on May 15, 2015, 11:09 already, you need to disable IPv6 connectivity on the router or on the computer. The enhanced features like content filtering and stats do not work with IPv6 yet. You can vote for IPv6 support here: https://support.opendns.com/entries/21786344

rotblitz · ‎06-30-2016

I may be partially wrong with my first section. This fe80::22aa:4bff:fe84:52c5 is your router's IPv6 DNS resolver address, and you may have configured your router with the OpenDNS IPv6 sandbox resolvers, because Akamai sees an OpenDNS Chicago router address 208.69.36.11 from you. But as you cannot register an IPv6 address at your dashboard, the second section still applies: you cannot use the enhanced features beyond pure recursive DNS with IPv6 yet.

wrtdns · ‎06-30-2016

Thank you RotBlitz. I appreciate you investing your time. Granted I had seen that point up above about IPV6.I had turned off the Wan6 Interface on OpenWRT as a result. However I didn't know what to look for in that result so I posted it here. Any chance you know or can guide me on what else to turn off in OpenWRT ? I don't know what that mac address or ipv6 address is or which interface is that.

Yes I do know, I should go post this on the openwrt forum instead of here. But I genuinely do not know what to ask there.

I did go vote on the link you provided.

wrtdns · ‎06-30-2016

After More Sleuthing around the OpenWRT settings, I now have,

C:\Users>nslookup whoami.akamai.net.
Server: Router.lan
Address: 192.168.0.1

Non-authoritative answer:
Name: whoami.akamai.net
Address: 208.69.36.11

So does that mean the IPV6 is shut down ? If so should the Filter apply now ?

rotblitz · ‎06-30-2016

"Yes I do know, I should go post this on the openwrt forum instead of here. But I genuinely do not know what to ask there."

Yes, this is your best bet. I can help you out. The simple question would be: "How does one disable IPv6 connectivity in OpenWRT?"

In addition, you could ask the more complex question: "Is it possible to force DNS traffic to go out over IPv4 instead of IPv6?"
If someone had an answer for this, you'd really be fine, because you could still use IPv6 connectivity for everything else except for DNS traffic.
This would be the ideal solution as long as OpenDNS do not support IPv6 for the enhanced features.

"I did go vote on the link you provided."

Great, thanks, this helps us all who would be able to use IPv6 but cannot yet if wanting to use OpenDNS.

wrtdns · ‎06-30-2016

Thank you. I will go ask that question. Now that you explained it, it makes sense to me.

Did you see second post I made since then after removing the IPV6 ?

rotblitz · ‎06-30-2016

"So does that mean the IPV6 is shut down ? If so should the Filter apply now ?"

Not sure, this could be a random result. What does this command return?

nslookup whoami.akamai.net. fe80::22aa:4bff:fe84:52c5

wrtdns · ‎06-30-2016

C:\Users>nslookup whoami.akamai.net. fe80::22aa:4bff:fe84:52c5
DNS request timed out.
    timeout was 2 seconds.
Server: UnKnown
Address: fe80::22aa:4bff:fe84:52c5

DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
*** Request to UnKnown timed-out

rotblitz · ‎07-01-2016

It looks like that DNS traffic via IPv6 is not possible anymore. IPv6 is shutdown at least for DNS. This is what you want unless it causes any kind of trouble instead of meeting your expectations about content filtering.

wrtdns · ‎07-01-2016

Thanks for confirming. Since my ISP does not issue IPV6 addresses anyway, I shut down that interface.

However, youtube is still not gone. For a minute I got "Unable to connect" error on that website. It did not give the OpenDNS Block page with my custom message. So I changed the block page back to default and tried again. This time youtube was back.

wrtdns · ‎07-01-2016

Correction, after flushing DNS with

/etc/init.d/dnsmasq restart

youtube appears gone again. I still get "Unable to connect" in firefox instead of OpenWRT Block Page.

wrtdns · ‎07-01-2016

Oh and, youtube app on Android is still able to access content.

rotblitz · ‎07-01-2016

Yes, your problem with YouTube was a caching problem. If you want settings changes to take effect immediately, you must always flush your local resolver cache and your browser cache, else you will be served with outdated content from these caches.

"I still get "Unable to connect" in firefox instead of OpenWRT Block Page."

Did you mean "OpenDNS Block Page" instead? Nothing is easier than to prove if this is a DNS problem our a browser problem:

nslookup www.youtube.com.

If this returns an OpenDNS IP address, then it is blocked by OpenDNS, no matter what the browser makes out of it. The rest is a browser problem.

"Oh and, youtube app on Android is still able to access content."

I have seen that many smart device apps use IP addressing instead of hostnames which means they do not make use of DNS. Nothing what goes to OpenDNS then, so OpenDNS cannot do anything for you. Your option is to block the related IP address ranges on the router.

wrtdns · ‎07-01-2016

Thanks for taking the time.

1. Yes I was going to say OPENDNS Block page but wrote OpenWRT instead. There's no way to edit these posts.

2. Output of the command is

C:\Users>nslookup www.youtube.com.
Server: Router.lan
Address: 192.168.0.1

Non-authoritative answer:
Name: www.youtube.com
Addresses: 146.112.61.104
146.112.61.104

I don't think that's a OpenDNS IP. It does not appear to be Youtube IP either. From what I can tell, for every device, my Router is the DNS lookup. I want this to be the case anyway.

As to Smart Devices, you could be right. If I search for youtube on google and click one of the resulting links, I can still access Youtube.