Can ping, but no browsing?

[Choc Top]

Playing around with some old equipment at home, I have this setup but am unable to browse the net. Pretty basic setup but i'm unsure how I have misconfigured?

Both the 7301 router and laptop can ping out but thats the extent of the connectivity

Cable Modem w/ Dynamic IP

   |

Router

 - GigabitEthernet0/0 - Dynamic IP picked up.

 - GigabitEthernet0/1- Unused

 - GigabitEthernet0/2 - 192.168.0.254 to Laptop

   |

Laptop - 192.168.0.200

 - DG 192.168.0.254

 - DNS 192.168.0.254

---------------------------------------------------

version 15.2
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec
service timestamps log datetime msec
!
no aaa new-model
clock timezone utc 10 0
no ip source-route
ip options drop
!
ip dhcp bootp ignore
!
no ip bootp server
no ip domain lookup
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
interface GigabitEthernet0/0
description To-Modem
ip address dhcp
ip nat outside
no ip route-cache
media-type rj45
speed auto
duplex auto
no negotiation auto
no cdp enable
!
interface GigabitEthernet0/1
no ip address
no ip route-cache
shutdown
media-type rj45
speed auto
duplex auto
no negotiation auto
!
interface GigabitEthernet0/2
description To-Laptop
ip address 192.168.0.254 255.255.255.0
ip nat inside
no ip route-cache
media-type rj45
speed auto
duplex auto
no negotiation auto
!
ip nat inside source list 5 interface GigabitEthernet0/0 overload
ip forward-protocol nd
!
no ip http server
no ip http secure-server
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0
!
access-list 5 permit 192.168.0.0 0.0.0.255
access-list 5 deny any
access-list 10 permit 192.168.0.0 0.0.0.255
access-list 10 deny any log
!
control-plane
!
parser config cache interface
!
line con 0
logging synchronous
transport preferred none
escape-character 3
stopbits 1
line aux 0
exec-timeout 0 1
no exec
transport output none
stopbits 1
line vty 0 4
access-class 10 in
exec-timeout 40 0
password cisco
logging synchronous
login
transport input all
line vty 5 10
access-class 10 in
exec-timeout 40 0
password cisco
logging synchronous
login
!
end

--------------------------

#sho ip int
GigabitEthernet0/0 is up, line protocol is up
Internet address is 110.23.x.x/22
Broadcast address is 255.255.255.255
Address determined by DHCP
MTU is 1500 bytes
Helper address is not set
Directed broadcast forwarding is disabled
Outgoing access list is not set
Inbound access list is not set
Proxy ARP is enabled
Local Proxy ARP is disabled
Security level is default
Split horizon is enabled
ICMP redirects are always sent
ICMP unreachables are always sent
ICMP mask replies are never sent
IP fast switching is disabled
IP Flow switching is disabled
IP CEF switching is disabled
IP Null turbo vector
IP Null turbo vector
Associated unicast routing topologies:
Topology "base", operation state is UP
IP multicast fast switching is disabled
IP multicast distributed fast switching is disabled
IP route-cache flags are No CEF
Router Discovery is disabled
IP output packet accounting is disabled
IP access violation accounting is disabled
TCP/IP header compression is disabled
RTP/IP header compression is disabled
Probe proxy name replies are disabled
Policy routing is disabled
Network address translation is enabled, interface in domain outside
BGP Policy Mapping is disabled
Input features: NAT Outside, MCI Check
Output features: Post-routing NAT Outside
WCCP Redirect outbound is disabled
WCCP Redirect inbound is disabled
WCCP Redirect exclude is disabled
GigabitEthernet0/1 is administratively down, line protocol is down
Internet protocol processing disabled
GigabitEthernet0/2 is down, line protocol is down
Internet address is 192.168.0.254/24
Broadcast address is 255.255.255.255
Address determined by setup command
MTU is 1500 bytes
Helper address is not set
Directed broadcast forwarding is disabled
Outgoing access list is not set
Inbound access list is not set
Proxy ARP is enabled
Local Proxy ARP is disabled
Security level is default
Split horizon is enabled
ICMP redirects are always sent
ICMP unreachables are always sent
ICMP mask replies are never sent
IP fast switching is disabled
IP Flow switching is disabled
IP CEF switching is disabled
IP Null turbo vector
IP Null turbo vector
Associated unicast routing topologies:
Topology "base", operation state is UP
IP multicast fast switching is disabled
IP multicast distributed fast switching is disabled
IP route-cache flags are No CEF
Router Discovery is disabled
IP output packet accounting is disabled
IP access violation accounting is disabled
TCP/IP header compression is disabled
RTP/IP header compression is disabled
Probe proxy name replies are disabled
Policy routing is disabled
Network address translation is enabled, interface in domain inside
BGP Policy Mapping is disabled
Input features: MCI Check
Output features: NAT Inside
WCCP Redirect outbound is disabled
WCCP Redirect inbound is disabled
WCCP Redirect exclude is disabled

[Mark Malone]

Whos running the full DNS service  thats most likely the issue if ping is working but cant resolve to a name to browse  via http ?

who ever is doing the DHCP should prob do th DNS too

[Julio E. Moisa]

Hi

Your configuration looks fine, try using the Google public DNS 8.8.8.8 and 4.2.2.2 on the laptop. 

[EPHRAIM MANI]

Hi Choc,

were you able to resolve this problem.....

I do not to show that 192.168.0.254 (router) is configured for  DNS server (respond to DNS queries)

if you want to use 192.168.0.254 as DNS resolver you need to configure it as DNS server alternativiely you can use publicly avaialble DNS server as addivsed by the earlier posters.

~EM

[Choc Top]

Hi,

I have tried a few combinations of my ISP and Google name-servers applied to the router, however none of them resolve host names?

IP's are pingable, but not host names from the router. I have not bothered to try the laptop until the router can do anything.

Silly question but should I try a reload after applying the name-server during testing? Does it someone how need to bind it self to the outgoing interface?

[Mark Malone]

You have domain-lookup turned off , should be on for DNS resolves
you don't need to reboot just save it

You could also create a dhcp pool on the router and specific the Google DNS servers there it will work that way too

https://www.cisco.com/c/en/us/support/docs/ip/domain-name-system-dns/24182-reversedns.html#topic2

ip domain lookup

[Choc Top]

Thanks for responses so far.

However I am not much better off.

I have independently applied both Googles and my ISPs DNS, along with ip domain lookup to no avail.

The laptop is still unable to ping domains, only IPs.

The router can ping domains but not always 100%....

Router
------------------------------
7301#ping news.com.au
Translating "news.com.au"...domain server (198.142.152.164) [OK]

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 104.72.70.82, timeout is 2 seconds:
!!.!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 36/101/196 ms

7301#
7301#ping news.com.au
Translating "news.com.au"...domain server (198.142.152.164) [OK]

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 104.72.70.82, timeout is 2 seconds:
!!.!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 24/64/112 ms

7301#ping news.com.au
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 104.72.70.82, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 24/49/68 ms

7301#ping news.com.au
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 104.72.70.82, timeout is 2 seconds:
!!.!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 36/50/56 ms

7301#ping theage.com.au
Translating "theage.com.au"...domain server (198.142.152.164) [OK]
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 54.230.243.187, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 44/97/176 ms

7301#ping theage.com.au
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 54.230.243.187, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 44/62/88 ms

7301#ping theage.com.au
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 54.230.243.187, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 40/70/112 ms

7301#ping theage.com.au
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 54.230.243.187, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 48/68/104 ms

------------------------------

On the laptop I have tried using the DHCP pool with Google and ISP DNS with no luck.

Assigning static DNS to the laptop netted the same results.

Windows diag stats the DNS server is not responding wheteher it is set to 192.168.0.254 or 8.8.8.8 or ISP DNS.

Here is my current config...

7301#sho run
Building configuration...

Current configuration : 2092 bytes
!
! Last configuration change at 08:39:59 UTC Tue Sep 19 2017
!
version 15.2
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec
service timestamps log datetime msec
!
hostname 7301
!
!
enable secret 5 xxxxxxxxxxxxxxxx
!
no aaa new-model
no ip source-route
ip options drop
!
!
!
ip dhcp bootp ignore
ip dhcp excluded-address 192.168.0.1
ip dhcp excluded-address 192.168.0.254
!
ip dhcp pool LAN
network 192.168.0.0 255.255.255.0
default-router 192.168.0.254
dns-server 8.8.8.8
!
!
no ip bootp server
ip name-server 8.8.8.8
ip name-server 4.2.2.2
ip cef
no ipv6 cef
!
!
multilink bundle-name authenticated
!
!
interface GigabitEthernet0/0
description To-Modem
ip address dhcp
ip nat outside
no ip route-cache
media-type rj45
speed auto
duplex auto
no negotiation auto
no cdp enable
!
interface GigabitEthernet0/1
no ip address
no ip route-cache
shutdown
media-type rj45
speed auto
duplex auto
no negotiation auto
!
interface GigabitEthernet0/2
description To-Laptop
ip address 192.168.0.254 255.255.255.0
ip nat inside
no ip route-cache
media-type rj45
speed auto
duplex auto
no negotiation auto
!
ip nat inside source list 5 interface GigabitEthernet0/0 overload
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0
!
access-list 5 permit 192.168.0.0 0.0.0.255
access-list 5 deny any
access-list 10 permit 192.168.0.0 0.0.0.255
access-list 10 deny any log
!
!
!
control-plane
!
parser config cache interface
!
line con 0
logging synchronous
transport preferred none
escape-character 3
stopbits 1
line aux 0
exec-timeout 0 1
no exec
transport output none
stopbits 1
line vty 0 4
access-class 10 in
exec-timeout 40 0
password cisco
logging synchronous
login
transport input all
line vty 5 10
access-class 10 in
exec-timeout 40 0
password cisco
logging synchronous
login
!
!
end
-------------------------------------

7301#sho ip int
GigabitEthernet0/0 is up, line protocol is up
Internet address is 110.23.x.x/22
Broadcast address is 255.255.255.255
Address determined by DHCP
MTU is 1500 bytes
Helper address is not set
Directed broadcast forwarding is disabled
Outgoing access list is not set
Inbound access list is not set
Proxy ARP is enabled
Local Proxy ARP is disabled
Security level is default
Split horizon is enabled
ICMP redirects are always sent
ICMP unreachables are always sent
ICMP mask replies are never sent
IP fast switching is disabled
IP Flow switching is disabled
IP CEF switching is disabled
IP Null turbo vector
IP Null turbo vector
Associated unicast routing topologies:
Topology "base", operation state is UP
IP multicast fast switching is disabled
IP multicast distributed fast switching is disabled
IP route-cache flags are No CEF
Router Discovery is disabled
IP output packet accounting is disabled
IP access violation accounting is disabled
TCP/IP header compression is disabled
RTP/IP header compression is disabled
Probe proxy name replies are disabled
Policy routing is disabled
Network address translation is enabled, interface in domain outside
BGP Policy Mapping is disabled
Input features: NAT Outside, MCI Check
Output features: Post-routing NAT Outside
WCCP Redirect outbound is disabled
WCCP Redirect inbound is disabled
WCCP Redirect exclude is disabled
GigabitEthernet0/1 is administratively down, line protocol is down
Internet protocol processing disabled
GigabitEthernet0/2 is up, line protocol is up
Internet address is 192.168.0.254/24
Broadcast address is 255.255.255.255
Address determined by non-volatile memory
MTU is 1500 bytes
Helper address is not set
Directed broadcast forwarding is disabled
Outgoing access list is not set
Inbound access list is not set
Proxy ARP is enabled
Local Proxy ARP is disabled
Security level is default
Split horizon is enabled
ICMP redirects are always sent
ICMP unreachables are always sent
ICMP mask replies are never sent
IP fast switching is disabled
IP Flow switching is disabled
IP CEF switching is disabled
IP Null turbo vector
IP Null turbo vector
Associated unicast routing topologies:
Topology "base", operation state is UP
IP multicast fast switching is disabled
IP multicast distributed fast switching is disabled
IP route-cache flags are No CEF
Router Discovery is disabled
IP output packet accounting is disabled
IP access violation accounting is disabled
TCP/IP header compression is disabled
RTP/IP header compression is disabled
Probe proxy name replies are disabled
Policy routing is disabled
Network address translation is enabled, interface in domain inside
BGP Policy Mapping is disabled
Input features: MCI Check
Output features: NAT Inside
WCCP Redirect outbound is disabled
WCCP Redirect inbound is disabled
WCCP Redirect exclude is disabled

[Julio E. Moisa]

Hi

Did you apply the Google DNS servers to the Computer network card? 

DNS Servers

8.8.8.8

4.2.2.2

8.8.4.4

[Georg Pauwen]

Hello,

on a side note, this could be a problem with your laptop as well. Try turning the Windows firewall off to check if this might be blocking your DNS requests. Also, what is the output of 'ipconfig/all' from the laptop ?

[Choc Top]

Hi Julio, I certainly did, trying every combination I could. Flushdns also done.

8.8.8.8

4.2.2.2

211.29.132.12
198.142.0.51

192.168.0.254

Have also disabled Windows Firewall service and stopped it.

I plug eveything back into the Linksys router and the connection is fine using identical dns settings.

The windows firewall works fine with the Linksys.

Ethernet adapter Ethernet:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) Ethernet Connection (3) I218-LM
Physical Address. . . . . . . . . : B8-6B-23-04-A8-C0
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 192.168.0.3(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Tuesday, September 19, 2017 9:17:12 PM
Lease Expires . . . . . . . . . . : Wednesday, September 20, 2017 9:17:11 PM
Default Gateway . . . . . . . . . : 192.168.0.254
DHCP Server . . . . . . . . . . . : 192.168.0.254
DNS Servers . . . . . . . . . . . : 8.8.8.8
4.2.2.2
NetBIOS over Tcpip. . . . . . . . : Enabled

[mrityunjay singh]

Hi Choc,

From the snap I can see the dns is already resolved as you getting reply though intermittent drop.It could be network issue at upstream.

You can also try the below to check if DNS responding fine.

Try to resolve one website using local host entry if you using windows o.s.

Path: C:\Windows\System32\drivers\etc

If it works fine , it means there is problem with either DNS request going outside or at your upstream who is restricting the request.

[Julio E. Moisa]

Hi

That is weird, it should work, also you can check the host file as it was mentioned previously. Also try configuring this link instead.

no ip route 0.0.0.0 0.0.0.0 G0/0

ip route 0.0.0.0 0.0.0.0 G0/0 DHCP

It could be a hardware drivers problem. Could you please make traceroute to 8.8.8.8

tracert -d 8.8.8.8

Thank you in advance. 

[Choc Top]

Some success! Allbeit very weird, maybe someone can explain...

I tried all suggested tips listed above and got nowhere, even host file entries where not working.

All tracerts looked normal.

I recall reading various other unrelated threads when researching other commands where users had tried a different IOS version, so at the end of my tether I had nothing to lose.

The router had 152-4.S5.

I wiped everything and threw 124-24.T4 on.

Then applied the config in chunks, testing if one certain command I had applied in my newbness was the culprit.

But by the end of applying the exact same config it was working!?

---------------------

Now that I have my preferred DNS applied, I need to block Google DNS for Netflix geo reasons.

But I cant seem to get it, I get incomplete command with this...

access-list 100 remark Block-Google-DNS
access-list 100 deny udp any host 8.8.8.8 eq dns
access-list 100 deny udp any host 8.8.4.4 eq dns
access-list 100 deny udp any host 108.175.32.0/20 eq dns

...

...

...
access-list 100 permit ip any any
int g0/0
ip access-group 100 out