Strange IP issue

Troubleshooting
1

When executing:

dig +short @ns1.google.com -t txt o-o.myaddr.l.google.com

Normally it returns your external IP, and it works on all my Ubuntu servers. But on my DietPI install, it returns a completely different IP. It is in the address range of my ISP, but it is certainly not my IP.

Does anyone have any idea what could be causing this behaviour? It’s so strange… Almost as if all my outgoing DNS traffic is routed through some proxy, but I cannot believe that is the case, so what could be happening?

2

do you get correct external IP while running

curl https://dietpi.com/geoip
3

This is the case.
The command is supposed to query ns1.google.com and return the source IP as txt in the reply. But if the query is intercepted and some other nameserver queries ns1, then you’ll see its address in the reply. Try it with dig -x IP_YOU_GOT

4

Hmm I can not replicate this, I get always my public IP.

5

With

curl -4 https://dietpi.com/geoip

or

curl -4 icanhazip.com

or any other similar HTTP service I get the correct IP. But Im trying to understand why it doesn’t work with DNS.

7

Okay, I finally figured out what is happening.

I have DNS Director enabled in my Asus Router. That means it intercepts all traffic to DNS port 53 on my network and redirects it to my PiHole. I use this because some devices like Chromecast ignore the DHCP settings and hardcode 8.8.8.8 as their DNS server.

So the traffic to ns1.google.com from the DietPi gets redirected to my providers nameserver by PiHole.

The reason why I never saw this behaviour on my Ubuntu servers, is that I had excluded them in DNS director.

So this issue was not related to DietPI at all but to my router configuration, sorry.

2 Likes