OpenDNS not blocking sites - only one computer works

Comments

16 comments

  • Avatar
    rotblitz (Edited )

    Your DNS server is apparently not 192.168.0.1. So use this command:

    nslookup -type=txt debug.opendns.com.

    0
    Comment actions Permalink
  • Avatar
    smayer97

    Thanks for quick reply.

     

    Sorry just updated description...

     

    Also just tested your new command. Results:

    Server: 2607:f798:18:10:0:640:7125:5204
    Address: 2607:f798:18:10::640:7125:5204#53

    Non-authoritative answer:
    *** Can't find debug.opendns.com: No answer

    Authoritative answers can be found from:
    opendns.com
    origin = auth1.opendns.com
    mail addr = noc.opendns.com
    serial = 1593870357
    refresh = 16384
    retry = 2048
    expire = 1048576
    minimum = 2560

    0
    Comment actions Permalink
  • Avatar
    rotblitz (Edited )

    “Checked Network settings DNS show 208.67.223.123 and 208.67.223.123”

    These should be 208.67.222.123 and 208.67.220.123.

    As you can clearly see, you’re using a DNSv6 service, not OpenDNS.

    Server: 2607:f798:18:10:0:640:7125:5204
    Address: 2607:f798:18:10::640:7125:5204#53

    You must configure IPv6 with the IPv4 equivalent addresses for FamilyShield to make it work.

    ::ffff:208.67.222.123
    ::ffff:208.67.220.123

    0
    Comment actions Permalink
  • Avatar
    smayer97

    Sorry, correction: DNS shows 208.67.223.123 and 208.67.220.123.

    When were these changed to 208.67.222.123 and 208.67.220.123?

    Also why would the first line work with one computer but not all the others?

     

    For the IPv6 entries, were do I place those? In the router DNS settings there is only one field for IPv6 vs 2 for v4.

    0
    Comment actions Permalink
  • Avatar
    smayer97

    I did correct the v4 DNS entries but not sure what to do about v6. Tried entering one as provide above but router says it IP address is invalid.

    0
    Comment actions Permalink
  • Avatar
    rotblitz

    The FamilyShield addresses never changed. They have always been this way.

    I do not know what you mean by “first line work“.

    I cannot help you with the router. I have a different one where it works.

    0
    Comment actions Permalink
  • Avatar
    smayer97

    Can anyone else provide help on this? I tried turning off IPv6 in the router (I think it I did anyway) but it had no impact. I have one field for IPv6 for an DNS IP address but I do not know what, if anything, should go in there to make this work if IPv6 is on.

    Trying to put ::ffff:208.67.222.123 or ::ffff:208.67.220.123 as suggested by rotblitz gives an error that the IP address is invalid.

    I'm not sure what else to try.

    0
    Comment actions Permalink
  • Avatar
    rotblitz

    Try with different notations like ::ffff:d043:de7b and ::ffff:d043:dc7b or 0::ffff:d043:de7b and 0::ffff:d043:dc7b

    1
    Comment actions Permalink
  • Avatar
    smayer97 (Edited )

    Ok...that did the trick! THANKS. Blocking works this way.

    Very odd behaviour though...

    First, router only allows me to enter ONE DNS IPv6 entry. I enter say ::ffff:d043:de7b and the router converts that to ::ffff:208.67.222.123 and I can save that. BUT if I enter ::ffff:208.67.222.123 directly OR if I click in the DNS field after it converts and try to save, it says the IP is invalid.

    Regardless, it works.

    BUT I notice that what this seems to do is create a "dummy" entry that forces networked devices trying to use IPv6 to default back to use IPv4 DNS entries because when I look at the network settings for networked devices, they now only show entries for the IPv4 DNS's but none for IPv6. Is that what is supposed to happen?

    This seems only like a work-around. If so, is there a more robust long-term solution for OpenDNS to support IPv6?

    1
    Comment actions Permalink
  • Avatar
    smayer97 (Edited )

    Ok, so the more I search the more I discover and learn BUT the more I have questions.This is what I believe I understand and some questions. Please let me know if anything is not correct.

    1. ::ffff:d043:de7b and ::ffff:d043:dc7b are the IPv6 equivalent of the IPv4 DNS resolvers for OpenDNS FamilyShield ONLY. These are equivalent to IPv4 208.67.222.123 and 208.67.222.123.

    2. Regular OpenDNS servers for IPv4 are 208.67.222.222 and 208.67.220.220.

    3. The IPv6 equivalents are to be entered into the IPv6 DNS resolver field(s) either on the router or the computer or device.

    4. Any address starting with "::", "fc", "fd", or "fe" are unable to work with the public IPv6 Internet. (source: http://www.test-ipv6.com/    faq:No IPv6 tab) Therefore, using these CANNOT access ANY IPv6 referenced sites.

    5. You seem to have listed 4 IPv4 equivalents to the IPv6 DNS entries but there are only 2 above in 1. (source: https://support.opendns.com/hc/en-us/community/posts/220012967-IPv6-Web-Filtering). Please clarify.

    ::ffff:d043:dede = ::ffff:208.67.222.222
    ::ffff:d043:dcdc = ::ffff:208.67.220.220
    ::ffff:d043:dedc = ::ffff:208.67.222.220
    ::ffff:d043:dcde = ::ffff:208.67.220.222

    Does OpenDNS actually have 4 regular servers (they only list the first 2 on their site)?

    6. If I only have one IPv6 field in my router, is there any way to enter more than one into one field using some kind of separate, e.g. semi-colon, space, no-space, etc, or does that mean I can only use one of the two?

    7. OpenDNS now HAS IPv6 DNS resolvers listed here: https://www.opendns.com/about/innovations/ipv6/. They are:

    • 2620:119:35::35
    • 2620:119:53::53

    These are listed as Cisco Umbrella. Can these truly be used/with for OpenDNS WITH filtering?

    8. The OpenDNS site does NOT directly list the IPv6 DNS resolvers from 7. above. The OpenDNS site only lists IPv4 address for the account. The OpenDNS Updater still only works with IPv4.

    a. is there an OpenDNS Updater to dynamic IPv6? If not, is there one in the works and what to do in the meantime?

    b. is OpenDNS filtering truly compatible with IPv6?

    9. My IP address from ISP seems to still be v4 based on what I see in OpenDNS Updater and Dashboard and using WhatIsMyIPAddress.com. Yet my ISP seems to have enabled IPv6...so how does this all work, especially the Dynamic IP? What issue am I likely to run into, if any?

     

    I know that is a lot. Any help would be appreciated.

    0
    Comment actions Permalink
  • Avatar
    smayer97 (Edited )

    Ok, playing with # 7 through trial and error it seems that those addresses DO NOT provide any filtering. Unless I did something wrong, it seems that 7, 8 b., and 9 are answered and moot. Please confirm.

    0
    Comment actions Permalink
  • Avatar
    rotblitz (Edited )

    1. Should be 208.67.222.123 and 208.67.220.123.
    2. + 5. There are 4 addresses.
    4. Your DNS traffic is being forced to IPv4. This still can resolve IPv6 destinations (AAAA records). You have full IPv6 access to all IPv6 destinations.
    6. No, you can use only one.
    7. + 8. You cannot register your IPv6 address at the dashboard yet, so DNSv6 does not regard your dashboard settings.
    8. a+b: No.
    9. Your ISP certainly provides dual-stack connectivity which allows this workaround tweak. No issue expected. The robust long-term solution is to include what’s with Umbrella already, that you can register also your IPv6 address(es) at the dashboard.

    0
    Comment actions Permalink
  • Avatar
    smayer97

    Thanks kindly for your replies. Had to shelve this until now.

    One follow-up...how do you know of the other 2 unpublished OpenDNS servers if they only list 2 on their website?

    0
    Comment actions Permalink
  • Avatar
    rotblitz

    It‘s documented in the knowledge base. They are not “unpublished”.

    0
    Comment actions Permalink
  • Avatar
    smayer97

    I wonder why they only post 2 of the 4 on their main page? Thanks for the info.

    0
    Comment actions Permalink
  • Avatar
    rotblitz

    Because publishing 4 addresses would cause more concerns and questions, for example why there are 4 if one needs only two, and which ones would be the right ones if using less than 4.

    0
    Comment actions Permalink

Please sign in to leave a comment.