Re[2]: What can make DNS lookups slow?

[Chris Evans <stats@psyctc.org>]

Friday, January 14, 2005, 10:46:31 PM, Daniel wrote:


>>DLM> route -n
>>
>>Kernel IP routing table
>>Destination     Gateway         Genmask         Flags Metric Ref  Use Iface
>>217.34.100.194  0.0.0.0         255.255.255.255 UH    0      0    0 eth2
>>217.34.100.192  0.0.0.0         255.255.255.248 U     0      0    0 eth0
>>192.168.2.0     0.0.0.0         255.255.255.0   U     0      0    0 eth2
>>192.168.1.0     0.0.0.0         255.255.255.0   U     0      0    0 eth1
>>0.0.0.0         217.34.100.198  0.0.0.0         UG    0      0    0 eth0
>>  
>>
DLM> execute:
DLM>     route del 217.34.100.194

DLM> that should kill the bogus eth2 entry.

DLM> Then see what happens.
Nothing bogus about that entry at all and I really don't want to
delete it but can confirm that the system has the same problems when I
do.  That has to be there to route things to and from the
http/https/smtp server in the dmz beyond eth2.  That is served
separately from the internal network which has no need to be visible
from the outside at all.  This is a pretty standard three card
hardware firewall I believe and has worked fine for some years until
recently.

I have made _some_ progress though not solved everything.  First thing
I've discovered is that my ISP's DNS servers are replying through
other machines with private range IP addresses which were being
filtered out by my firewall since it is set up to ignore private
addresses from outside (on the not entirely unreasonable belief that I
think many firewalls operate that nothing should be coming to them
from those addresses).  I had been assuming, stupidly, that those
iptables rejections were irrelevant.  Trouble I've got now is how to
use shorewall to set the iptables commands to accept these packets
since they are coming from a private address, not the one to which the
firewall sent the request, and they're routed back to the MAC address,
not to the IP address of that interface.

I don't think that's the whole story either though and I think another
issue may be that the ISP's servers are simply sometimes very slow or
else return time outs when they shouldn't.  Ugh.  This is a nightmare.

Still very keen to hear any thoughts from anyone.

TIA,

Chris