DNS not working on ubuntu server 14.04

Question

I'm trying to update my ubuntu 14.04 server, but I'm struggling a bit on it, as it seems that it's unable to reach the DNS server.

as a result:

$ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=57 time=2.46 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=57 time=2.58 ms

$ ping google.com
ping: unknown host google.com

$ nslookup www.google.com
;; connection timed out; no servers could be reached

as this is a server I'm not using network manager, and:

$ cat /etc/network/interfaces | grep -v "#"

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet dhcp
dns-nameservers 8.8.8.8 8.8.8.9

$ cat /etc/resolv.conf
# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 109.74.194.20
nameserver 109.74.192.20
nameserver 109.74.193.20
search members.linode.com

I have installed recently pritunl on the server to use it as a VPN server, it might be related.

$ sudo iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  localhost            anywhere
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:<pritunl web port>
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:<pritunl vpn port>
ACCEPT     icmp --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

I don't have dnsmasq

$ ps -ef | grep dns
user  5125  3813  0 11:20 pts/0    00:00:00 grep --color=auto dns

What could I do to get the server back working?

thanks,

Answer 1

What could I do to get the server back working?

Your firewall rules are too restrictive, they banish proper replies to your own queries. Add this,

iptables -A INPUT   -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

which should allow DNS queries leaving your system to be replied to.

Strictly speaking, for DNS to work you would need to allow only replies on port UDP53, but you would still get no reply at all on all conversations you begin. So this wider rule allows replies to DNS queries and replies to http page requests, for instance.