问题[systemd-resolved](ubuntu)

我正在使用焦点 Ubuntu 20.04.1 LTS（托管虚拟机）

有时在重新启动后 DNS 解析失败（例如ping google.com > Resource temporarily unavailable）

为了“解决”这个问题，我重新启动了机器。

什么是正确的解决方法，为什么偶尔会发生这种情况？

的内容resolv.conf表示文件由systemd-resolved

# This file is managed by man:systemd-resolved(8). Do not edit.
#
# This is a dynamic resolv.conf file for connecting local clients directly to
# all known uplink DNS servers. This file lists all configured search domains.
#
# Third party programs must not access this file directly, but only through the
# symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a different way,
# replace this symlink by a static file or a different symlink.
#
# See man:systemd-resolved.service(8) for details about the supported modes of
# operation for /etc/resolv.conf.
# No DNS Servers known

示例错误：

wal@www:~$ ping google.com
ping: google.com: Resource temporarily unavailable

编辑：在我输入这个问题的过程中，它显然已自行修复，现在它按预期工作。我仍然对为什么会发生这种情况感兴趣:)

我的设置如下：

我在 address 有一个本地 DNS 服务器（准确地说是 pihole）192.168.1.200。我的家庭网络中的 address 也有一台服务器192.168.1.300。我的域example.com指向我的公共 IP 5.5.5.5。pihole 有一些自定义的 DNS 条目，因此当我在本地网络中时，example.com解析为192.168.1.300而不是5.5.5.5（以避免 NAT 出现问题）我已将我的 wifi 的 DNS 服务器设置为192.168.1.200. （也是在路由器里设置的……）

现在不知何故，我仍然从 systemd-resolve 获得 5.5.5.5 IP。

我已经用 sudo systemd-resolve --flush-caches

sudo systemd-resolve --statistics返回缓存大小为 0

systemd-resolve --status | grep "DNS Servers"节目192.168.1.200

现在是有趣的部分：

dig example.com返回5.5.5.5

而 dig example.com @192.168.1.200返回192.168.1.300

这怎么可能？如何让 systemd-resolve 实际查询我设置的 DNS 服务器？

更多信息：

• ls -al /etc/resolv.conf返回 lrwxrwxrwx 1 root root 39 Sep 26 2019 /etc/resolv.conf -> ../run/systemd/resolve/stub-resolv.conf
• cat /etc/resolv.conf返回

# This file is managed by man:systemd-resolved(8). Do not edit.
#
# This is a dynamic resolv.conf file for connecting local clients to the
# internal DNS stub resolver of systemd-resolved. This file lists all
# configured search domains.
#
# Run "systemd-resolve --status" to see details about the uplink DNS servers
# currently in use.
#
# Third party programs must not access this file directly, but only through the
# symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a different way,
# replace this symlink by a static file or a different symlink.
#
# See man:systemd-resolved.service(8) for details about the supported modes of
# operation for /etc/resolv.conf.

nameserver 127.0.0.53
options edns0
search home

• dpkg -l *dnsmasq*返回

Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name                   Version          Architecture     Description
+++-======================-================-================-==================================================
un  dnsmasq                <none>           <none>           (no description available)
ii  dnsmasq-base           2.79-1           amd64            Small caching DNS proxy and DHCP/TFTP server
un  dnsmasq-base-lua       <none>           <none>           (no description available)

• grep -i dns /etc/systemd/resolved.conf返回

#DNS=
#FallbackDNS=
#MulticastDNS=no
#DNSSEC=no
#DNSStubListener=yes

我正在使用 ubuntu 20.04，我配置rsyslog为将日志发送/转发到远程syslog-ng，但我收到了很多WARNING这样的消息：

Server returned error NXDOMAIN, mitigating potential DNS violation DVE-2018-0001, 
retrying transaction with reduced feature level UDP.

如何将日志级别增加到ERROR仅用于systemd-resolved或配置rsyslog为仅转发日志级别>WARNING

我有 netplan 管理一个简单的网桥，并在同一台服务器上使用 BIND 提供 DNS 服务，除了相对域解析之外，它都运行良好。

host -t A foo输出：

foo.example.com has address 192.168.0.3

但是host -t A bar.foo（它是 的别名foo）输出：

Host bar.foo not found: 3(NXDOMAIN)

即使ping bar.foo正确解析域别名并输出：

PING foo.example.com (192.168.0.3) 56(84) bytes of data.

我认为这可以通过添加指令ndots:2来控制，以便第二个查询被视为相对，但当然它不是一个直接可编辑的文件。从 netplan 传递此配置的正确方法是什么？或者还有其他可以指定的地方吗？如果可以避免，我不想制作常规文件。options/etc/resolv.conf/etc/resolv.conf

我在resolved.conf 手册页中没有发现任何有用的东西。

/etc/netplan/00-my-config.yaml：

network:
    ethernets:
        eno1:
            dhcp4: false
            dhcp6: false
    version: 2
    bridges:
        br0:
            interfaces:
                - eno1
            addresses:
                - 192.168.0.2/24
            gateway4: 192.168.0.1
            nameservers:
                addresses:
                    - 192.168.0.2
                    - 192.168.0.1
                search:
                    - example.com

/etc/resolv.conf：

# This file is managed by man:systemd-resolved(8). Do not edit.
#
# This is a dynamic resolv.conf file for connecting local clients to the
# internal DNS stub resolver of systemd-resolved. This file lists all
# configured search domains.
#
# Run "resolvectl status" to see details about the uplink DNS servers
# currently in use.
#
# Third party programs must not access this file directly, but only through the
# symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a different way,
# replace this symlink by a static file or a different symlink.
#
# See man:systemd-resolved.service(8) for details about the supported modes of
# operation for /etc/resolv.conf.

nameserver 127.0.0.53
options edns0
search example.com

使用sudo systemd-resolve --statistics让我查看当前的 dns 缓存统计信息，例如：

Cache                     
  Current Cache Size: 68  
          Cache Hits: 412 
        Cache Misses: 461

我想查看 dns 缓存的所有条目（这里是 68 个），可以吗？

每次由于域不存在（例如could not resolve host）而应该收到错误时，我都会收到有关连接到环回地址的错误：

$ curl -4 -v https://nonexist.invalid
Trying 127.0.0.1...

该问题仅在建立无线连接约 2 秒后才开始出现。短时间内，一切都按预期工作。

我正在使用systemd-resolved并且 dns 似乎正在工作：

$ readlink /etc/resolv.conf
../run/systemd/resolve/stub-resolve.conf
$ dig +short A example.com
192.0.2.1
$ dig +short A nonexist.invalid
$ systemd-resolve -t A nonexist.invalid
nonexist.invalid: resolve call failed: No appropriate name servers or networks for name found

如果名称解析看起来不错，为什么程序似乎仍将名称解析为127.0.0.1？

就在 Ubuntu 升级到 20.04 之后，/etc/resolv.conf包含：

nameserver 127.0.2.1

它不起作用。改为：

nameserver 127.0.0.53

但是每次重新启动后它都会被覆盖，我必须重新更改它。

我已经在这个盒子里安装了 Ubuntu 15.10，并定期升级它，这是解析器第一次出现这种行为不端。淘气！

如何永久解决此问题？

编辑：

输出$ ls -al /etc/resolv.conf：

lrwxrwxrwx 1 root root 29 lis  1  2015 /etc/resolv.conf -> ../run/resolvconf/resolv.conf

内容/etc/resolv.conf：

# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
# 127.0.0.53 is the systemd-resolved stub resolver.
# run "systemd-resolve --status" to see details about the actual nameservers.

nameserver 127.0.0.53
search wroclaw.vectranet.pl

（它曾经是nameserver 127.0.2.1在重新启动后，但不改变127.0.0.53我将无法写这篇文章;）。）

内容/etc/hosts：

127.0.0.1   localhost
127.0.1.1   marcin-Lenovo

# The following lines are desirable for IPv6 capable hosts
::1     ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

#188.165.239.159 wkaliszu.pl

#10.10.9.157    mskorzewski.axit.pl
X.X.X.X mskorzewski.axit.pl

（X.X.X.X是一些真实的IP地址。）

我已经安装了 Ubuntu 20.04，但我没有让 IPv6 工作。有人能帮助我吗？

$ resolvectl -6 查询 google.com

google.com: 2a00:1450:4003:801::200e           -- link: wlo1

-- Information acquired via protocol DNS in 16.2ms.
-- Data is authenticated: no

好的

$ resolvectl -6 查询 askubuntu.com

askubuntu.com: resolve call failed: 'askubuntu.com' does not have any RR of the requested type

失败

$ resolvectl -4 查询 askubuntu.com

askubuntu.com: 151.101.1.69                    -- link: wlo1
               151.101.65.69                   -- link: wlo1
               151.101.193.69                  -- link: wlo1
               151.101.129.69                  -- link: wlo1

-- Information acquired via protocol DNS in 18.3ms.
-- Data is authenticated: no

如果使用 IPv4，则可以。

$ cat /var/run/NetworkManager/resolv.conf
# Generated by NetworkManager
nameserver 127.0.0.53
$ cat /var/run/NetworkManager/no-stub-resolv.conf
# Generated by NetworkManager
nameserver 8.8.8.8

[使用 IPv4 连接时的输出]

$ cat /var/run/NetworkManager/resolv.conf
# Generated by NetworkManager
nameserver 127.0.0.53
$ cat /var/run/NetworkManager/no-stub-resolv.conf
# Generated by NetworkManager
nameserver 2001:4860:4860::8888

[使用 IPv6 连接时的输出]

$ systemd-resolve --status
Global
       LLMNR setting: no                  
MulticastDNS setting: no                  
  DNSOverTLS setting: no                  
      DNSSEC setting: no                  
    DNSSEC supported: no                  
          DNSSEC NTA: 10.in-addr.arpa     
                      16.172.in-addr.arpa 
                      168.192.in-addr.arpa
                      17.172.in-addr.arpa 
                      18.172.in-addr.arpa 
                      19.172.in-addr.arpa 
                      20.172.in-addr.arpa 
                      21.172.in-addr.arpa 
                      22.172.in-addr.arpa 
                      23.172.in-addr.arpa 
                      24.172.in-addr.arpa 
                      25.172.in-addr.arpa 
                      26.172.in-addr.arpa 
                      27.172.in-addr.arpa 
                      28.172.in-addr.arpa 
                      29.172.in-addr.arpa 
                      30.172.in-addr.arpa 
                      31.172.in-addr.arpa 
                      corp                
                      d.f.ip6.arpa        
                      home                
                      internal            
                      intranet            
                      lan                 
                      local               
                      private             
                      test                

Link 2 (wlo1)
      Current Scopes: DNS                 
DefaultRoute setting: yes                 
       LLMNR setting: yes                 
MulticastDNS setting: no                  
  DNSOverTLS setting: no                  
      DNSSEC setting: no                  
    DNSSEC supported: no                  
         DNS Servers: 2001:4860:4860::8888
          DNS Domain: ~.

$ 猫 /etc/nsswitch.conf

# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.

passwd:         files systemd
group:          files systemd
shadow:         files
gshadow:        files

hosts:          files resolve [!UNAVAIL=return] dns
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup:       nis

编辑： 有一个问题。我无法访问 askubuntu.com 网站。问题出在我的 NetworkManager 配置上。我已将 IPv4 方法设置为“禁用”，而我真正想要的只是“需要 IPv6 寻址才能完成此连接”。很酷的行为！

我systemd-resolved进入调试模式，试图解决来自这台机器的大量 DNS 查询（tcfe01）。似乎systemd-resolved保留了多个缓存副本，一个用于全局范围（*/*），另一个用于特定网络设备（eno1/*）。从日志看来，似乎只有全局范围 ( */*) 被缓存，而不是 ( eno1/*)。对于第一个查询，我们看到Cache miss两个范围，但对于后续查询，我们得到Positive cache hit全局范围，但又Cache miss是设备范围，我们最终每次都访问 DNS 服务器。

这违背了拥有缓存的全部目的，不仅损害了本地计算机 ( tcfe01) 的性能，而且还不必要地破坏了 DNS 服务器。对这种行为的任何洞察都会非常有帮助。

Apr 23 16:45:34 tcfe01 systemd-resolved[26041]: Got DNS stub UDP query packet for id 14184
Apr 23 16:45:34 tcfe01 systemd-resolved[26041]: Looking up RR for google.com IN A.
Apr 23 16:45:34 tcfe01 systemd-resolved[26041]: Switching to DNS server 192.168.10.25 for interface eno1.
Apr 23 16:45:34 tcfe01 systemd-resolved[26041]: Switching to system DNS server 192.168.10.25.
Apr 23 16:45:34 tcfe01 systemd-resolved[26041]: Cache miss for google.com IN A
Apr 23 16:45:34 tcfe01 systemd-resolved[26041]: Transaction 48281 for <google.com IN A> scope dns on */*.
Apr 23 16:45:34 tcfe01 systemd-resolved[26041]: Using feature level UDP+EDNS0 for transaction 48281.
Apr 23 16:45:34 tcfe01 systemd-resolved[26041]: Using DNS server 192.168.10.25 for transaction 48281.
Apr 23 16:45:34 tcfe01 systemd-resolved[26041]: Sending query packet with id 48281.
Apr 23 16:45:34 tcfe01 systemd-resolved[26041]: Cache miss for google.com IN A
Apr 23 16:45:34 tcfe01 systemd-resolved[26041]: Transaction 1213 for <google.com IN A> scope dns on eno1/*.
Apr 23 16:45:34 tcfe01 systemd-resolved[26041]: Using feature level UDP+EDNS0 for transaction 1213.
Apr 23 16:45:34 tcfe01 systemd-resolved[26041]: Using DNS server 192.168.10.25 for transaction 1213.
Apr 23 16:45:34 tcfe01 systemd-resolved[26041]: Sending query packet with id 1213.
Apr 23 16:45:34 tcfe01 systemd-resolved[26041]: Processing query...
Apr 23 16:45:34 tcfe01 systemd-resolved[26041]: Processing incoming packet on transaction 48281. (rcode=SUCCESS)
Apr 23 16:45:34 tcfe01 systemd-resolved[26041]: Verified we get a response at feature level UDP+EDNS0 from DNS server 192.168.10.25.
Apr 23 16:45:34 tcfe01 systemd-resolved[26041]: Added positive unauthenticated cache entry for google.com IN A 299s on */INET/192.168.10.25
Apr 23 16:45:34 tcfe01 systemd-resolved[26041]: Transaction 48281 for <google.com IN A> on scope dns on */* now complete with <success> from network (unsigned).
Apr 23 16:45:34 tcfe01 systemd-resolved[26041]: Freeing transaction 1213.
Apr 23 16:45:34 tcfe01 systemd-resolved[26041]: Sending response packet with id 14184 on interface 1/AF_INET.
Apr 23 16:45:34 tcfe01 systemd-resolved[26041]: Freeing transaction 48281.


Apr 23 16:45:45 tcfe01 systemd-resolved[26041]: Got DNS stub UDP query packet for id 50679
Apr 23 16:45:45 tcfe01 systemd-resolved[26041]: Looking up RR for google.com IN A.
Apr 23 16:45:45 tcfe01 systemd-resolved[26041]: Positive cache hit for google.com IN A
Apr 23 16:45:45 tcfe01 systemd-resolved[26041]: Transaction 51371 for <google.com IN A> on scope dns on */* now complete with <success> from cache (unsigned).
Apr 23 16:45:45 tcfe01 systemd-resolved[26041]: Cache miss for google.com IN A
Apr 23 16:45:45 tcfe01 systemd-resolved[26041]: Transaction 16504 for <google.com IN A> scope dns on eno1/*.
Apr 23 16:45:45 tcfe01 systemd-resolved[26041]: Using feature level UDP+EDNS0 for transaction 16504.
Apr 23 16:45:45 tcfe01 systemd-resolved[26041]: Using DNS server 192.168.10.25 for transaction 16504.
Apr 23 16:45:45 tcfe01 systemd-resolved[26041]: Sending query packet with id 16504.
Apr 23 16:45:45 tcfe01 systemd-resolved[26041]: Freeing transaction 51371.
Apr 23 16:45:45 tcfe01 systemd-resolved[26041]: Freeing transaction 16504.
Apr 23 16:45:45 tcfe01 systemd-resolved[26041]: Sending response packet with id 50679 on interface 1/AF_INET.
Apr 23 16:45:45 tcfe01 systemd-resolved[26041]: Processing query...


Apr 23 16:45:48 tcfe01 systemd-resolved[26041]: Got DNS stub UDP query packet for id 50950
Apr 23 16:45:48 tcfe01 systemd-resolved[26041]: Looking up RR for google.com IN A.
Apr 23 16:45:48 tcfe01 systemd-resolved[26041]: Positive cache hit for google.com IN A
Apr 23 16:45:48 tcfe01 systemd-resolved[26041]: Transaction 27482 for <google.com IN A> on scope dns on */* now complete with <success> from cache (unsigned).
Apr 23 16:45:48 tcfe01 systemd-resolved[26041]: Cache miss for google.com IN A
Apr 23 16:45:48 tcfe01 systemd-resolved[26041]: Transaction 24663 for <google.com IN A> scope dns on eno1/*.
Apr 23 16:45:48 tcfe01 systemd-resolved[26041]: Using feature level UDP+EDNS0 for transaction 24663.
Apr 23 16:45:48 tcfe01 systemd-resolved[26041]: Using DNS server 192.168.10.25 for transaction 24663.
Apr 23 16:45:48 tcfe01 systemd-resolved[26041]: Sending query packet with id 24663.
Apr 23 16:45:48 tcfe01 systemd-resolved[26041]: Freeing transaction 27482.
Apr 23 16:45:48 tcfe01 systemd-resolved[26041]: Freeing transaction 24663.
Apr 23 16:45:48 tcfe01 systemd-resolved[26041]: Sending response packet with id 50950 on interface 1/AF_INET.
Apr 23 16:45:48 tcfe01 systemd-resolved[26041]: Processing query...

正如最近几周许多人所做的那样，我现在尝试让 VPN 启动并运行并在家工作。

经过一番挣扎，我成功了。我们正在使用 L2TP/IPsec VPN。

安装：

来自 github 的xl2tpd（需要公司防火墙的特殊标志，WATCHGUARD）

network-manager-l2tp

network-manager-l2tp-gnome

我遇到了重大问题。我尝试了一切，以至于我不知道自己做了什么。我们的 VPN 只支持3des-sha1-modp1024我看到的请求。我在某个地方读到 Linux 根本不支持，他开始接受aes-sha256-modp1024. 它奏效了。

但是，我必须手动重新安排 DNS 服务器/etc/resolve.conf，将我的公司 DNS 设置在顶部。在一个说DO NOT EDIT这个文件的文件中。

现在的问题是我没有获得连接到公司开发网站所需的 DNS。resolve.conf我知道我在某处对我设置的符号链接做了一些更改。

TL;DR：我希望我的 DNS 服务器在连接到 VPN 时自动更新，因为我在不知道我做了什么的情况下在根目录中摆弄以破坏。

额外日志：

$ ls -l /etc/resove.conf
lrwxrwxrwx 1 root root 32 mar 17 10:00 /etc/resolv.conf -> /run/systemd/resolve/resolv.conf

$ lbs_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 19.04
Release:    19.04
Codename:   disco