Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 4 replies
  • Subscribers 3 subscribers
  • Views 8151 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Can't connect to the internet, dropping DNS packet

BJohnson

OK...

I've got a LAN interface, a WAN interface, DNS forwarder Google and NAT masquerading rule LAN --> WAN.  

I've got 5 firewall rules, LAN --> any --> WAN, WAN --> any --> LAN, Google --> any -->WAN & Any; LAN --> any --> Any, and Any --> any --> LAN.

When I try to DNS resolve or ping www.yahoo.com using WebAdmin, the firewall log says this:

2016:04:19-17:55:51 sg115w ulogd[4446]: id="2000" severity="info" sys="SecureNet" sub="packetfilter" name="Packet logged" action="log" fwrule="0"

srcip="108.214.80.73" dstip="8.8.4.4" proto="17" length="45" tos="0x00" prec="0x00" ttl="64" srcport="45754" dstport="53"

info="nf_ct_dns: dropping packet: DNS packet of insuffient length: 25

What am I missing? Thank you for any responses.





This thread was automatically locked due to age.
Parents
  • +1

    Hi Jonathan,

    Please check if ping from Gateway option is selected in Network Protection> Firewall > ICMP> Ping Settings. PFA screenshot:

    Here, LAN->Any->WAN firewall is needed. Rest all the rules can be kept off. I want to know if you are facing any issue when you try to resolve the DNS host OR ping to yahoo.com through a end system.

    Thanks

    Sachin Gurung

    Sachin Gurung
    Team Lead | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

Reply
  • +1

    Hi Jonathan,

    Please check if ping from Gateway option is selected in Network Protection> Firewall > ICMP> Ping Settings. PFA screenshot:

    Here, LAN->Any->WAN firewall is needed. Rest all the rules can be kept off. I want to know if you are facing any issue when you try to resolve the DNS host OR ping to yahoo.com through a end system.

    Thanks

    Sachin Gurung

    Sachin Gurung
    Team Lead | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  |  Video tutorials
    Remember to like a post.  If a post (on a question thread) solves your question use the 'This helped me' link.

Children
Unfiltered HTML