1.0 Error
While configuring a Linux server, the error Failed to fetch webpage, temporary failure resolving domain
was observed.
$ sudo apt-get update Err:1 ... bionic InRelease Temporary failure resolving ... Err:2 ... bionic-updates InRelease Temporary failure resolving ... ... Reading package lists... Done W: Failed to fetch ... Temporary failure resolving ... ...
Also, the dig command would not work.
$ dig example.com ; <<>> DiG 9.11.3-1ubuntu1-Ubuntu <<>> example.com ;; global options: +cmd ;; connection timed out; no servers could be reached
2.0 Solution
Obviously the DNS resolution was not working. In this particular system, the DNS server on the localhost was being used. However, the strict iptables rules were not allowing network traffic from the localhost. The problem was solved by adding rules to allow bidirectional traffic from the localhost.
... iptables -N val_input iptables -N val_output # allow packets with NEW, ESTABLISHED and RELATED states iptables -A val_input -m state --state NEW,ESTABLISHED,RELATED -i lo -j RETURN iptables -A val_output -m state --state NEW,ESTABLISHED,RELATED -o lo -j RETURN iptables -A val_input -j DROP iptables -A val_output -j DROP iptables -A INPUT -p tcp -j val_input iptables -A OUTPUT -p tcp -j val_output # allow DNS queries and replies - client iptables -A INPUT -p udp -i eth0 --sport 53 -j ACCEPT iptables -A OUTPUT -p udp -o eth0 --dport 53 -j ACCEPT iptables -A INPUT -p tcp -i eth0 --sport 53 -j ACCEPT iptables -A OUTPUT -p tcp -o eth0 --dport 53 -j ACCEPT # allow everything on localhost iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT # set policies for chains iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP
After the above-mentioned change, the commands, which were giving error earlier, work fine.
$ sudo apt-get update Hit:1 ... bionic InRelease Get:2 ... bionic-updates InRelease [88.7 kB] ... Fetched 806 kB in 1s (1,023 kB/s) Reading package lists... Done $ $ dig example.com ; <<>> DiG 9.11.3-1ubuntu1-Ubuntu <<>> example.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3121 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 65494 ;; QUESTION SECTION: ;example.com. IN A ;; ANSWER SECTION: example.com. 23074 IN A 93.184.216.34 ;; Query time: 0 msec ;; SERVER: 127.0.0.53#53(127.0.0.53) ;; WHEN: Sat Jul 07 16:38:26 UTC 2018 ;; MSG SIZE rcvd: 56
