45

While attempting to use the 1.1.1.1 DNS service provided by Cloudflare on my home network, all queries timed out. I am a CenturyLink fibre (now renamed Quantum Fiber) customer. Why?

Use here means adding it as an explicit DNS resolver in a Mac, a Windows 10 PC and in a linux server running using DNSMasq as a DNS Forwarder.

Improve this question
0

2 Answers 2

Reset to default
67

Answer

The answer in my case is that the telco equipment commonly used in older installations by CenturyLink treats 1.1.1.1 as a "special address" that is not forwarded – it is used as a captive portal address.

To solve the problem: use the alternate address for the service 1.0.0.1 instead. This also applies if you also want use Cloudflare's DNS over HTTPs solution with 1.1.1.1. This assumes that you can't update the router firmware to address this issue.

Further Information

The router provided by the telco to me is a Technicolor C2100T.

This presentation from CloudFlare pages 14-16 identifies this model and others as exhibiting this behavior:

  • Pace (Arris) 5268
  • D-Link DMG-6661
  • Technicolor C2100T
  • Calix GigaCenter – fixed 2018/Jun/12 thanks to a USER
  • Nomadix (model(s) unknown)
  • Xerox Phaser MFP
Improve this answer
2
  • 10
    Fun fact: If you're interested in getting your hands dirty and have a CenturyLink provided Calix C844G, you can enable Telnet/SSH on the router and manually remove the route to 1.1.1.1. The commands are similar to that on Linux. It doesn't persist over reboots, but I haven't had to reboot the thing in months.
    – duper51
    Feb 16, 2021 at 1:53
  • 2
    Glad I saw this... I'm about to add a Xerox Phaser device to my network, and I would have NEVER figured out what was going on.
    – Joel Coehoorn
    Feb 17, 2021 at 14:34
1

Although the OP has answered their own question for their particular situation, I would like to point out another possible answer in the event that others may have a similar and related issue-- one which I have had.

If using Suricata, such as with pfSense, there is a rule (with similar and related consequences):

#ET POLICY Connection to previously unallocated address space 1.1.1.0/24 suppress gen_id 1, sig_id 2017000

If the rule is disabled or configured to alert only (and not drop), the problem is solved.

Improve this answer
1
  • Curious if using 1.0.0.1 would work as well before mod ding the rule. Great detail to add to the thread!
    – rburte
    Feb 20, 2021 at 19:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.