CGNAT & Running DNS Benchmark

[SCFan]

Hello. New member here and joined to ask a question since I've not seen the answer covered anywhere on the forums or the DNS Benchmark webpage(s) or via other sources. Apologies in advance for my ignorance on these matters. I'm posting this in case it can help, or at the very least help me and others learn something.

I recently changed ISPs. Went from wireless to fiber. With the prior ISP I had a dynamic IP address and the Benchmark ran great.

The new ISP has me behind CGNAT (10.10.x.x on router's WAN (not 100.x.x.x). "What is my IP" web lookup is 23.147.x.x) and the Benchmark won't work when running straight from the .exe. I get all red circle (no cache) DNS servers / "Nameserver returned invalid replies" and the "Run Benchmark" button is grayed out.

I ran Proton's VPN software (installed on computer, free / slower version) and when connected was able to run the Benchmark after restarting it. The three DNS servers set on the router have the boxes / border around them (1.1.1.3, 1.1.1.1 and 9.9.9.9). I'm guessing the ISPs DNS server also has a box (10.2.x.x. My LAN is all 192.168.x.x). The first 29 entries (sorted by Fastest First) have close to the same cached speeds (0.025 - 0.034). The uncached and dotcom have more variability. The fastest uncached reports 0.049 and fastest dotcom reports 0.033.

If I disconnect the VPN and go back to the already open Benchmark screen and hit Run Benchmark again, it runs but all the red bar cached entries go away and it only reports uncached and dotcom. The fastest response times are 0.04 and 0.011, respectively.

I ran NS lookup (without the VPN connected) and checked the Wireshark record for the DNS query and saw that I did get a regular response from 1.1.1.3 (primary DNS on router). No problems. 10-20 ms response time for those packets.

I have not reached out to my ISP yet to see what, if any, kind of blocking they may be doing. I don't know enough to make an educated guess as to why these symptoms are occurring.

If, without the VPN I get normal DNS responses from 1.1.1.3, I don't understand why the Benchmark won't initially run without the VPN connected and then why the cache entries go away when re-running the Benchmark with the VPN disconnected.

Thoughts? Thanks!

 

[PHolder]

Get yourself a list of common DNS servers (from DNS Benchmark or elsewhere) and try doing manual nslookups against them to see if the ISP is blocking all access to some other ISPs DNS. In nslookup you can type server x.x.x.x to switch servers. Then just put in a DNS name to test for a response. (You can also modify the type of query with the type command but that isn't really relevant for these tests.) An example:

C:\Users\Paul>nslookup
Default Server:  router.myhome.com
Address:  192.168.9.1

> server 9.9.9.9
Default Server:  dns9.quad9.net
Address:  9.9.9.9

> grc.com
Server:  dns9.quad9.net
Address:  9.9.9.9

DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
*** Request to dns9.quad9.net timed-out

> server 8.8.8.8
DNS request timed out.
    timeout was 2 seconds.
Default Server:  [8.8.8.8]
Address:  8.8.8.8

> grc.com
Server:  [8.8.8.8]
Address:  8.8.8.8

Non-authoritative answer:
Name:    grc.com
Address:  4.79.142.200

>exit

 

[SCFan]

Here are the results from running that:
PS C:\Users\B> nslookup
Default Server: family.cloudflare-dns.com
Address: 1.1.1.3

> server 9.9.9.9
Default Server: dns9.quad9.net
Address: 9.9.9.9

> grc.com
Server: dns9.quad9.net
Address: 9.9.9.9
Name: grc.com
Address: 4.79.142.200

> server 8.8.8.8
Default Server: dns.google
Address: 8.8.8.8

> grc.com
Server: dns.google
Address: 8.8.8.8
Name: grc.com
Address: 4.79.142.200

> exit

---
Side note: I tested the Benchmark when the same computer was connected to a mobile hotspot and the Benchmark ran fine.

 

[peterblaise]

I'm not a techie or programmer ( I'm a mechanical guy ), so maybe
someone can read this article linked below to see if it informs the situation:

XDA: Cloudflare Tunnels are the best way to get around CGNAT

https://www.xda-developers.com/cloudflare-tunnels-are-the-best-way-to-get-around-cgnat/

 

[ColbyBouma]

Does your router have any security features that might be mis-classifying DNS Benchmark's traffic as malicious? From what I know about CGNAT, I doubt it's causing this issue.

 

[SCFan]

@ColbyBouma - Regarding CGNAT, thanks for the comment. I just looked at the logs (UCG Ultra) and saw that inbound on port 53 is being blocked from 8.8.8.8... and a few others due to a the signature "ET MALWARE Possible Zeus P2P Variant DGA NXDOMAIN Responses July 11 2014". I'll dig into that more. It's not listing all of the DNS servers / addresses, just four of them.

@peterblaise - I'll test that as well just to learn about how the system responds.

Thanks for the various thoughts and comments. I'll post what I figure out about the intrusion prevention issue, etc.