I am seeing public ipv4 addresses in my eth0 settings .It configured to
use 1.1.1.1 and 1.1.0.1

I am thinking that 1.1.1.1 is some kind of proxy and what I can see is
the actual DNS servers that are responding,is this correct?

Google does not have a definitive answer and it full of help on how to
setup 1.1.1.1 not how it works.

I am a retired network engineer so I understand how cloudflare itself
works but it is very difficult to get an accurate answer to my question.

On Mon, 13 Mar 2023 13:13:59 +0000
grinch <grinch@sommewhere.com> wrote:

> I am seeing public ipv4 addresses in my eth0 settings .It configured
> to use 1.1.1.1 and 1.1.0.1
>
> I am thinking that 1.1.1.1 is some kind of proxy and what I can see
> is the actual DNS servers that are responding,is this correct?
>
> Google does not have a definitive answer and it full of help on how
> to setup 1.1.1.1 not how it works.
>
> I am a retired network engineer so I understand how cloudflare itself
> works but it is very difficult to get an accurate answer to my
> question.
Hi
The 1.1.0.1 is not a DNS, it's a public ip (in China)...?

<https://dnslytics.com/ip/1.1.0.1>

<https://www.cloudflare.com/learning/dns/what-is-1.1.1.1/>

--
Cheers Malcolm °¿° (Linux Counter #276890)
Tumbleweed 20230311 | GNOME Shell 43.3 | 6.2.2-1-default
HP Z440 | Xeon E5-2690 V3 X24 @ 2.60GHz | Nvidia Quadro T400/Tesla P4
up 15:07, 2 users, load average: 0.25, 0.21, 0.19

On 2023-03-13 14:45, Malcolm wrote:
> On Mon, 13 Mar 2023 13:13:59 +0000
> grinch <grinch@sommewhere.com> wrote:
>
>> I am seeing public ipv4 addresses in my eth0 settings .It configured
>> to use 1.1.1.1 and 1.1.0.1
>>
>> I am thinking that 1.1.1.1 is some kind of proxy and what I can see
>> is the actual DNS servers that are responding,is this correct?
>>
>> Google does not have a definitive answer and it full of help on how
>> to setup 1.1.1.1 not how it works.
>>
>> I am a retired network engineer so I understand how cloudflare itself
>> works but it is very difficult to get an accurate answer to my
>> question.
> Hi
> The 1.1.0.1 is not a DNS, it's a public ip (in China)...?
>
> <https://dnslytics.com/ip/1.1.0.1>
>
> <https://www.cloudflare.com/learning/dns/what-is-1.1.1.1/>
>

Right, it does not answer to DNS queries:

cer@Telcontar:~> host -v google.es 1.1.0.1
Trying "google.es"
;; connection timed out; no servers could be reached

cer@Telcontar:~>

But 1.1.1.1 does:

cer@Telcontar:~> host -v google.es 1.1.1.1
Trying "google.es"
Using domain server:
Name: 1.1.1.1
Address: 1.1.1.1#53
Aliases:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41256
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;google.es. IN A

;; ANSWER SECTION:
google.es. 237 IN A 142.250.185.3

Received 43 bytes from 1.1.1.1#53 in 15 ms
Trying "google.es"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39677
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;google.es. IN AAAA

;; ANSWER SECTION:
google.es. 18 IN AAAA 2a00:1450:4003:80d::2003

Received 55 bytes from 1.1.1.1#53 in 11 ms
Trying "google.es"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43728
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;google.es. IN MX

;; ANSWER SECTION:
google.es. 264 IN MX 0 smtp.google.com.

Received 58 bytes from 1.1.1.1#53 in 15 ms
cer@Telcontar:~> host 1.1.1.1
1.1.1.1.in-addr.arpa domain name pointer one.one.one.one.
cer@Telcontar:~>

cer@Telcontar:~> whois 1.1.1.1
% [whois.apnic.net]
% Whois data copyright terms http://www.apnic.net/db/dbcopyright.html

% Information related to '1.1.1.0 - 1.1.1.255'

% Abuse contact for '1.1.1.0 - 1.1.1.255' is 'helpdesk@apnic.net'

inetnum: 1.1.1.0 - 1.1.1.255
netname: APNIC-LABS
descr: APNIC and Cloudflare DNS Resolver project
descr: Routed globally by AS13335/Cloudflare <=============
descr: Research prefix for APNIC Labs
country: AU
org: ORG-ARAD1-AP
admin-c: AR302-AP
tech-c: AR302-AP
abuse-c: AA1412-AP
status: ASSIGNED PORTABLE
remarks: ---------------
remarks: All Cloudflare abuse reporting can be done via
remarks: resolver-abuse@cloudflare.com
remarks: ---------------
mnt-by: APNIC-HM
mnt-routes: MAINT-AU-APNIC-GM85-AP
mnt-irt: IRT-APNICRANDNET-AU
last-modified: 2020-07-15T13:10:57Z
source: APNIC

irt: IRT-APNICRANDNET-AU
address: PO Box 3646
address: South Brisbane, QLD 4101
address: Australia
e-mail: helpdesk@apnic.net
abuse-mailbox: helpdesk@apnic.net
admin-c: AR302-AP
tech-c: AR302-AP
auth: # Filtered
remarks: helpdesk@apnic.net was validated on 2021-02-09
mnt-by: MAINT-AU-APNIC-GM85-AP
last-modified: 2021-03-09T01:10:21Z
source: APNIC

organisation: ORG-ARAD1-AP
org-name: APNIC Research and Development
country: AU
address: 6 Cordelia St
phone: +61-7-38583100
fax-no: +61-7-38583199
e-mail: helpdesk@apnic.net
mnt-ref: APNIC-HM
mnt-by: APNIC-HM
last-modified: 2017-10-11T01:28:39Z
source: APNIC

role: ABUSE APNICRANDNETAU
address: PO Box 3646
address: South Brisbane, QLD 4101
address: Australia
country: ZZ
phone: +000000000
e-mail: helpdesk@apnic.net
admin-c: AR302-AP
tech-c: AR302-AP
nic-hdl: AA1412-AP
remarks: Generated from irt object IRT-APNICRANDNET-AU
abuse-mailbox: helpdesk@apnic.net
mnt-by: APNIC-ABUSE
last-modified: 2021-03-09T01:10:22Z
source: APNIC

role: APNIC RESEARCH
address: PO Box 3646
address: South Brisbane, QLD 4101
address: Australia
country: AU
phone: +61-7-3858-3188
fax-no: +61-7-3858-3199
e-mail: research@apnic.net
nic-hdl: AR302-AP
tech-c: AH256-AP
admin-c: AH256-AP
mnt-by: MAINT-APNIC-AP
last-modified: 2018-04-04T04:26:04Z
source: APNIC

% Information related to '1.1.1.0/24AS13335'

route: 1.1.1.0/24
origin: AS13335
descr: APNIC Research and Development
6 Cordelia St
mnt-by: MAINT-AU-APNIC-GM85-AP
last-modified: 2018-03-16T16:58:06Z
source: APNIC

% This query was served by the APNIC Whois Service version 1.88.16
(WHOIS-UK3)

cer@Telcontar:~>

--
Cheers, Carlos.

On 13/03/2023 22:50, Carlos E.R. wrote:
> On 2023-03-13 14:45, Malcolm wrote:
>> On Mon, 13 Mar 2023 13:13:59 +0000
>> grinch <grinch@sommewhere.com> wrote:
>>
>>> I am seeing public ipv4 addresses in my eth0 settings .It configured
>>> to use 1.1.1.1 and 1.1.0.1
>>>
>>> I am thinking that 1.1.1.1 is some kind of proxy and what I can see
>>> is the actual DNS servers that are responding,is this correct?
>>>
>>> Google does not have a definitive answer and it full of help on how
>>> to setup 1.1.1.1 not how it works.
>>>
>>> I am a retired network engineer so I understand how cloudflare itself
>>> works but it is very difficult to get an accurate answer to my
>>> question.
>> Hi
>> The 1.1.0.1 is not a DNS, it's a public ip (in China)...?
>>
>> <https://dnslytics.com/ip/1.1.0.1>
>>
>> <https://www.cloudflare.com/learning/dns/what-is-1.1.1.1/>

>
As per my yesterdays post which appears to have been lost in this group .

The latest tumbleweed update has fixed the issue so it was a bug/feature.

Worrying though as I'm not sure who's DNS it was using before. I can
feel a firewall rule coming on.

grinch wrote:
> On 13/03/2023 22:50, Carlos E.R. wrote:
>> On 2023-03-13 14:45, Malcolm wrote:
>>> On Mon, 13 Mar 2023 13:13:59 +0000
>>> grinch <grinch@sommewhere.com> wrote:
>>>
>>>> I am seeing public ipv4 addresses in my eth0 settings .It configured
>>>> to use 1.1.1.1 and 1.1.0.1
>>>>
>>>> I am thinking that 1.1.1.1 is some kind of proxy and what I can see
>>>> is the actual DNS servers that are responding,is this correct?
>>>>
>>>> Google does not have a definitive answer and it full of help on how
>>>> to setup 1.1.1.1 not how it works.
>>>>
>>>> I am a retired network engineer so I understand how cloudflare itself
>>>> works but it is very difficult to get an accurate answer to my
>>>> question.
>>> Hi
>>> The 1.1.0.1 is not a DNS, it's a public ip (in China)...?
>>>
>>> <https://dnslytics.com/ip/1.1.0.1>
>>>
>>> <https://www.cloudflare.com/learning/dns/what-is-1.1.1.1/>
>
>>
> As per my yesterdays post which appears to have been lost in this group .
>
> The latest tumbleweed update has fixed the issue so it was a bug/feature.
>
> Worrying though as I'm not sure who's DNS it was using before. I can
> feel a firewall rule coming on.

I don't use Tumbleweed but can't imagine an update changing
configuration settings in that way (unless the previous version was
totally broken and incapable of reading config files successfully).
My guess would be something external to your machine, although a failure
of ee-maj-in-eyshun on my part is always on the cards.

On 14/03/2023 11:56, Don Spam's Reckless Son wrote:
> grinch wrote:
>> On 13/03/2023 22:50, Carlos E.R. wrote:
>>> On 2023-03-13 14:45, Malcolm wrote:
>>>> On Mon, 13 Mar 2023 13:13:59 +0000
>>>> grinch <grinch@sommewhere.com> wrote:
>>>>
>>>>> I am seeing public ipv4 addresses in my eth0 settings .It configured
>>>>> to use 1.1.1.1 and 1.1.0.1

>>>>>
>>>>> I am a retired network engineer so I understand how cloudflare itself
>>>>> works but it is very difficult to get an accurate answer to my
>>>>> question.
>
>>
>>>
>> As per my yesterdays post which appears to have been lost in this group .
>>
>> The latest tumbleweed update has fixed the issue so it was a bug/feature.
>>

> I don't use Tumbleweed but can't imagine an update changing
> configuration settings in that way (unless the previous version was
> totally broken and incapable of reading config files successfully).

It now follows the firewalls dhcp4/6 settings as does everything else on
the network and there have been no changes/reboots made to the firewall.

All my other OS 15.4 Linux boxes and android devices on the network,
work properly DNS wise as they have always done.

Even when I added the DNS servers manually it still used the same
settings,that what was worrying me.

Next little project is to create a Firewall DNS allow rule for
cloudflare and my ISP's ipv4/6 DNS servers only then put a firewall deny
DNS/log the rule after it so I can see if it happens again.

My guess would be something external to your machine, although a failure
> of ee-maj-in-eyshun on my part is always on the cards.