Kraven_the_Hunter

I went into the Mullvad settings a bit deeper to see why my Surface might be using wireguard tunnels while my desktop doesn't. I didn't see anything related to that, but I did notice that Mullvad has a "Lockdown Mode" which requires you to be connected to Mullvad in order to access the internet. I don't have that active, but I wonder if it is in that mode anyway. I did a quick enable/disable of it to no avail.

I took a bit to reply because I wanted to wait for the next update to Mullvad. I just installed it this morning and even though I haven't re-started the program, my network connection is dafaulting to go through the Mullvad wireguard servers which is letting everything work. I'm not sure why I have so many copies of the same wg0-mullvad server in my list so that seems suspicious.

Here are the resolv.conf and systemd/resolved.conf files.. really nothing unique other than calling back to 127.0.0.53 for the nameserver like I showed before. My desktop has the same settings and nameserver though. The only difference is that Mullvad on my desktop is not using wireguard servers, so maybe that is causing the issue on my Surface?

# This is /run/systemd/resolve/stub-resolv.conf managed by man:systemd-resolved(8).
# Do not edit.
#
# This file might be symlinked as /etc/resolv.conf. If you're looking at
# /etc/resolv.conf and seeing this text, you have followed the symlink.
#
# This is a dynamic resolv.conf file for connecting local clients to the
# internal DNS stub resolver of systemd-resolved. This file lists all
# configured search domains.
#
# Run "resolvectl status" to see details about the uplink DNS servers
# currently in use.
#
# Third party programs should typically not access this file directly, but only
# through the symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a
# different way, replace this symlink by a static file or a different symlink.
#
# See man:systemd-resolved.service(8) for details about the supported modes of
# operation for /etc/resolv.conf.

nameserver 127.0.0.53
options edns0 trust-ad
search .

#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it under the
#  terms of the GNU Lesser General Public License as published by the Free
#  Software Foundation; either version 2.1 of the License, or (at your option)
#  any later version.
#
# Entries in this file show the compile time defaults. Local configuration
# should be created by either modifying this file (or a copy of it placed in
# /etc/ if the original file is shipped in /usr/), or by creating "drop-ins" in
# the /etc/systemd/resolved.conf.d/ directory. The latter is generally
# recommended. Defaults can be restored by simply deleting the main
# configuration file and all drop-ins located in /etc/.
#
# Use 'systemd-analyze cat-config systemd/resolved.conf' to display the full config.
#
# See resolved.conf(5) for details.

[Resolve]
# Some examples of DNS servers which may be used for DNS= and FallbackDNS=:
# Cloudflare: 1.1.1.1#cloudflare-dns.com 1.0.0.1#cloudflare-dns.com 2606:4700:4700::1111#cloudflare-dns.com 2606:4700:4700::10
01#cloudflare-dns.com
# Google:     8.8.8.8#dns.google 8.8.4.4#dns.google 2001:4860:4860::8888#dns.google 2001:4860:4860::8844#dns.google
# Quad9:      9.9.9.9#dns.quad9.net 149.112.112.112#dns.quad9.net 2620:fe::fe#dns.quad9.net 2620:fe::9#dns.quad9.net
#DNS=
#FallbackDNS=
#Domains=
#DNSSEC=no
#DNSOverTLS=no
#MulticastDNS=no
#LLMNR=no
#Cache=no-negative
#CacheFromLocalhost=no
#DNSStubListener=yes
#DNSStubListenerExtra=
#ReadEtcHosts=yes
#ResolveUnicastSingleLabel=no
#StaleRetentionSec=0

In Soviet Amerika, MS Windows throw you.

Not sure where I was going with this one honestly. Started as a callback to Russia owning the White House and then I theew in some corporate twist and couldn't figure out how to land it.

We have an asteroid incoming, so there's hope...

No, unfortunately. It consistently works when connected to Mullvad on both wireless and cellular networks. It briefly worked without Mullvad after a routine software update but its back to its old ways.

What I should probably do next, just to be thorough, is boot Mint or Tails from USB and see if it all works.

Since I dont keep anything on this device, reinstalling wont be a major pain. Ive just had enough other things going on that this hasn't bubbled to the top of my list.

Thanks for the info, I'll read through the docs and hopefully get this up and running again in the near future. Fortunately, nothing here is mission critical and I can still use the machine with VPN active. Getting resolv.conf back in working order appears to be the right solution.

My nsswitch.conf file looks identical to yours, so nothing to edit there.

I also looked at my resolv.conf and systemd\resolved.conf files.

resolv.conf is a symlink, but is the only file with anything un-commented in the file:

# This is /run/systemd/resolve/stub-resolv.conf managed by man:systemd-resolved(
8).
# Do not edit.
#
# This file might be symlinked as /etc/resolv.conf. If you're looking at
# /etc/resolv.conf and seeing this text, you have followed the symlink.
#
# This is a dynamic resolv.conf file for connecting local clients to the
# internal DNS stub resolver of systemd-resolved. This file lists all
# configured search domains.
#
# Run "resolvectl status" to see details about the uplink DNS servers
# currently in use.
#
# Third party programs should typically not access this file directly, but only
# through the symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a
# different way, replace this symlink by a static file or a different symlink.
#
# See man:systemd-resolved.service(8) for details about the supported modes of
# operation for /etc/resolv.conf.

nameserver 127.0.0.53
options edns0 trust-ad
search .

Yes I believe that Mullvad routes you to their DNS server so that explains why it works when connected to VPN. If I attempt an nslookup when NOT connected to VPN it fails and the server it attempts to contact is 127.0.0.53. When I connect to VPN the nslookup succeeds, and it uses the same server address.

I then disconnect from VPN and ping the ip address that I just looked up (I chose etsy) and the ping goes through so this seems to be a DNS lookup issue. Is 127.0.0.53 the right server address? I would expect it to use my DHCP server address of 192.168.x.x format.

Thanks for the tip. If I bypass DNS it does appear to work so that's likely the problem. I need to figure out why now and I think it has something to do with a local DNS override of some sort.

I checked and everything was still set to the defaults, which makes sense as I didn't change anything. Regardless, I deleted the connection and re-made it with the same results. No network connectivity outside of my LAN unless I have a VPN active.

Settings are:

Security: WPA/WPA 2 Personal IPV4 using DHCP DNS: Automatic Routes: Automatic IPV6: Active (but unused) with DNS=Auto and Routes=Auto

I did also try resetting the network using the Reset button to no avail.

I may just end up reinstalling the OS if I can't figure anything out.

As the other commenter said, any US citizen can get a passport card. They also double as a Real ID for federal identification.