Dave Bishop
The host IP is not present as the very first hop (source IP) is the server's private interface. That said, I have had such cases in the past and it appears that the remote host is blocking UDP traffic by their DNS server. Here is how the traffic looks like for a server from which download.regularlabs.com resolves fine:
21:19:40.815482 IP 10.20.0.87.54264 > 185.220.175.129.domain: UDP, length 65
21:19:40.820531 IP 185.220.175.129.domain > 10.20.0.87.54264: UDP, length 97
21:19:40.815482 IP 10.20.0.87.54264 > 185.220.175.129.domain: UDP, length 65
21:19:40.820531 IP 185.220.175.129.domain > 10.20.0.87.54264: UDP, length 97
Here's what's seen on the host node when we try to resolve download.regularlabs.com from one of the servers, the traffic from which is blocked by them:
21:20:16.305446 IP 10.12.0.92.46767 > 185.220.175.129.domain: UDP, length 65
21:20:17.105595 IP 10.12.0.92.42570 > 185.220.175.129.domain: UDP, length 65
21:20:17.905808 IP 10.12.0.92.42442 > 185.220.175.129.domain: UDP, length 42
21:20:18.705981 IP 10.12.0.92.54950 > 185.220.175.129.domain: UDP, length 42
As you can see again we have an outgoing UDP packet from our server toward 185.220.175.129, however, we receive no response, which indicates that UDP traffic from the main IP of the server (34.174.71.85) is blocked by the remote server.
Here are the results of a dig +trace command:
regularlabs.com. 172800 IN NS ns1.vps0216.zxcs.nl.
regularlabs.com. 172800 IN NS ns2.vps0216.zxcs.nl.
CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN NSEC3 1 1 0 - CK0Q2D6NI4I7EQH8NA30NS61O48UL8G5 NS SOA RRSIG DNSKEY NSEC3PARAM
CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN RRSIG NSEC3 8 2 86400 20230627042518 20230620031518 46551 com. HfAI+YRdruDFRrUwxPdrcjD3IpzH8FpMwbtAOZEXGFV7wdQcIVZ0jQ4V J5cTrrln4DOL7e6gvqaxnreMIhljyU8iUpmKqBCR/s5vI96486yJvo5k f4hIwBW31cQtLzKQz4jsC1S7ja+yJY5JMoagnzHPmZRwCQ1Jt42yJZ/j Nta0rulw5kFuCp3lpaNOLawObJ64nm6PURwTR21IFySPRw==
D39D4M796VILPI9B64M3V34ISFF693TU.com. 86400 IN NSEC3 1 1 0 - D39DA601EINL61SLIR6ROJU9V1U97FA9 NS DS RRSIG
D39D4M796VILPI9B64M3V34ISFF693TU.com. 86400 IN RRSIG NSEC3 8 2 86400 20230625054737 20230618043737 46551 com. SHk7INU6i6Fb2oQyY8xzTTryqMPf0igeoqkoFqeppOm9gLvwK39/ZHWn jxIt4ZLVmP/IkET+FoIlLfh7OZyZCkp22QE866ZRzZIaJPChw6WwLMK4 4OxXYNWgyxbw6isCZNOV1LZQsMzfJjvOlC0lu0YjGMjzPR+AsiFVBfMs zsyELMT1zJqFfiFkFtFsAV7Gmemh6sqPeSkWf78qIegpFg==
;; Received 653 bytes from 192.43.172.30#53(i.gtld-servers.net) in 3 ms
;; connection timed out; no servers could be reached
Once we reach the above IP/nameserver, they simply cut us out, and yes, this is a block on their end. Do note that no matter how many TCP and ICMP tests (the latter being ping and traceroute checks) are made on either side, they are irrelevant as the DNS system works over the UDP protocol. As such, regularlabs.com should review their networking, firewalls and the settings on their DNS server and ensure that no networks are being blocked in terms of UDP requests that are made.
Regards,
Ivan Maznev
Senior Technical Support