DNS resolution failures in Rocky Linux 8 virtual machines often stem from misconfigured network interfaces or restrictive firewall rules blocking port 53. This guide details how to verify connectivity by connecting VMs to a NAT network, testing with IP addresses, and correcting
systemd-resolved settings to restore reliable name resolution for your virtualized environment.
Understanding the Network Environment
Virtual machines running on host systems frequently encounter DNS issues because they operate within isolated network segments. Unlike physical servers that might have static routes or dedicated gateways, VMs rely heavily on the hypervisor’s network configuration. The most common setup involves a NAT (Network Address Translation) network, which allows the guest OS to access external resources through the host’s connection. However, this abstraction layer can sometimes obscure routing problems or cause the guest OS to lose its default gateway configuration after a reboot or network interface restart.
When troubleshooting these environments, it is crucial to distinguish between a complete network outage and a specific DNS failure. If you cannot ping an external IP address like
8.8.8.8, the issue lies in routing or firewall rules rather than DNS itself. Conversely, if IP connectivity works but domain names fail to resolve, the problem is isolated to the resolver configuration. In many cases, users find that their VMs are not properly attached to the virtual switch or bridge defined by their hypervisor software. For those managing multiple VMs, understanding how to automate installations can prevent configuration drift, as seen in guides about
Automatically Installing VMs using virt-manager.
Verifying Connectivity with IP Addresses
The first diagnostic step is to bypass DNS entirely and test raw network connectivity. Open a terminal in your Rocky Linux 8 VM and execute the
ping command against a well-known public IP address, such as Google’s public DNS server at
8.8.8.8. If this ping succeeds, your network stack, virtual NIC driver, and routing table are functioning correctly. This confirms that the VM has a valid IP address assigned via DHCP and can reach the outside world.
If the ping fails, check your interface status using
ip addr show. Ensure that the interface has an IP address and that the default route is present in the output of
ip route. A missing default route indicates that the VM does not know where to send traffic destined for external networks. In such cases, restarting the network service or re-attaching the VM to the correct NAT network in your hypervisor settings usually resolves the issue. Note that optimizing other aspects of your VM, such as
Upscaling Video Resolution on QEMU/KVM Virtual Machines for Better Display on Limited Resources, does not affect network routing but ensures overall system stability during troubleshooting.
Configuring systemd-resolved
Rocky Linux 8 utilizes
systemd-resolved as its primary DNS resolver. Misconfigurations here are the leading cause of "network ok, but no internet" symptoms. You can inspect the current status of the resolver by running
resolvectl status. Look for the active network interface and verify that it lists valid DNS servers under the "Current DNS Server" section. If this section is empty or shows unreachable servers, the configuration is broken.
To fix this, you may need to edit the network configuration files located in
/etc/NetworkManager/system-connections/ or use the
nmtui text-based utility. Ensure that the DNS fields are populated with reliable servers like
8.8.8.8 and
1.1.1.1. After making changes, restart the NetworkManager service with
sudo systemctl restart NetworkManager. It is also advisable to flush the cache by stopping and starting the
systemd-resolved service. Be aware that complex DNS setups involving custom domains may require additional attention, similar to issues found when
Troubleshooting DNS Wildcard Domains: github.com Case Study.
Checking Firewall Rules
Even with correct resolver settings, local firewall rules can block outbound DNS traffic. Rocky Linux uses
firewalld by default. Check the active zones and services with
firewall-cmd --list-all. Ensure that the "dns" service is enabled in your active zone. If it is not, add it using
sudo firewall-cmd --permanent --add-service=dns followed by
sudo firewall-cmd --reload. This allows UDP and TCP traffic on port 53 to pass through.
In some enterprise environments, administrators might implement stricter controls using
iptables directly. If you suspect deeper packet filtering issues, reviewing
Configuring Iptables Rules to Allow Outgoing DNS Lookups can provide insights into legacy rule sets that might still be interfering with modern networking stacks. Always verify that your rules do not inadvertently drop packets before they leave the loopback interface used by local resolvers.
Testing and Validation
After applying these fixes, validate the solution by attempting to resolve a domain name using
dig example.com or
nslookup google.com. These tools provide detailed information about the query process, including latency and server responses, which helps identify intermittent issues. If resolution works, perform a final test by pinging a domain name to ensure end-to-end functionality. Regularly monitoring these settings prevents recurrence, especially after system updates or hypervisor migrations.
Frequently Asked Questions
Why does my VM have an IP address but no internet access?
This symptom typically indicates a routing error or a blocked port 53. Verify that your default gateway is correctly set in
ip route and ensure that firewalld allows DNS traffic. If the gateway is missing, the VM cannot route packets outside its local subnet.
How do I reset the DNS cache in Rocky Linux 8?
You can flush the cache by restarting the resolved daemon. Run
sudo systemctl restart systemd-resolved to clear any stale entries. This forces the system to fetch fresh records from the configured DNS servers immediately.
Can I use static IPs instead of DHCP for better reliability?
Yes, assigning static IPs eliminates DHCP lease issues but requires manual management of subnet masks and gateways. Configure these values in your NetworkManager connection profile to ensure consistency across reboots.
What should I do if resolvectl shows no DNS servers?
This means your network interface is not requesting DNS information from the DHCP server. Check your VM’s network adapter settings in the hypervisor to ensure it is connected to a network that provides DNS options. Manually specifying DNS servers in the connection profile is a viable workaround.
Does changing the hypervisor network type affect DNS?
Switching from NAT to Bridged networking changes how the VM obtains its IP address and routes traffic. Bridged mode often exposes the VM directly to the physical network, which may require different DNS configurations depending on your LAN’s infrastructure.