All internet connections cut, except via Tor Browser

Hello,

Recently I was not able to connect to internet at all, with one exception: Tor Browser, which was connecting with no problems. I used OpenSUSE leap 15.4 and after that 15.5.

On other forums I found out that the same problem was occurring on Windows and on Mac years ago.

Are the root causes of such problems found? I believe the most probable cause to be a malicious attack made over internet. Any other possible causes? Are such events already inspected to their root?

Hello and welcome to the openSUSE forums.

That is only your conclusion. We want to know how you came to that conclusion. E.g. what is the result of

ping -c1 195.135.221.140

(And, because you are new here, please copy/paste such information, the command and the output, from the terminal window into your post and then select that text and clich the</> button from the tool bar above the post editor.)

Hello hcvv and thanks for your reply,

I now use other Linux distribution, but have the same problem and here are the results of what you suggested:

ping -c1 195.135.221.140
PING 195.135.221.140 (195.135.221.140) 56(84) bytes of data.

--- 195.135.221.140 ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms

You forgot to tell why you think you have no connection to the internet.

You can indeed not ping to that IP address.

Please show;

ip a

and

ip route

You forgot to tell why you think you have no connection to the internet.

That is because no web browser opens any web page, no other applications I checked (for example Software) connect to the internet.

Be aware that by “connect to the internet” I mean full connection, i.e. established in both ways, from my computer to the far away server and from the server to my computer. The ping shows that my computer receives nothing.

This is from ip a

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: enp1s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast state DOWN group default qlen 1000
    link/ether 30:65:ec:a3:53:0d brd ff:ff:ff:ff:ff:ff
3: wlp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether c8:ff:28:3f:84:f9 brd ff:ff:ff:ff:ff:ff
    inet 192.168.3.151/24 brd 192.168.3.255 scope global dynamic noprefixroute wlp2s0
       valid_lft 79778sec preferred_lft 79778sec
5: nordlynx: <POINTOPOINT,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
    link/none 
    inet 10.5.0.2/32 scope global nordlynx
       valid_lft forever preferred_lft forever

This is from ip route:

default via 192.168.3.1 dev wlp2s0 proto dhcp src 192.168.3.151 metric 600 
169.254.0.0/16 dev nordlynx scope link metric 1000 
192.168.3.0/24 dev wlp2s0 proto kernel scope link src 192.168.3.151 metric 600

Yes, but you only tried with a browser. that does not say much about “connection to the internet”. The internet is used for much more then only some browser to http server connection.

But indeed you now made it very plausible that you have no connection to the internet.

To me it looks that your connectio to the internet should go through wlp2s0 (192.168.3.151) to router 192.168.3.1.

Did you check if that router is functioning correct?

Can you ping the router?

When I ping the router, the results are such:

ping -c1 192.168.3.1
PING 192.168.3.1 (192.168.3.1) 56(84) bytes of data.

--- 192.168.3.1 ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms

But I must state that I can’t connect to the internet (i.e. symptoms are exactly the same) even when I use wired connection directly to my modem. Except, again, with Tor Browser.

To not be able to ping your default route is quite disturbing but it also seems to me that you have installed NordVPN (nordlynx) at some point. Could that interfere with your normal network setup?

Thanks for pointing that.

There was no such problem a lot of months after installing NordVPN and then it suddenly appeared. I reported the problem to NordVPN, but the solutions they offered didn’t worked. I don’t know if the problem is related to NordVPN or not. How can I check? If NordVPN made something to the operating system, then even after removing NordVPN the problem will probably remain.

When you can not even reach your router, then of course you can not connect to the internet.

You seem to read only half from what I type.

Did you check your router? From the fact that you can not even ping it, it could be broken, down, or gone with the waste man. Cables broken. Whatever.

When you can not even reach your router, then of course you can not connect to the internet.

It seems that you are the one who read half of what I write and send the blame to me. Why would you do that?

I wrote:

But I must state that I can’t connect to the internet (i.e. symptoms are exactly the same) even when I use wired connection directly to my modem.

Is your openSUSE device the only one that has this kind of connectivity issues with this router/internet connection? Could you ping the router from an other device?

Is it possible to deactivate the NordVPN connection and access the internet without VPN for testing?

Can you check the router firmware for port blockings and such?

I haven’t used NordVPN and Nordlynx but from the docs at NordVPN it seems to use wireguard and that can probably interfere after uninstall depending on local setup for NordVPN/Nordlynx that’s not part of initial installation. But start with this:

check if it’s still there:
zypper if nordvpn (look for row Installed)

From inspecting nordvpn rpm it seems to not install something outside this:
/usr/bin/nordfileshared
/usr/bin/nordvpn
/usr/lib/systemd/system/nordfileshared.service
/usr/lib/systemd/system/nordfileshared.socket
/usr/lib/systemd/system/nordvpnd.service
/usr/lib/systemd/system/nordvpnd.socket
/usr/lib/systemd/user/nordfileshared.service
/usr/lib/systemd/user/nordfileshared.socket
/usr/lib/tmpfiles.d/nordvpn.conf
/usr/sbin/nordvpnd
/usr/share/applications/nordvpn.desktop
/usr/share/bash-completion/completions/nordvpn
/usr/share/icons/hicolor/scalable/apps/nordvpn.svg
/usr/share/licenses/nordvpn/LICENSE.md
/usr/share/licenses/nordvpn/THIRD-PARTY-NOTICES.md
/usr/share/man/man1/nordvpn.1.gz
/usr/share/zsh/functions/Completion/Unix/_nordvpn_auto_complete
/var/lib/nordvpn/data/countries.dat
/var/lib/nordvpn/data/cybersec.dat
/var/lib/nordvpn/data/insights.dat
/var/lib/nordvpn/data/ovpn_template.xslt
/var/lib/nordvpn/data/ovpn_xor_template.xslt
/var/lib/nordvpn/data/rsa-key-1.pub
/var/lib/nordvpn/data/servers.dat
/var/lib/nordvpn/openvpn

So, check if all those are removed.

Is your openSUSE device the only one that has this kind of connectivity issues with this router/internet connection?

Yes.

Could you ping the router from an other device?

I will do it later.

Is it possible to deactivate the NordVPN connection and access the internet without VPN for testing?

I did it and there is some improvement, but problems remain.

What is improved:

ping -c1 192.168.3.1
PING 192.168.3.1 (192.168.3.1) 56(84) bytes of data.
64 bytes from 192.168.3.1: icmp_seq=1 ttl=64 time=1.38 ms

--- 192.168.3.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 1.375/1.375/1.375/0.000 ms
PING 195.135.221.140 (195.135.221.140) 56(84) bytes of data.
64 bytes from 195.135.221.140: icmp_seq=1 ttl=53 time=46.4 ms

--- 195.135.221.140 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 46.389/46.389/46.389/0.000 ms

The application called Software can connect to the internet and find new software.

What is not improved:

No browser, except Tor, opens any web page. This remains exactly the same as it was before.

Can you check the router firmware for port blockings and such?

Should this mean that the router can block some of the internet? I didn’t set anything like that, but of course some malicious party could have done something. And more, the problems are there even when I am connected only to the modem and not to the router.

As a clarification, there are two ways for my computer to connect to the internet: one with only using the modem, the other using the router while it is connected to the modem. Both don’t work.

Show

cat /etc/resolv.conf
ls -l /etc/resolv.conf

Thanks for this. I now use another Linux distribution (I already mentioned it somewhere in the beginning), which uses sudo instead of zypper, but the problems are the same as they were in openSUSE. So I wrote to this forum.

If I change zypper with sudo, I get sudo: if: command not found But it is no problem, I may write in their forum some time in the future, when they solve the problem of not allowing me to sign up for yet not explained reasons.

The first one gives this:

nameserver 127.0.0.53
options edns0 trust-ad
search .

The second one:

lrwxrwxrwx 1 root root 39 Apr 18 22:32 /etc/resolv.conf -> ../run/systemd/resolve/stub-resolv.conf

You probably has something else than sudo to check for packages. Typical is apt, yum etc. depending on distribution. If it’s rpm based you could run:
rpm -qa nordvpn*
If it’s debian style try:
dpkg -l nordvpn*