AdGuard Home documentation

Talk about Documentation
1

Hi everyone,

Was following this guide on how to setup adguard home (AGH): https://openwrt.org/docs/guide-user/services/dns/adguard-home#lan_domain_interception

In the lan domain interception part, it says to add the following to the upstream DNS servers:
[/lan/]127.0.0.1:54
[//]127.0.0.1:54

Can someone please explain why it says to put in: [//]127.0.0.1:54 ?

I asked chatgpt as a starting point, and it says that if I put in the above AGH will send DNS queries to OpenWRT dnsmasq (my set WAN DNS servers). Is that true?

If so, it seems to be a mistake as it doesn't align with what that section is about. It seems more likely that someone would want to use AGH to set the DNS upstream servers, rather than point them back to the WAN DNS servers. Thanks :slight_smile:

2

it's answered in the paragraph above the one you linked it.

it's also not sending all queries to dnsmasq.

for once, the dumb AI seems to be correct.

3

Paragraph above the bit I linked? Or the paragraph above where the upstream servers are listed? Can't get my head round it :confused:

I'm concerned because AGH has 27k+ requests to 127.0.0.1:54 in a short period, and presumed that the upstream DNS server (nextdns) in AGH was being bypassed to go to my WAN DNS servers.

4

Don't use AGH, but only local requests should be forwarded to dnsmasq, so unless you really talk a lot to your local devices, it's probably wrong.

5

The // refers to “requests without a FQDN” mentioned in the wiki. e.g. mydevice versus mydevice.lan.

6

You are right :slight_smile: Thanks.
Managed to find it in the AGH config page: https://github.com/AdguardTeam/AdGuardHome/wiki/Configuration#upstreams-for-domains

An empty domain specification, // has the special meaning of “unqualified names only”, i.e. names without any dots in them, like myhost or router. Those will only be used for resolving requests for unqualified domain names, but not their subdomains. So, a configuration like this:

5.6.7.8:53
[//]4.3.2.1:53
[/com/]1.2.3.4:53

sends requests for com (and its subdomains) to 1.2.3.4:53, requests for other top-level domains to 4.3.2.1:53, and all other requests to 5.6.7.8:53.

Find it crazy I had over 27 thousand unqualified names is a 24hr period....

7

that sounds worrying.

you should not have that many, the guide you linked is replacing the default dnsmasq dns with AGH but keeps dnsmasq in charge for DHCP. so normally unqualified domain names should be your internal lan devices only.

8

Yeah I think this is what I find confusing….. I think it might be linked to my Amazon Firestick polling a non .com page: trace-server.prod-clustered.bugs.firebat.prime-video.amazon.dev. The Firestick has done over 30,000 DNS look ups in 24hrs, with 11,000 of them to the above address.

So the [\\] is picking those up as there’s no .com or .lan in there. I feel like the best option is to just remove [\\], as I don’t have any addresses on my network that don’t have a .lan or an IP address.

9

This name doesn’t exist publicly, so the firestick sees the NXdomain response and tries again, appending the local domain. I’ve seen this behavior as well, but I don’t use AGH. Perhaps try an override to map that name to 0.0.0.0 instead of letting AGH reply with NXdomain?

10

this is not an unqualified domain name. trace-serverby its own would be. so if you have dhcp clients in your internal network, my-pc.lan, my-tablet.lan etc. you could access them by just calling my-pc without the domain suffix (.lan) and via [//] it will be resolved by dnsmasq instead of agh. if you have really 24k such type of queries then something is off.

what @dave14305 wrote about NXdomain response is valid but different case. your client receive an NXdomain response and try to be smart by adding .lan domain and retry. so 0.0.0.0 is probably a better response indeed.