Randomly, DNS lookups started failing today. I checked my dnsmasq settings and saw that the upstream DNS forwarding list was empty. That seems strange, as I thought I had set that to my ISP's service. All my clients point to my OpenWRT router for DNS queries.
Is there a setting to auto-configure the upstream DNS server? Maybe it was getting it from the WAN DHCP?
Can I disable it and just use a static setting that I choose (so I can decide if I want to use a public service)?
By default, this is how it should work.
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
ubus call system board
cat /etc/config/network
cat /etc/config/dhcp
cat /etc/config/firewall
Not the OP, but I'm having the same problem. Everything working fine up through this morning then suddenly DNS broke, with no changes made.
On a linux machine on the LAN any DNS lookup results in SERVFAIL. If I modify that computer to use a public DNS server, such as the ones my ISP advertises, instead of the one running on OpenWRT, DNS and all other internet functionality works fine.
After the problem started, I updated to the latest version of OpenWRT, but behavior is unchanged.
The configs requested:
root@router:~# ubus call system board
{
"kernel": "6.6.86",
"hostname": "router.<REDACTED>",
"system": "Atheros AR9344 rev 2",
"model": "TP-Link TL-WDR3600 v1",
"board_name": "tplink,tl-wdr3600-v1",
"rootfs_type": "squashfs",
"release": {
"distribution": "OpenWrt",
"version": "24.10.1",
"revision": "r28597-0425664679",
"target": "ath79/generic",
"description": "OpenWrt 24.10.1 r28597-0425664679",
"builddate": "1744562312"
}
}
root@router:~# cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fdb4:c258:397f::/48'
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0.1'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.0.1'
option netmask '255.255.255.0'
option ip6assign '60'
config device
option name 'eth0.2'
option macaddr '<REDACTED>'
config interface 'wan'
option device 'eth0.2'
option proto 'pppoe'
option username '<REDACTED>'
option password '<REDACTED>'
option ipv6 'auto'
config interface 'wan6'
option device 'eth0.2'
option proto 'dhcpv6'
config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'
config switch_vlan
option device 'switch0'
option vlan '1'
option ports '2 3 4 5 0t'
config switch_vlan
option device 'switch0'
option vlan '2'
option ports '1 0t'
root@router:~# cat /etc/config/dhcp
config dnsmasq
option domainneeded '1'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option cachesize '1000'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option localservice '1'
option ednspacket_max '1232'
list address '/letsencrypt.org/'
config dhcp 'lan'
option interface 'lan'
option start '200'
option limit '250'
option leasetime '12h'
option dhcpv4 'server'
option dhcpv6 'server'
option ra 'server'
list ra_flags 'managed-config'
list ra_flags 'other-config'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
config host
option name '<REDACTED>'
option ip '192.168.0.100'
list mac '<REDACTED>'
option dns '1'
config host
option name '<REDACTED>'
option ip '192.168.0.101'
list mac '<REDACTED>'
option dns '1'
config host
option name '<REDACTED>'
list mac '<REDACTED>'
option ip '192.168.0.102'
config host
option name '<REDACTED>'
list mac '<REDACTED>''
config domain
option name '<REDACTED>'
option ip '192.168.0.102'
config domain
option name '<REDACTED>'
option ip '192.168.0.102'
config domain
option name '<REDACTED>'
option ip '192.168.0.102'
config host
option name '<REDACTED>'
list mac '<REDACTED>'
oot@router:~# cat /etc/config/firewall
config defaults
option syn_flood '1'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
config zone
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
config zone
option name 'wan'
list network 'wan'
list network 'wan6'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Drop-Malicious'
option ipset 'Malicious-Addresses'
option target 'DROP'
option src 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config redirect
option dest 'lan'
option target 'DNAT'
option name 'SSH'
option src 'wan'
option src_dport '22'
option dest_ip '192.168.0.101'
option dest_port '22'
option enabled '0'
config redirect
option dest 'lan'
option target 'DNAT'
option name 'SMTP'
option src 'wan'
option src_dport '25'
option dest_ip '192.168.0.101'
option dest_port '25'
config redirect
option dest 'lan'
option target 'DNAT'
option name 'IMAP'
option src 'wan'
option src_dport '993'
option dest_ip '192.168.0.101'
option dest_port '993'
config ipset
option name 'Malicious-Addresses'
option comment 'IP blocks attempting to access servers.'
option family 'ipv4'
list match 'src_ip'
config redirect
option dest 'lan'
option target 'DNAT'
option name 'SSH from work'
option src 'wan'
option src_dport '22'
option dest_ip '192.168.0.101'
option dest_port '22'
option src_ip '<REDACTED>'
Remove this:
This is invalid...
the limit is the size of the pool, so your DHCP pool currently is specified for 200-449. With a /24, that value must be <=254.
Well after an hour of trying to figure it out on my own, I posted for help and it immediately fixed itself.
Anyway, I fixed the DHCP limit from 250 to 50, thank you for catching that!
I'll post back if the problem returns. Thanks again!