Hey guys,
I still have some DNS problems. I've been banging my head against the wall, so would appreciate any tip to solve this.
System Configuration
OpenWrt 19.07.7
MacOS BigSur 11.6.1
Symptoms
Every now and then, the DNS resolution to discussions.apple.com is empty :
$ dscacheutil -q host -a name discussions.apple.com
returns no output at all
Most of the time, it returns the correct output :
$ dscacheutil -q host -a name discussions.apple.com
name: e4233.a.akamaiedge.net
alias: discussions.apple.com discussions.apple.com.edgekey.net
ip_address: 23.216.99.243
To try and diagnose this, I run tcpdump -i any | grep discussions on the router itself.
When the problem manifests itself, I see :
11:02:24.107239 IP MyDevice.mydomain.54534 > OpenWrt.mydomain.53: 53690+ AAAA? discussions.apple.com.edgekey.net. (51)
11:02:24.107239 IP MyDevice.mydomain.54534 > OpenWrt.mydomain.53: 53690+ AAAA? discussions.apple.com.edgekey.net. (51)
11:02:24.156893 IP MyDevice.mydomain.52379 > OpenWrt.mydomain.53: 45701+ A? discussions.apple.com.edgekey.net. (51)
11:02:24.156893 IP MyDevice.mydomain.52379 > OpenWrt.mydomain.53: 45701+ A? discussions.apple.com.edgekey.net. (51)
and nothing after that. In other words, I see MyDevice (the mac) asking the router for DNS resolution, but nothing comes back.
I then run sudo dscacheutil -flushcache ; sudo killall -HUP mDNSResponder on the mac to flush the cache.
When I requery DNS for discussions.apple.com following this, the output of tcpdump is like this:
11:18:00.626022 IP MyDevice.mydomain.64486 > OpenWrt.mydomain.53: 42605+ AAAA? discussions.apple.com. (39)
11:18:00.626022 IP MyDevice.mydomain.64486 > OpenWrt.mydomain.53: 42605+ AAAA? discussions.apple.com. (39)
11:18:00.642325 IP bl4-166-221.dsl.telepac.pt.28159 > 1.1.1.2.53: 35125+ AAAA? discussions.apple.com. (39)
0x0020: 0000 0000 0b64 6973 6375 7373 696f 6e73 .....discussions
11:18:00.649261 ethertype IPv4, IP 1.1.1.2.53 > bl4-166-221.dsl.telepac.pt.28159: 35125 2/1/0 CNAME discussions.apple.com.edgekey.net., CNAME e4233.a.akamaiedge.net. (177)
11:18:00.649261 IP 1.1.1.2.53 > bl4-166-221.dsl.telepac.pt.28159: 35125 2/1/0 CNAME discussions.apple.com.edgekey.net., CNAME e4233.a.akamaiedge.net. (177)
11:18:00.660449 IP OpenWrt.mydomain.53 > MyDevice.mydomain.64486: 42605 2/1/0 CNAME discussions.apple.com.edgekey.net., CNAME e4233.a.akamaiedge.net. (177)
11:18:00.660463 IP OpenWrt.mydomain.53 > MyDevice.mydomain.64486: 42605 2/1/0 CNAME discussions.apple.com.edgekey.net., CNAME e4233.a.akamaiedge.net. (177)
Does anyone have any clue as to what is going on?
It seems to me that past the first DNS request, the router just does not bother resolving the DNS query. Maybe a caching problem on the router side?
My original setup was using https-dns-proxy. But I commented out list server '127.0.0.1#5060 and used directly 8.8.8.8 instead in my dhcp config, and the problem still persists. See configuration below.
DNSmasq configuration
config dnsmasq 'dnsmasq_mydomain'
option domainneeded '1'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option domain 'mydomain'
option local '/mydomain/'
option expandhosts '1'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp_mydomain.leases'
option noresolv '1'
option localservice '1'
option logdhcp '1'
list interface 'mydomain'
option confdir '/tmp/dnsmasq.d'
list server 8.8.8.8
#list server '127.0.0.1#5060'
config dnsmasq 'dnsmasq_otherdomain'
option domainneeded '1'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option domain 'otherdomain'
option local '/otherdomain/'
option expandhosts '1'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp_otherdomain.leases'
option noresolv '1'
option localservice '1'
list interface 'otherdomain'
list notinterface 'loopback'
option confdir '/tmp/dnsmasq.d'
list server '127.0.0.1#5061'
/etc/config/firewall/
config rule 'mydomain_dns'
option name 'Allow-DNS-mydomain'
option src 'mydomain'
option dest_port '53'
option proto 'tcp udp'
option target 'ACCEPT'
config redirect 'mydomain_intdns'
option name 'Intercept-DNS-mydomain'
option src 'mydomain'
option src_dport '53'
option proto 'tcp udp'
option target 'DNAT'
config rule 'dot_deny'
option name 'Deny-DoT'
option src '*'
option dest 'wan'
option dest_port '853'
option proto 'tcp udp'
option target 'REJECT'
config rule 'doh_deny'
option name 'Deny-DoH'
option src '*'
option dest 'wan'
option dest_port '443 80'
option proto 'tcp udp'
option family 'ipv4'
option ipset 'doh dest'
option target 'REJECT'
config include
option path '/etc/firewall.user'
config ipset 'doh'
option name 'doh'
option family 'ipv4'
option storage 'hash'
option match 'ip'
list entry '101.198.191.4'
list entry '101.6.6.6'
list entry '101.71.72.192'
list entry '103.2.57.5'
list entry '103.2.57.6'
list entry '103.85.15.60'
list entry '104.16.132.229'
list entry '104.16.133.229'
list entry '104.16.248.249'
list entry '104.16.249.249'
list entry '104.21.18.56'
list entry '104.21.22.243'
list entry '104.21.41.122'
Finding
If I configure the macOS client to use an external dns (8.8.8.8), I still have the same problem.
However, if I configure the macOS client to use an external dns AND comment out the redirect mydomain_intdns in the firewall, then the problem disappears. What does that mean?
