I have recently updated my TP-Link Archer C6 v2 (US) to 21.02.3 r16554-1d4dea6d4f, but I must have lost or screwed up some configuration:
Whenever I make a DNS query, be it through nslookup, accessing a website in Firefox, or however else, the first time I query that address in some time, it fails. If I then attempt the same query again, then I get results:
$ nslookup tetris.com
;; Got SERVFAIL reply from 192.168.1.1, trying next server
Server: fd84:b8be:b707::1
Address: fd84:b8be:b707::1#53
** server can't find tetris.com: SERVFAIL
$ nslookup tetris.com
Server: 192.168.1.1
Address: 192.168.1.1#53
Name: tetris.com
Address: 104.26.1.105
Name: tetris.com
Address: 104.26.0.105
Name: tetris.com
Address: 172.67.74.202
;; Got SERVFAIL reply from 192.168.1.1, trying next server
** server can't find tetris.com: SERVFAIL
If I don't try to lookup that address for a good while, it will fail again, so I'm guessing it's a problem along the lines of: the router only checking its cache for replies, and when something is not in the cache, it queries upstream but returns the immediate state of the cache. Thing is, I have no idea how to diagnose this.
I have the adblock package installed, but it is currently paused. I can reproduce the problem with different client devices.
Please run the following commands (copy-paste the whole block) and paste the output here, using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have
ubus call system board; \
uci export network; \
uci export dhcp; uci export firewall; \
head -n -0 /etc/firewall.user; \
ip -4 addr ; ip -4 ro li tab all ; ip -4 ru; \
ip -6 addr ; ip -6 ro li tab all ; ip -6 ru; \
ls -l /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/* ; head -n -0 /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/*
Hi, thanks for your reply. Here are the outputs. I've been very thorough with redacting IPv6 addresses since I don't know what ranges are public or not, If you need any specific one just ask.
package network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd84:b8be:b707::/48'
config device
option name 'br-lan'
option type 'bridge'
list ports 'eth0.1'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'
config interface 'wan'
option device 'eth0.2'
option proto 'dhcp'
config interface 'wan6'
option device 'eth0.2'
option proto 'dhcpv6'
config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'
config switch_vlan
option device 'switch0'
option vlan '1'
option ports '2 3 4 5 0t'
config switch_vlan
option device 'switch0'
option vlan '2'
option ports '1 0t'
package dhcp
config dnsmasq
option domainneeded '1'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option localservice '1'
option ednspacket_max '1232'
option confdir '/tmp/dnsmasq.d'
option allservers '1'
option nonegcache '1'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option dhcpv6 'server'
option ra 'server'
option ra_slaac '1'
list ra_flags 'managed-config'
list ra_flags 'other-config'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
config host
option name 'REDACTED'
option dns '1'
option mac 'REDACTED'
option ip 'REDACTED'
option duid 'REDACTED'
config host
option name 'REDACTED'
option dns '1'
option mac 'REDACTED'
option ip 'REDACTED'
config host
option name 'REDACTED'
option dns '1'
option mac 'REDACTED'
option ip 'REDACTED'
package firewall
config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
config zone
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
config zone
option name 'wan'
list network 'wan'
list network 'wan6'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fc00::/6'
option dest_ip 'fc00::/6'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config rule
option name 'Support-UDP-Traceroute'
option src 'wan'
option dest_port '33434:33689'
option proto 'udp'
option family 'ipv4'
option target 'REJECT'
option enabled 'false'
config include
option path '/etc/firewall.user'
# This file is interpreted as shell script.
# Put your custom iptables rules here, they will
# be executed with each firewall (re-)start.
# Internal uci firewall chains are flushed and recreated on reload, so
# put custom rules into the root chains e.g. INPUT or FORWARD or into the
# special user chains, e.g. input_wan_rule or postrouting_lan_rule.
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
6: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
inet 192.168.1.1/24 brd 192.168.1.255 scope global br-lan
valid_lft forever preferred_lft forever
8: eth0.2@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
inet 192.168.0.3/24 brd 192.168.0.255 scope global eth0.2
valid_lft forever preferred_lft forever
default via 192.168.0.1 dev eth0.2 src 192.168.0.3
192.168.0.0/24 dev eth0.2 scope link src 192.168.0.3
192.168.1.0/24 dev br-lan scope link src 192.168.1.1
broadcast 127.0.0.0 dev lo table local scope link src 127.0.0.1
local 127.0.0.0/8 dev lo table local scope host src 127.0.0.1
local 127.0.0.1 dev lo table local scope host src 127.0.0.1
broadcast 127.255.255.255 dev lo table local scope link src 127.0.0.1
broadcast 192.168.0.0 dev eth0.2 table local scope link src 192.168.0.3
local 192.168.0.3 dev eth0.2 table local scope host src 192.168.0.3
broadcast 192.168.0.255 dev eth0.2 table local scope link src 192.168.0.3
broadcast 192.168.1.0 dev br-lan table local scope link src 192.168.1.1
local 192.168.1.1 dev br-lan table local scope host src 192.168.1.1
broadcast 192.168.1.255 dev br-lan table local scope link src 192.168.1.1
0: from all lookup local
32766: from all lookup main
32767: from all lookup default
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 state UNKNOWN qlen 1000
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
inet6 REDACTED/64 scope link
valid_lft forever preferred_lft forever
6: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
inet6 REDACTED/60 scope global noprefixroute
valid_lft forever preferred_lft forever
inet6 REDACTED/64 scope link
valid_lft forever preferred_lft forever
8: eth0.2@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
inet6 REDACTED/64 scope global dynamic noprefixroute
valid_lft 3598sec preferred_lft 3598sec
inet6 REDACTED/128 scope global dynamic noprefixroute
valid_lft 2608sec preferred_lft 2608sec
inet6 REDACTED/64 scope link
valid_lft forever preferred_lft forever
9: wlan1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
inet6 REDACTED/64 scope link
valid_lft forever preferred_lft forever
10: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
inet6 REDACTED/64 scope link
valid_lft forever preferred_lft forever
default from REDACTED via REDACTED dev eth0.2 metric 512
default from REDACTED::/64 via REDACTED dev eth0.2 metric 512
REDACTED::/64 dev eth0.2 metric 256
unreachable REDACTED::/64 dev lo metric 2147483647
REDACTED::/64 dev br-lan metric 1024
unreachable REDACTED::/48 dev lo metric 2147483647
fe80::/64 dev eth0 metric 256
fe80::/64 dev eth0.2 metric 256
fe80::/64 dev br-lan metric 256
fe80::/64 dev wlan1 metric 256
fe80::/64 dev wlan0 metric 256
local ::1 dev lo table local metric 0
anycast REDACTED:: dev eth0.2 table local metric 0
local REDACTED dev eth0.2 table local metric 0
local REDACTED dev eth0.2 table local metric 0
anycast fd84:b8be:b707:: dev br-lan table local metric 0
local fd84:b8be:b707::1 dev br-lan table local metric 0
anycast fe80:: dev eth0 table local metric 0
anycast fe80:: dev eth0.2 table local metric 0
anycast fe80:: dev br-lan table local metric 0
anycast fe80:: dev wlan1 table local metric 0
anycast fe80:: dev wlan0 table local metric 0
local REDACTED dev wlan0 table local metric 0
local REDACTED dev eth0 table local metric 0
local REDACTED dev eth0.2 table local metric 0
local REDACTED dev br-lan table local metric 0
local REDACTED dev wlan1 table local metric 0
multicast ff00::/8 dev eth0 table local metric 256
multicast ff00::/8 dev br-lan table local metric 256
multicast ff00::/8 dev eth0.2 table local metric 256
multicast ff00::/8 dev wlan1 table local metric 256
multicast ff00::/8 dev wlan0 table local metric 256
0: from all lookup local
32766: from all lookup main
4200000001: from all iif lo lookup unspec 12
4200000006: from all iif br-lan lookup unspec 12
4200000008: from all iif eth0.2 lookup unspec 12
4200000008: from all iif eth0.2 lookup unspec 12
Your configuration looks correct to me. Have you ruled out the possibility that the nameservers of your ISP are not responding as they should? Try to use 8.8.8.8, 1.1.1.1, 9.9.9.9 as upstream dns
Oh, you're absolutely right, it hadn't even crossed my mind, as this problem started just about exactly after updating OpenWRT. I tried setting the router's DNS upstream to Google's or Cloudflare's and it sure does work.
Still seems like an eerie coincidence. Are there any obscurities you can think of that would cause something like this? In any case, I'll take this up with my ISP.
