im using https dns proxy and it is configured with default 1.1.1.1 resolver.
the problem is it does work fine after i reboot the router but after some times all my devices start using isp dns resolver which is google DNS.
i have already applied DNS hijacking and I'm also using dnsmasq-full with PBR.
any expert please help.
What is “DNS Proxy” - there is like 10 of those in packages tree.
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button (red circle; this works best in the 'Markdown' composer view in the blue oval):
Remember to redact passwords, VPN keys, MAC addresses and any public IP addresses you may have:
ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall
kill -s USR1 dnsasq ; sleep 5 ; logread -e masq | tail
im using this one
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
OpenWrt 24.10.3, r28872-daca7c049b
-----------------------------------------------------
root@asif:~# ubus call system board
{
"kernel": "6.6.104",
"hostname": "asif",
"system": "ARMv8 Processor rev 4",
"model": "Cudy WR3000S v1",
"board_name": "cudy,wr3000s-v1",
"rootfs_type": "squashfs",
"release": {
"distribution": "OpenWrt",
"version": "24.10.3",
"revision": "r28872-daca7c049b",
"target": "mediatek/filogic",
"description": "OpenWrt 24.10.3 r28872-daca7c049b",
"builddate": "1758316778"
}
}
root@asif:~# cat /etc/config/network
config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd4e:9e8d:9b5d::/48'
option packet_steering '1'
config device
option name 'br-lan'
option type 'bridge'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'lan4'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '10.0.1.1'
option netmask '255.255.255.0'
option ip6assign '60'
config interface 'wan'
option device 'wan'
option proto 'dhcp'
config interface 'wan6'
option device 'wan'
option proto 'dhcpv6'
config device
option type 'bridge'
option name 'br-vpn'
option bridge_empty '1'
config interface 'vpn'
option proto 'static'
option device 'br-vpn'
option ipaddr '10.0.2.1'
option netmask '255.255.255.0'
config interface 'cf_wg'
option proto 'wireguard'
option private_key 'WJra7S9VkXyccaRIaftEF4BcBOywxlwB/P0WtTnFvEs='
list addresses '172.16.0.2/32'
list addresses '2606:4700:110:89fc:1ad7:bfa7:c404:9156/128'
list dns '1.1.1.1'
list dns '1.0.0.1'
list dns '2606:4700:4700::1111'
list dns '2606:4700:4700::1001'
option mtu '1280'
config wireguard_cf_wg
option description 'Imported peer configuration'
option public_key 'bmXOC+F1FxEMF9dyiK2H5/1SUtzH0JuVo51h2wPfgyo='
list allowed_ips '0.0.0.0/0'
list allowed_ips '::/0'
option endpoint_host 'engage.cloudflareclient.com'
option endpoint_port '2408'
option persistent_keepalive '25'
root@asif:~# cat /etc/config/wireless
config wifi-device 'radio0'
option type 'mac80211'
option path 'platform/soc/18000000.wifi'
option band '2g'
option channel 'auto'
option htmode 'HE40'
option country 'SA'
option cell_density '0'
config wifi-iface 'default_radio0'
option device 'radio0'
option network 'lan'
option mode 'ap'
option ssid 'Bee'
option encryption 'psk2'
option key ''
config wifi-device 'radio1'
option type 'mac80211'
option path 'platform/soc/18000000.wifi+1'
option band '5g'
option channel 'auto'
option htmode 'HE80'
option cell_density '0'
config wifi-iface 'default_radio1'
option device 'radio1'
option network 'lan'
option mode 'ap'
option ssid 'Bee'
option encryption 'psk2'
option key ''
config wifi-iface 'wifinet2'
option device 'radio0'
option mode 'ap'
option ssid 'ZERO'
option encryption 'psk2'
option key '95506666'
option network 'vpn'
config wifi-iface 'wifinet3'
option device 'radio1'
option mode 'ap'
option ssid 'ZERO'
option encryption 'psk2'
option key ''
option network 'vpn'
root@asif:~# cat /etc/config/dhcp
config dnsmasq
option domainneeded '1'
option boguspriv '1'
option filterwin2k '0'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option nonegcache '0'
option cachesize '1000'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option nonwildcard '1'
option localservice '1'
option ednspacket_max '1232'
option filter_aaaa '0'
option filter_a '0'
list addnmount '/bin/busybox'
list addnmount '/var/run/adblock-lean/abl-blocklist.gz'
list addnmount '/var/run/pbr.dnsmasq'
option doh_backup_noresolv '-1'
option noresolv '1'
list doh_backup_server ''
list doh_backup_server '/mask.icloud.com/'
list doh_backup_server '/mask-h2.icloud.com/'
list doh_backup_server '/use-application-dns.net/'
list doh_backup_server '127.0.0.1#5053'
list doh_backup_server '127.0.0.1#5054'
list server '/mask.icloud.com/'
list server '/mask-h2.icloud.com/'
list server '/use-application-dns.net/'
list server '127.0.0.1#5053'
list server '127.0.0.1#5054'
list doh_server '127.0.0.1#5053'
list doh_server '127.0.0.1#5054'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option dhcpv4 'server'
option dhcpv6 'server'
option ra 'server'
list ra_flags 'managed-config'
list ra_flags 'other-config'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
config dhcp 'vpn'
option interface 'vpn'
option start '100'
option limit '150'
option leasetime '12h'
root@asif:~# cat /etc/config/firewall
config defaults
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option synflood_protect '1'
config zone
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
list network 'wan'
list network 'wan6'
list network 'cf_wg'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config zone
option name 'vpn'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
list network 'vpn'
config forwarding
option src 'vpn'
option dest 'wan'
config rule
option src 'vpn'
option name 'dns-vpn'
option dest_port '53'
option target 'ACCEPT'
config rule
option src 'vpn'
option name 'dhcp-vpn'
option dest_port '67'
option target 'ACCEPT'
list proto 'udp'
config redirect 'dns_int'
option name 'Intercept-DNS'
option family 'any'
option proto 'tcp udp'
option src 'lan'
option src_dport '53'
option dest_port '53'
option target 'DNAT'
root@asif:~# kill -s USR1 dnsasq ; sleep 5 ; logread -e masq | tail
ash: invalid number 'dnsasq'
Fri Oct 24 17:27:12 2025 daemon.warn dnsmasq-dhcp[1]: not giving name Asif.lan t o the DHCP lease of 10.0.1.146 because the name exists in /tmp/hosts/dhcp.cfg014 11c with address 10.0.2.1
Fri Oct 24 17:27:12 2025 daemon.warn dnsmasq-dhcp[1]: not giving name Asif to th e DHCP lease of 10.0.1.146 because the name exists in /tmp/hosts/dhcp.cfg01411c with address 10.0.2.1
Fri Oct 24 17:31:29 2025 daemon.info dnsmasq-dhcp[1]: DHCPREQUEST(br-vpn) 10.0.2 .110 5e:2c:d6:44:5f:a7
Fri Oct 24 17:31:29 2025 daemon.info dnsmasq-dhcp[1]: DHCPACK(br-vpn) 10.0.2.110 5e:2c:d6:44:5f:a7
Fri Oct 24 17:31:29 2025 daemon.warn dnsmasq-dhcp[1]: not giving name Asif.lan t o the DHCP lease of 10.0.1.146 because the name exists in /tmp/hosts/dhcp.cfg014 11c with address 10.0.1.1
Fri Oct 24 17:31:29 2025 daemon.warn dnsmasq-dhcp[1]: not giving name Asif to th e DHCP lease of 10.0.1.146 because the name exists in /tmp/hosts/dhcp.cfg01411c with address 10.0.1.1
Fri Oct 24 17:32:35 2025 daemon.info dnsmasq-dhcp[1]: DHCPREQUEST(br-vpn) 10.0.2 .183 d2:0a:01:71:ee:49
Fri Oct 24 17:32:35 2025 daemon.info dnsmasq-dhcp[1]: DHCPACK(br-vpn) 10.0.2.183 d2:0a:01:71:ee:49
Fri Oct 24 17:32:35 2025 daemon.warn dnsmasq-dhcp[1]: not giving name Asif.lan t o the DHCP lease of 10.0.1.146 because the name exists in /tmp/hosts/dhcp.cfg014 11c with address 10.0.2.1
Fri Oct 24 17:32:35 2025 daemon.warn dnsmasq-dhcp[1]: not giving name Asif to th e DHCP lease of 10.0.1.146 because the name exists in /tmp/hosts/dhcp.cfg01411c with address 10.0.2.1
root@asif:~#
My bad missed a caracter
kill -s USR1 dnsmasq ; sleep 5 ; logread -e masq | tail
What is this option supposed to accomplish?
root@asif:~# kill -s USR1 dnsmasq ; sleep 5 ; logread -e masq | tail
ash: invalid number 'dnsmasq'
Fri Oct 24 17:52:12 2025 daemon.warn dnsmasq-dhcp[1]: not giving name Asif.lan to the DHCP lease of 10.0.1.146 because the name exists in /tmp/hosts/dhcp.cfg01411c with address 10.0.1.1
Fri Oct 24 17:52:12 2025 daemon.warn dnsmasq-dhcp[1]: not giving name Asif to the DHCP lease of 10.0.1.146 because the name exists in /tmp/hosts/dhcp.cfg01411c with address 10.0.1.1
Fri Oct 24 17:58:31 2025 daemon.info dnsmasq-dhcp[1]: DHCPREQUEST(br-vpn) 10.0.2.118 ce:c1:19:ac:55:a3
Fri Oct 24 17:58:31 2025 daemon.info dnsmasq-dhcp[1]: DHCPACK(br-vpn) 10.0.2.118 ce:c1:19:ac:55:a3 POCO-X6-Pro-5G
Fri Oct 24 17:58:31 2025 daemon.warn dnsmasq-dhcp[1]: not giving name Asif.lan to the DHCP lease of 10.0.1.146 because the name exists in /tmp/hosts/dhcp.cfg01411c with address 10.0.2.1
Fri Oct 24 17:58:31 2025 daemon.warn dnsmasq-dhcp[1]: not giving name Asif to the DHCP lease of 10.0.1.146 because the name exists in /tmp/hosts/dhcp.cfg01411c with address 10.0.2.1
Fri Oct 24 18:01:00 2025 daemon.info dnsmasq-dhcp[1]: DHCPREQUEST(br-vpn) 10.0.2.110 5e:2c:d6:44:5f:a7
Fri Oct 24 18:01:00 2025 daemon.info dnsmasq-dhcp[1]: DHCPACK(br-vpn) 10.0.2.110 5e:2c:d6:44:5f:a7
Fri Oct 24 18:01:00 2025 daemon.warn dnsmasq-dhcp[1]: not giving name Asif.lan to the DHCP lease of 10.0.1.146 because the name exists in /tmp/hosts/dhcp.cfg01411c with address 10.0.1.1
Fri Oct 24 18:01:00 2025 daemon.warn dnsmasq-dhcp[1]: not giving name Asif to the DHCP lease of 10.0.1.146 because the name exists in /tmp/hosts/dhcp.cfg01411c with address 10.0.1.1
root@asif:~#
no idea i dont know what is this.
It's how https-dns-proxy backs up existing dhcp settings before changing them, to restore on uninstall.