Getting DNS updates through luci-app-https-dns-proxy

[dgilman]

I have luci-app-https-dns-proxy configured to force_dns / Force Router DNS. At the same time, inside of my network, I am trying to use nsupdate to send a dynamic DNS update to an authoritative nameserver. The DNS update request times out[1]. I can confirm if I turn off the force_dns configuration my DNS update does make it through to the authoritative server.

Is there some configuration magic I can do to allow the https-dns-proxy to let these specific requests through? I am not seeing anything on the docs page but maybe I can cheese it with a firewall rule or something?

[1] If I do the “server” command in nsupdate to force the IP of the authoritative nameserver I instead get “dns_request_getresponse: expected a TSIG or SIG(0)” which I imagine is the result of the “reject rule” behavior from luci-app-https-dns-proxy

[brada4]

You will have to do that manually

• https://openwrt.org/docs/guide-user/firewall/fw3_configurations/intercept_dns#dns_redirection
  Pay attention to excludes in the rule.

[egc]

@dgilman

I can confirm if I turn off the force_dns configuration my DNS update does make it through to the authoritative server

Then your DNS update does not use DNS53 but probably DNS853 aka DoT (DNS over TLS via port 853) just let your DNS update use normal DNS53 or make an exception for the IP address of your DNS updater as mentioned above