Internal DNS not responding in guest network

amarel · December 19, 2024, 3:33pm

I tried to setup separate lan and ssid for my IoT devices. I decided that this tutorial:
https://openwrt.org/docs/guide-user/network/wifi/guestwifi/configuration_webinterface
fits my needs and configured everything as described there. My lan interface uses 192.168.100.1/24 and my new iot interface uses 192.168.101.1/24. When I connect to new wifi network, I get correct IP address from DHCP, I can ping 8.8.8.8, but I cannot use DNS at 192.168.101.1:53 - however I can use DNS at 192.168.100.1:53. I gathered some screenshots, please help

TELNET TO DNS SERVER:

amarel · December 19, 2024, 3:33pm

FIREWALL RULE:

psherman · December 19, 2024, 3:34pm

The best way to figure out what is wrong will be to look at the configuration.

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall

amarel · December 19, 2024, 3:35pm

Ok, I will do it i a few hours because Im not at home now.

frollic · December 19, 2024, 3:58pm

If you can ping 8.8.8.8, tell your guest clients to use it, instead of your internal DNS ?

totkeks · December 19, 2024, 4:24pm

As you have a working firewall rule and you can also connect to the dns on 192.168.100.1:53, I would assume that your DNS server is not listening on the other IP.

There is a interface list in the dnsmasq config in /etc/config/dhcp.

Can also check this with netstat -lunp, which prints out all ports services are listening on.

Should look like this if dnsmasq is listening on both:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
udp        0      0 192.168.100.1:53           0.0.0.0:*                           11045/dnsmasq
udp        0      0 192.168.101.1:53           0.0.0.0:*                           11045/dnsmasq

amarel · December 20, 2024, 1:04am

Thank you for all your responses. I gathered more details (private data replaced by XXXXX):

================ netstat -lunp ================

root@openwrt:~#  netstat -lunp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
udp        0      0 127.0.0.1:53            0.0.0.0:*                           11571/dnsmasq
udp        0      0 192.168.101.1:53        0.0.0.0:*                           11571/dnsmasq
udp        0      0 192.168.100.1:53        0.0.0.0:*                           11571/dnsmasq
[.....]

================ ubus call system board ================

root@openwrt:~# ubus call system board
{
	"kernel": "5.15.167",
	"hostname": "openwrt",
	"system": "ARMv8 Processor rev 4",
	"model": "GL.iNet GL-MT6000",
	"board_name": "glinet,gl-mt6000",
	"rootfs_type": "squashfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "23.05.5",
		"revision": "r24106-10cc5fcd00",
		"target": "mediatek/filogic",
		"description": "OpenWrt 23.05.5 r24106-10cc5fcd00"
	}
}

================ cat /etc/config/network ================

root@openwrt:~# cat /etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix XXXXX'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'
	list ports 'lan5'

config device
	option name 'lan1'
	option macaddr 'XXXXX'

config device
	option name 'lan2'
	option macaddr 'XXXXX'

config device
	option name 'lan3'
	option macaddr 'XXXXX'

config device
	option name 'lan4'
	option macaddr 'XXXXX'

config device
	option name 'lan5'
	option macaddr 'XXXXX'

config interface 'lan'
	option device 'br-lan'
	option proto 'static'
	option ipaddr '192.168.100.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

config device
	option name 'eth1'
	option macaddr 'XXXXX'
	option ipv6 '0'

config interface 'wan'
	option device 'eth1.35'
	option proto 'pppoe'
	option username 'XXXXX'
	option password 'XXXXX'
	option ipv6 '0'

config interface 'wan6'
	option device 'eth1'
	option proto 'dhcpv6'
	option disabled '1'
	option auto '0'
	option reqaddress 'try'
	option reqprefix 'auto'

config device
	option name 'eth0'
	option ipv6 '0'

config device
	option name 'eth1.35'
	option type '8021q'
	option ifname 'eth1'
	option vid '35'
	option ipv6 '0'

config device
	option name 'pppoe-wan'
	option ipv6 '0'

config device
	option type 'bridge'
	option name 'br-iot'
	option bridge_empty '1'
	option ipv6 '0'

config interface 'iot'
	option proto 'static'
	option device 'br-iot'
	option ipaddr '192.168.101.1'
	option netmask '255.255.255.0'

================ cat /etc/config/wireless ================

root@openwrt:~# cat /etc/config/wireless

config wifi-device 'radio0'
	option type 'mac80211'
	option path 'platform/soc/18000000.wifi'
	option channel 'auto'
	option band '2g'
	option htmode 'HT20'
	option country 'PL'
	option cell_density '0'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option network 'lan'
	option mode 'ap'
	option ssid 'XXXXX-2GHz'
	option encryption 'psk2'
	option key 'XXXXX'

config wifi-device 'radio1'
	option type 'mac80211'
	option path 'platform/soc/18000000.wifi+1'
	option channel 'auto'
	option band '5g'
	option htmode 'VHT80'
	option cell_density '0'
	option country 'PL'

config wifi-iface 'default_radio1'
	option device 'radio1'
	option network 'lan'
	option mode 'ap'
	option ssid 'XXXXX-5GHz'
	option encryption 'psk2'
	option key 'XXXXX'

config wifi-iface 'wifinet7'
	option device 'radio0'
	option mode 'ap'
	option ssid 'XXXXX-private'
	option encryption 'psk2'
	option key 'XXXXX'
	option network 'iot'

================ cat /etc/config/dhcp ================

root@openwrt:~# cat /etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option localservice '1'
	option ednspacket_max '1232'
	list notinterface 'wan'
	list notinterface 'wan6'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'iot'
	option interface 'iot'
	option start '100'
	option limit '150'
	option leasetime '12h'

================ cat /etc/config/firewall ================

root@openwrt:~# cat /etc/config/firewall

config defaults
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option synflood_protect '1'

config zone
	option name 'lan'
	list network 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'

config zone
	option name 'wan'
	list network 'wan'
	list network 'wan6'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	option masq '1'
	option mtu_fix '1'

config forwarding
	option src 'lan'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-Renew'
	option src 'wan'
	option proto 'udp'
	option dest_port '68'
	option target 'ACCEPT'
	option family 'ipv4'

config rule
	option name 'Allow-Ping'
	option src 'wan'
	option proto 'icmp'
	option icmp_type 'echo-request'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-IGMP'
	option src 'wan'
	option proto 'igmp'
	option family 'ipv4'
	option target 'ACCEPT'

config rule
	option name 'Allow-DHCPv6'
	option src 'wan'
	option proto 'udp'
	option dest_port '546'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-MLD'
	option src 'wan'
	option proto 'icmp'
	option src_ip 'fe80::/10'
	list icmp_type '130/0'
	list icmp_type '131/0'
	list icmp_type '132/0'
	list icmp_type '143/0'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Input'
	option src 'wan'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	list icmp_type 'router-solicitation'
	list icmp_type 'neighbour-solicitation'
	list icmp_type 'router-advertisement'
	list icmp_type 'neighbour-advertisement'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-ICMPv6-Forward'
	option src 'wan'
	option dest '*'
	option proto 'icmp'
	list icmp_type 'echo-request'
	list icmp_type 'echo-reply'
	list icmp_type 'destination-unreachable'
	list icmp_type 'packet-too-big'
	list icmp_type 'time-exceeded'
	list icmp_type 'bad-header'
	list icmp_type 'unknown-header-type'
	option limit '1000/sec'
	option family 'ipv6'
	option target 'ACCEPT'

config rule
	option name 'Allow-IPSec-ESP'
	option src 'wan'
	option dest 'lan'
	option proto 'esp'
	option target 'ACCEPT'

config rule
	option name 'Allow-ISAKMP'
	option src 'wan'
	option dest 'lan'
	option dest_port '500'
	option proto 'udp'
	option target 'ACCEPT'

config zone
	option name 'iot'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'iot'

config forwarding
	option src 'iot'
	option dest 'wan'

config rule
	option name 'Allow-DHCP-IoT'
	list proto 'udp'
	option src 'iot'
	option dest_port '67'
	option target 'ACCEPT'

config rule
	option name 'Allow-DNS-IoT'
	option src 'iot'
	option dest_port '53'
	option target 'ACCEPT'
	option dest '*'

psherman · December 20, 2024, 1:09am

Remove the last line (destination):

Remove these two lines rom the DHCP file:

Reboot and test again.

amarel · December 20, 2024, 1:35am

I made changes and still not working

TELNET FROM MY PC:

xxxxx@fedora:~$ telnet 192.168.101.1 53
Trying 192.168.101.1...
telnet: connect to address 192.168.101.1: Connection refused

IP ADDRESS SHOW ON MY PC:

xxxxx@fedora:~$ ip a s
[.....]
2: wlp0s20f3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    [.....]
    inet 192.168.101.156/24 brd 192.168.101.255 scope global dynamic 
[.....]

cat /etc/config/firewall

root@openwrt:~# cat /etc/config/firewall
[.....]
config rule
	option name 'Allow-DNS-IoT'
	option src 'iot'
	option dest_port '53'
	option target 'ACCEPT'
[.....]

cat /etc/config/dhcp

root@openwrt:~# cat /etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option cachesize '1000'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
	option localservice '1'
	option ednspacket_max '1232'

config dhcp 'lan'
	option interface 'lan'
	option start '100'
	option limit '150'
	option leasetime '12h'
	option dhcpv4 'server'
	option dhcpv6 'server'
	option ra 'server'
	list ra_flags 'managed-config'
	list ra_flags 'other-config'

config dhcp 'wan'
	option interface 'wan'
	option ignore '1'

config odhcpd 'odhcpd'
	option maindhcp '0'
	option leasefile '/tmp/hosts/odhcpd'
	option leasetrigger '/usr/sbin/odhcpd-update'
	option loglevel '4'

config dhcp 'iot'
	option interface 'iot'
	option start '100'
	option limit '150'
	option leasetime '12h'

psherman · December 20, 2024, 1:38am

what happens if you issue this from your pc:

nslookup openwrt.org
nslookup openwrt.org 8.8.8.8
nslookup openwrt.org 192.168.101.1

amarel · December 20, 2024, 2:05am

I attached results below, but I have also discovered something interesting. Sometimes when I try to ping 8.8.8.8 (while connected to iot ssid), then first answer is coming after a few seconds (ping freezing) - maybe it is not related to my problem.

xxxxx@fedora:~$ nslookup openwrt.org
;; Got SERVFAIL reply from 127.0.0.53
Server:		127.0.0.53
Address:	127.0.0.53#53

** server can't find openwrt.org: SERVFAIL


xxxxx@fedora:~$ nslookup openwrt.org 8.8.8.8
Server:		8.8.8.8
Address:	8.8.8.8#53

Non-authoritative answer:
Name:	openwrt.org
Address: 64.226.122.113
Name:	openwrt.org
Address: 2a03:b0c0:3:d0::1a51:c001


xxxxx@fedora:~$ nslookup openwrt.org 192.168.101.1
;; communications error to 192.168.101.1#53: connection refused
;; communications error to 192.168.101.1#53: connection refused
;; communications error to 192.168.101.1#53: connection refused
;; no servers could be reached


xxxxx@fedora:~$ resolvectl status
[.....]
Link 2 (wlp0s20f3)
    Current Scopes: DNS LLMNR/IPv4
         Protocols: +DefaultRoute LLMNR=resolve -mDNS -DNSOverTLS DNSSEC=no/unsupported
Current DNS Server: 192.168.101.1
       DNS Servers: 192.168.101.1
        DNS Domain: lan
[.....]

psherman · December 20, 2024, 2:08am

Can you try another computer, or even just a mobile phone/tablet?

porshuram · December 20, 2024, 11:20am

post the ouput of following commands from openwrt (ssh)

nslookup duckduckgo.com
nslookup duckduckgo.com 0.0.0.0
nslookup duckduckgo.com 127.0.0.1
nslookup duckduckgo.com 192.168.100.1
nslookup duckduckgo.com 192.168.101.1
nslookup duckduckgo.com 1.1.1.1
cat /etc/resolv.conf
service
ip address
cat /etc/dnsmasq.conf

and the full output of
netstat -lunp

amarel · December 20, 2024, 12:26pm

I have checked other devices and wow, it worked!!! So I came back to my computer and I run 'ip a s' - I found network created by my VMware software for one of my virtual machines (192.168.101.0/24) so there was address conflict between my VM network and WIFI network. I am really sorry for wasting your time, and I am very grateful for all your help and very fast answers!!!!!!

system · December 30, 2024, 12:26pm

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.