When my ISP box is in bridge mode, my OpenWRT router loses DNS resolution. Internet connectivity still works (I can ping IP addresses like 9.9.9.9), but DNS lookups fail. However, when I switch the ISP box to router mode, DNS resolution and internet access both work correctly.
Setup Details:
OpenWRT version: OpenWrt 24.10.1 r28597-0425664679 / LuCI openwrt-24.10 branch 25.151.78251~e445dc1
Device model: Fujitsu S920
WAN interface: DHCP client
ISP box brand/model: France / Free
Issue occurs: Only when ISP box is in bridge mode
I m adding that I'm using AdGuard Home on port 53 with OpenWRT (dnsmasq is now on port 54).
AdGuard appears functional and logs DNS queries correctly (including blocked entries), but only when the ISP box is in bridge mode.
Observed Behavior:
OpenWRT WAN interface gets IP and gateway via DHCP correctly.
No DNS resolution from OpenWRT or connected clients. I don't know know what else to test.
Pinging IPs (e.g., 9.9.9.9) works fine.
Switching ISP box to router mode fix the DNS functionality.
Restarting dnsmasq → no effect
AdGuard Home Settings :
Upstream DNS servers :
https://dns.adguard-dns.com/dns-query
tls://dns.adguard-dns.com
94.140.14.14
2a10:50c0::ad1:ff
https://dns10.quad9.net/dns-query
[/lan/]127.0.0.1:54
[//]127.0.0.1:54
[/pool.ntp.org/]94.140.14.14
[/pool.ntp.org/]94.140.15.15
[/pool.ntp.org/]2a10:50c0::ad1:ff
[/pool.ntp.org/]2a10:50c0::ad2:ff
quic://dns.adguard-dns.com
Fallback DNS servers :
94.140.14.14
94.140.15.15
2a10:50c0::ad1:ff
2a10:50c0::ad2:ff
Bootstrap DNS servers :
94.140.14.14
94.140.15.15
2a10:50c0::ad1:ff
2a10:50c0::ad2:ff
Private reverse DNS servers :
192.168.1.1:54
127.0.0.1:54
Box Use private reverse DNS resolvers is on
Box Enable reverse resolving of clients'IP addresses is on
I've followed this guide to install the adguard software : https://openwrt.org/docs/guide-user/services/dns/adguard-home
In "/etc/config/network" :
...
config interface 'lan'
option device 'br-lan'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'
list dns '192.168.1.1'
config interface 'wan'
option device 'eth1'
option proto 'dhcp'
option peerdns '0'
list dns '94.140.14.14'
list dns '94.140.15.15'
list dns '2a10:50c0::ad1:ff'
list dns '2a10:50c0::ad2:ff'
config interface 'wan6'
option device 'eth1'
option proto 'dhcpv6'
option peerdns '0'
list dns '2a10:50c0::ad1:ff'
list dns '2a10:50c0::ad2:ff'
In "/etc/config/dhcp" :
config dnsmasq
option domainneeded '1'
option boguspriv '1'
option filterwin2k '0'
option localise_queries '1'
option rebind_protection '0'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option nonegcache '0'
option cachesize '1000'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option nonwildcard '1'
option localservice '1'
option ednspacket_max '1232'
option filter_aaaa '0'
option filter_a '0'
option port '54'
option noresolv '0'
list server '192.168.1.1'
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '24h'
option dhcpv4 'server'
option dhcpv6 'server'
option ra 'server'
list ra_flags 'managed-config'
list ra_flags 'other-config'
list dhcp_option '6,192.168.1.1'
list dhcp_option '3,192.168.1.1'
list dns 'fdc1:93:ff10::1'
...
In /etc/resolv.conf
search lan
nameserver 127.0.0.1
nameserver ::1
in logs (when ISP box is in router mode):
Wed Jun 4 17:55:07 2025 daemon.info dnsmasq[1]: using nameserver 192.168.1.1#53
Wed Jun 4 17:55:07 2025 daemon.info dnsmasq[1]: using nameserver 192.168.1.1#53
Wed Jun 4 17:55:07 2025 daemon.info dnsmasq[1]: using nameserver 94.140.14.14#53
Wed Jun 4 17:55:07 2025 daemon.info dnsmasq[1]: using nameserver 94.140.15.15#53
Wed Jun 4 17:55:07 2025 daemon.info dnsmasq[1]: using nameserver 2a10:50c0::ad1:ff#53
Wed Jun 4 17:55:07 2025 daemon.info dnsmasq[1]: using nameserver 2a10:50c0::ad2:ff#53
netstat -tuln | grep :53 :
tcp 0 0 :::53 :::* LISTEN
udp 0 0 :::53 :::*
netstat -tuln | grep :54 :
tcp 0 0 192.168.1.1:54 0.0.0.0:* LISTEN
tcp 0 0 192.168.1.118:54 0.0.0.0:* LISTEN <- Me
...