Device: GL-BE3600, firmware 4.10.1 release1 (2026-09-18 20:51:02), OpenWrt 23.05-SNAPSHOT r0-3601c2a49, kernel 5.4.213. Uplink: repeater (wwan).
DNS settings:
gl-dns-v2.@dns[0].mode='secure'
gl-dns-v2.@dns[0].provider='cloudflare'
gl-dns-v2.@dns[0].proto='dot'
gl-dns-v2.@dns[0].servers_list='Standard'
gl-dns-v2.@dns[0].force_dns='1'
gl-dns-v2.@dns[0].override_vpn='1'
After a power outage the router booted with /etc/dnsproxy/dnsproxy.yaml empty. dnsproxy crash-loops and nothing listens on port 5453. dnsmasq forwards only to 127.0.0.1#5453 (noresolv=1), so LAN clients get no DNS. No plaintext fallback is expected with these settings. The bug is that the config never recovers.
Not reproducible on every power loss: I power-cycled this router roughly 20-30 times (unplug/replug, moving it around) before this happened; it failed once, discovered the next morning. So this looks timing-dependent (likely whether the power cut lands during/near the dnsproxy.yaml rewrite), not a guaranteed failure on every power loss.
Boot log:
kernel: qti_scm_restart_reason: reset_reason : Power on Reset [0x20]
kernel: UBIFS (ubi0:3): recovery needed
kernel: UBIFS (ubi0:3): recovery completed
dnsproxy[5457]: ERROR running dnsproxy err="creating proxy: general upstreams: no upstream specified"
procd: Instance dnsproxy::instance1 s in a crash loop 6 crashes, 0 seconds since last crash
The first dnsproxy start (S18, ~25 s after kernel start) already failed, before /etc/init.d/gl_dns (S95) touched the file. So the file was already broken on flash after UBIFS recovery.
Issue 1: dnsproxy.yaml does not survive a power cut.
gl_dns boot calls dns set_config on every boot, and set_config rewrites dnsproxy.yaml. I can't read the compiled /usr/lib/oui-httpd/rpc/dns. The result matches an in-place rewrite without fsync, which UBIFS can leave zero-length after power loss.
Issue 2: set_config can't repair a broken file.
set_config doesn't render the file from a template. It patches the existing upstream: block. With no block to patch, it writes back a single newline:
# hexdump -C /etc/dnsproxy/dnsproxy.yaml
00000000 0a
Repro: with a newline-only dnsproxy.yaml in place, run set_config (the same call gl_dns boot makes). The file stays 0a and dnsproxy keeps crashing. Every reboot repeats this, so the router never recovers on its own.
Workaround:
cp /rom/etc/dnsproxy/dnsproxy.yaml /etc/dnsproxy/dnsproxy.yaml
config=$(ubus call gl-session call '{"module":"dns","func":"get_config"}' | jsonfilter -e '@.result')
ubus call gl-session call "{\"module\":\"dns\",\"func\":\"set_config\",\"params\":$config}"
Afterwards the file contains upstream: - tls://one.one.one.one, dnsproxy listens on :5453, and resolution works.
Expected:
- write dnsproxy.yaml to a temp file, fsync, rename;
- render it from
/rom/etc/dnsproxy/dnsproxy.yamlwhen the file is empty or has noupstream:block.
Possibly related (same symptom, nothing listening on 5453, different backend): [BUG] Encrypted DNS (DoH) not working on MT6000 Flint 2 - Firmware 4.8.4