# \[BUG\] GL-BE3600 4.10.1: dnsproxy.yaml left empty after power loss, Encrypted DNS never recovers

**URL:** <https://forum.gl-inet.com/t/bug-gl-be3600-4-10-1-dnsproxy-yaml-left-empty-after-power-loss-encrypted-dns-never-recovers/72436>\
**Category:** VPN, DNS, Leaks\
**Created:** [October 29, 2026, 3:59pm UTC](https://forum.gl-inet.com/t/bug-gl-be3600-4-10-1-dnsproxy-yaml-left-empty-after-power-loss-encrypted-dns-never-recovers/72436 "2026-10-29T15:59:51Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![gh0stx](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/g/35a633/32.png) [@gh0stx](https://forum.gl-inet.com/u/gh0stx)\
**Post date:** [October 29, 2026, 3:59pm UTC](https://forum.gl-inet.com/t/bug-gl-be3600-4-10-1-dnsproxy-yaml-left-empty-after-power-loss-encrypted-dns-never-recovers/72436/1 "2026-10-29T15:59:51Z")

</div>

**Device:** GL-BE3600, firmware 4.10.1 release1 (2026-09-18 20:51:02), OpenWrt 23.05-SNAPSHOT r0-3601c2a49, kernel 5.4.213. Uplink: repeater (wwan).

**DNS settings:**

```auto
gl-dns-v2.@dns[0].mode='secure'
gl-dns-v2.@dns[0].provider='cloudflare'
gl-dns-v2.@dns[0].proto='dot'
gl-dns-v2.@dns[0].servers_list='Standard'
gl-dns-v2.@dns[0].force_dns='1'
gl-dns-v2.@dns[0].override_vpn='1'

```

After a power outage the router booted with `/etc/dnsproxy/dnsproxy.yaml` empty. dnsproxy crash-loops and nothing listens on port 5453. dnsmasq forwards only to `127.0.0.1#5453` (`noresolv=1`), so LAN clients get no DNS. No plaintext fallback is expected with these settings. The bug is that the config never recovers.

Not reproducible on every power loss: I power-cycled this router roughly 20-30 times (unplug/replug, moving it around) before this happened; it failed once, discovered the next morning. So this looks timing-dependent (likely whether the power cut lands during/near the dnsproxy.yaml rewrite), not a guaranteed failure on every power loss.

Boot log:

```auto
kernel: qti_scm_restart_reason: reset_reason : Power on Reset [0x20]
kernel: UBIFS (ubi0:3): recovery needed
kernel: UBIFS (ubi0:3): recovery completed
dnsproxy[5457]: ERROR running dnsproxy err="creating proxy: general upstreams: no upstream specified"
procd: Instance dnsproxy::instance1 s in a crash loop 6 crashes, 0 seconds since last crash

```

The first dnsproxy start (S18, ~25 s after kernel start) already failed, before `/etc/init.d/gl_dns` (S95) touched the file. So the file was already broken on flash after UBIFS recovery.

**Issue 1: dnsproxy.yaml does not survive a power cut.**  
`gl_dns boot` calls `dns set_config` on every boot, and set\_config rewrites dnsproxy.yaml. I can't read the compiled `/usr/lib/oui-httpd/rpc/dns`. The result matches an in-place rewrite without fsync, which UBIFS can leave zero-length after power loss.

**Issue 2: set\_config can't repair a broken file.**  
set\_config doesn't render the file from a template. It patches the existing `upstream:` block. With no block to patch, it writes back a single newline:

```auto
# hexdump -C /etc/dnsproxy/dnsproxy.yaml
00000000 0a

```

Repro: with a newline-only dnsproxy.yaml in place, run set\_config (the same call `gl_dns boot` makes). The file stays `0a` and dnsproxy keeps crashing. Every reboot repeats this, so the router never recovers on its own.

**Workaround:**

```auto
cp /rom/etc/dnsproxy/dnsproxy.yaml /etc/dnsproxy/dnsproxy.yaml
config=$(ubus call gl-session call '{"module":"dns","func":"get_config"}' | jsonfilter -e '@.result')
ubus call gl-session call "{\"module\":\"dns\",\"func\":\"set_config\",\"params\":$config}"

```

Afterwards the file contains `upstream: - tls://one.one.one.one`, dnsproxy listens on `:5453`, and resolution works.

**Expected:**

- write dnsproxy.yaml to a temp file, fsync, rename;
- render it from `/rom/etc/dnsproxy/dnsproxy.yaml` when the file is empty or has no `upstream:` block.

Possibly related (same symptom, nothing listening on 5453, different backend): [[BUG] Encrypted DNS (DoH) not working on MT6000 Flint 2 - Firmware 4.8.4](https://forum.gl-inet.com/t/bug-encrypted-dns-doh-not-working-on-mt6000-flint-2-firmware-4-8-4/67827)