Hello GL.iNet Support,
I am reporting a suspected interaction between Network Acceleration and "AdGuard Home Handle Client Requests" on my Flint 3. UDP DNS timed out while TCP DNS directly to AdGuard returned IP addresses. After disabling Network Acceleration, normal DNS to the router worked and AdGuard correctly displayed my computer's IP.
Environment
- Router: GL-BE9300 (Flint 3).
- GL.iNet firmware: 4.10.1.
- LuCI displayed OpenWrt 23.05-SNAPSHOT (r0-3601c2a49).
- AdGuard Home: v0.107.79, confirmed in service logs. Whether this version was bundled or separately updated is not established by this report.
- Router LAN: 192.168.8.1; Windows PowerShell test client: 192.168.8.149.
- AdGuard listens on TCP and UDP port 3053.
- Configured upstream: quic://<NEXTDNS_PROFILE_ID>.dns.nextdns.io (NextDNS over QUIC).
- No VPN in use.
- Network Acceleration was enabled before the workaround; the exact selected acceleration mode was not recorded.
Observed behavior
- With "Handle Client Requests" OFF, DNS worked, but forwarded client queries appeared as localhost/router in AdGuard. Earlier direct port-3053 tests showed the computer's IP.
- With "Handle Client Requests" ON and acceleration enabled, UDP nslookup requests to both 192.168.8.1:53 and :3053 timed out.
- TCP nslookup (-vc) directly to port 3053 returned IP addresses. The transcript contains the beginning of the response; I confirmed that addresses followed. A complete TCP-port-53 result was not retained.
- Router-side tcpdump on br-lan showed UDP packets from my computer to port 3053, return packets from that port, and repeated requests despite those return packets.
- Enabling "Allow Custom DNS to Override VPN DNS" and applying the setting did not resolve the failure. This option was confirmed ON in a screenshot. "Override DNS Settings of All Clients" was shown OFF.
- After disabling Network Acceleration, leaving Handle Client Requests ON and the QUIC upstream unchanged, a normal nslookup to 192.168.8.1 returned IPv4 and IPv6 answers for exampledotcom. AdGuard's Query Log then showed 192.168.8.149 instead of localhost.
Current working configuration
- Network Acceleration OFF.
- AdGuard Home enabled.
- AdGuard Home Handle Client Requests ON.
- NextDNS QUIC upstream unchanged.
- Allow Custom DNS to Override VPN DNS was left ON after the unsuccessful workaround test.
Firewall and log observations
- The supplied ruleset contains a LAN TCP/UDP port-53 PREROUTING jump into dns_dispatcher, then adg_redirect:
meta l4proto { tcp, udp } fib daddr type local redirect to :3053 - fw4 input jumps from br-lan into dns_accept, which explicitly accepts TCP/UDP ports 53 and 3053.
- AdGuard logs show both TCP and UDP listeners on port 3053.
- The filtered service log also contains many dnsmasq "Insecure DS reply received" warnings. Their relationship to this failure is unknown.
- The supplied ruleset includes a WAN DNS port-forward named "port53" and associated reflection rules. Disabling it was recommended during troubleshooting, but its removal was not confirmed. Please account for this configuration when reviewing.
- The 25-packets/second input limit in the raw ruleset is in table arp filter, not an IPv4 DNS input chain.
How the failure was tested
With Handle Client Requests ON and acceleration enabled:
nslookup -timeout=3 -retry=1 examplecom 192.168.8.1
nslookup -timeout=3 -retry=1 -port=3053 exampledotcom 192.168.8.1
Both UDP tests timed out.
TCP comparison:
nslookup -vc -timeout=3 -retry=1 -type=A -port=3053 exampledotcom 192.168.8.1
Returned IP addresses.
After disabling acceleration:
nslookup -timeout=3 -retry=1 examplecom 192.168.8.1
Returned addresses; the exact supplied output is included in 05-client-tests.txt.
Attached are the service logs, full nftables ruleset, two packet-capture transcripts, and client test results. Public WAN IP, device MAC identifiers, private IPv6 prefixes, NextDNS profile ID and unrelated queried domains have been redacted where present. LAN test IPs, ports, rule structure, counters and timestamps are preserved.
glinet-diagnostic-logs-20261017.txt (232.3 KB)