MT6000 - Local DNS resolutions fail with AdGuard Home enabled

Router
1

Flint 2 running v4.9.1-op25

I cannot get resolution of local host names, or reverse resolution of local IP addresses to work with AdGuard Home enabled. I've specified 4 upstream public DNS addresses (the same 4 I've specified in the GL-iNet GUI) and resolution of remote DNS names works.

I tried setting the private reverse DNS server to 192.168.8.1 (my router's address) but that did not help.

This is probably irrelevant (I hope), but in LuCI I've specified a local domain name for my LAN - OF-LAN. I also have several DNS static lease definitions in DHCP (and defined those same names/addresses in DNS Hostname records. I have no idea how these OpenWRT definitions interact with GL-iNet definitions and/or AdGuard settings.

At the moment I don't think there's any VPN interaction (that a lot of people seem to run into). I have an OpneVPN server running, but nobody is trying to use it. I have no VPN client running on the router.

Because of the local resolution failures I can only run Adguard for very short times, complicating my ability to perform diagnostic tasks. Is there any way to access the AdGuard log when AdGuard is disabled? I've read seemingly conflicting statements regarding this.

BTW, I've run for years without AdGuard Home so it's not critical that I get this working, but lots of people on the GL-iNet forum seem to be using it so I suspect I'm running into something trivial.

Update:
Reverse resolution of local addresses still fails, but I got the forward resolution for local devices working by adding the following lines to my list of upstream DNS servers:

[/OF-LAN/] 192.168.8.1
[//] 192.168.8.1
That means I can keep AdGauard enabled while doing further tests.

As far as I know, I've got nothing that actually needs reverse DNS lookup but I seem to use it a lot when I'm working on local network configuration problems, so I want this working.

I've added

192.168.8.1
to the AdGuard "Private reverse DNS servers" list (In fact, the's the only entry.), checked the "Useprivate revers DNS servers" box, and tried both checking and unchecking "Enable reverse resolving of clients' IP addresses". No luck.

I'm doing my testing from Windows.
nslookup 192.168.8.1

Server: UnKnown
Address: 2601:xxxx:xxxx:xxxx::1
*** UnKnown can't find 192.168.8.1: Non-existent domain

That obscured DNS server address is the public IPv6 address of router's LAN interface - part of the subnet giver by Comcast, my ISP. (I really don't understand IPv6 so that description is probably poor.)

If I disable AdGuard, that same NSLOOKUP returns the correct result (from that same IPv6 DSM server address):
nslookup 192.168.8.1
Server: UnKnown
Address: 2601:602:8680:10e5::1

Name: console.gl-inet.com
Address: 192.168.8.1

If I issue the same command but point to my router as the DNS server, the command return the correct result:
nslookup 192.168.8.1 192.168.8.1

Server: console.gl-inet.com
Address: 192.168.8.1
Name: console.gl-inet.com
Address: 192.168.8.1

With AdGuard enabled, the router's DNS server reached by the router's IPv6 address does not resolve the local (IPv4) address. With AdGuard disabled, the route's DNS server (again reached by its IPv6 address) does resolve the (IPv4) address.

How do I fix this?

3

Hi,

With AdGuard Home Handle Client Requests enabled, AdGuard Home will treat clients using public IPv6 addresses as non-local and reject their private reverse-DNS queries. This would explain why using the IPv4 LAN DNS server works.

There are three options:

  1. Disable only AdGuard Home Handle Client Requests under Admin Panel → Applications → AdGuard Home. The router handles local DNS, while ad blocking continues. This is the simplest option, but AdGuard loses per-device visibility for forwarded queries.

  2. Advertise a ULA IPv6 DNS address. In LuCI’s LAN DHCP/IPv6 settings, advertise the router’s ULA address through DHCPv6 and RA/RDNSS instead of its public IPv6 address. Clients must also have and use ULA addresses for these requests. This preserves per-device visibility and avoids dependence on the ISP’s prefix, but requires additional IPv6 configuration.

  3. Extend AdGuard’s local network list. Back up /etc/AdGuardHome/config.yaml, stop AdGuard Home, and update dns.private_networks to include the default local ranges plus your LAN’s public IPv6 prefix, then restart it. The custom list replaces the defaults, so retain those ranges explicitly. This preserves your current DNS setup and per-device visibility, but requires updating whenever the ISP prefix changes.

Keep your existing forwarding rules and private reverse-DNS server (192.168.8.1). Afterwards, retry nslookup 192.168.8.1 using the client’s default DNS.

4

Thank you. Option #1 was trivially easy. And it's the obvious solution now that I know the an AdGuard "client" is a device in the LAN. That wasn't obvious to me, and I could not find it defined (although I'm sure it is defined somewhere).

Now that I've got it working correctly, is there any reason I need to keep the router's IP addr in the upstream DNS server list or in the private reverse DNS server list?

5

I now understand what you meant by

AdGuard loses per-device visibility for forwarded queries.

All entries in the Query Log come from 127.0.0.1.

I'm now considering your second suggestion, but I don't understand

Doesn't the router's DHCP automatically provide the ULAs? I haven't set anything in the LuCI IPv6 DHCP settings so it's doing whatever it does by default.

I know my Windows computers have (and apparently use) ULAs. I don't know about any of the other devices on my LAN.
It looks like they get and use a delegated prefix addresses rather than ULAs.

My understanding of IPv6 (and of OpenWRT) is very feeble, but it looks like my router should be advertising both PD addresses and ULAs so I'm baffled. IPCONFIG on Windows shows:


Ethernet adapter Ethernet:

   Connection-specific DNS Suffix  . : OF-LAN
   IPv6 Address. . . . . . . . . . . : xxxx:xxxx:xxxx:xxxx::947
   IPv6 Address. . . . . . . . . . . : xxxx:xxxx:xxxx:xxxx:5ff8:f47c:addf:2df6
   Temporary IPv6 Address. . . . . . : xxxx:xxxx:xxxx:xxxx:d47b:54b1:da30:1de4
   Link-local IPv6 Address . . . . . : fe80::c01a:3e6e:8aad:9cd6%25
   IPv4 Address. . . . . . . . . . . : 192.168.8.131
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : fe80::9683:c4ff:feb6:ac40%25
                                       192.168.8.1

(where I've x'ed out the DP). Link-local but no ULA.

Do I want to disable DHCPv6 altogether and just use SLAAC? I have no idea if that changes what I'm seeing or not. I don't understand IPv6 enough to ask intelligent questions here.

Maybe I'd better look into that 3rd option you mentioned.

6

Ha!
For whatever reasons, in OpenWRT, my LAN interface did not have

local (Local ULA)

in its IPv6 prefix filter list. I added it and the router started advertising a ULA to any newly connected device on the LAN. Once that happened I re-enabled

AdGuard Home Handle Client Requests

and AdGaurd is working as I had hoped it would.