Network>DNS Server Simple Config Question

Router
1

In setting up Network→DNS Servers, there are input boxes for up to 4 servers. I understand that only one is needed (doing a Manual Configuration), but wasn’t sure on what happens if 2 or more DNS server ip’s were entered; specifically are they used (parallell?), or are they used sequentionally so if the 1st fails, it then tries the 2nd, …?

I have searched this topic but have come up with conflicting results so was hoping to get a more confident answer here. Why am I interested? Using AGH installed on rpi for more flexibility, control over config, etc and have a 2nd rpi (emergency use only as it is an rpi zero 2w) with an identical config (manual “sync” via copying yaml files). If 1st rpi goes down, current process is to login to router and change Network>DNS server ip. If 2nd rpi ip could be entered as 2nd DNS server on teh router and it only gets used if the 1st rpi / agh instance fails.

All insights welcome.

2

I use 4 two are ipv4 the second one is “backup” the other two are ipv6 same story one is backup .

You could use multiple providers if you like or use all from one provider. 1.1.1.1 or 8.8.8.8 or 9.9.9.9 or the given by your provider or a service provider like nextdns for more ad en security controls

3

Thank you for the reply.

Still open question though is are the servers queried “in paralell” or only when one fails. For example: DNS Server 1 is 1.1.1.1, server 2 is 9.9.9.9, server 3 is 8.8.8.8. Are all 3 used for DNS or is server 2 only used if server 1 fails, and server 3 only used of both 1 &2 fail (sequential vs parallel)?

What I would like to configure is a strictly sequential process so that I can use 2 rpi’s with adguard home installed with identical confgs. 1 rpi is primary and 1 is secondary. Secondary should only be used if primary fails since secondary does not have as many free resources and should onlt be used in “emergency” when primary fails. As soo as primary is fixed, it goes back to resolving dns and secondary stops. So in Network DNS: DNS Server 1 set to Primary RPI IP, DNS Server 2 set to Secondary RPI IP.

As it stands, I just ran a basic test and with default FLINT 2 setup, both servers are being queried, which is not the desired process outlined above. How to force strict sequential DNS Server use?

4

Do you use one phone book at the time to look for an address or multiple at the same time?

usually the router only uses one, and if that’s not available the backup. And I’m not aware of you programming the order other then enter 1 (first used), 2 (second used) etc and if your smart you do two ipv4 and two ipv6 so your router is always able to connect

5

Hi

Please also refer to the dnsmasq documentation:

image690x51
image690x511901×142 23.2 KB

By default, when multiple upstream DNS servers are configured, dnsmasq continuously evaluates the availability of all of them and preferentially uses the server that responds the fastest for subsequent queries.

image690x54
image690x542283×181 27.3 KB

You can change this behavior using one of the following options:

  1. -o, --strict-order (this matches the behavior you are looking for)
uci set dhcp.@dnsmasq[0].strictorder='1'
uci commit dhcp
/etc/init.d/dnsmasq restart

image690x52
image690x522225×170 22.7 KB

  1. --all-servers
uci set dhcp.@dnsmasq[0].allservers='1'
uci commit dhcp
/etc/init.d/dnsmasq restart

image690x152
image690x1522273×503 70.7 KB

1 Like
7

I did have the strict-order option enabled but the 2nd server still getting queried frquently every minute, similar to the 1st server. Not every few minutes which might be expected for a health check. Does the allservers option need to be set to “0” as well?

root@GL-MT6000:~# uci set dhcp.@dnsmasq[0].strictorder='1'
root@GL-MT6000:~# uci commit dhcp
root@GL-MT6000:~# /etc/init.d/dnsmasq restart

config dnsmasq
option domainneeded '1'
option localise_queries '1'
option local '/lan/'
option expandhosts '1'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option localservice '1'
option ednspacket_max '1232'
option filter_aaaa '1'
option cachesize '1'
option domain 'lan'
option confdir '/tmp/dnsmasq.d'
option rebind_protection '0'
option noresolv '1'
option strictorder '1'
list server '192.168.x.xxx'
list server '192.168.x.xxx

config dhcp 'lan'

8

Sorry should have include that /etc/resolv.conf only has the servers from from the Internet>Ethernet DNS Servers (ie, the ISP DNS Servers), which I think is as it should be. Not sure if this impacts what happens with dnsmasq settings.

Also, using VPN client on router and have
”Override DNS Settings of all clients” enabled
”Allow Custom DNS to Override VPN DNS” enabled
”DNS Rebinding….” Disabled
Network>DNS is Manual
DNS Server 1 - IP of Primary RPI/AGH
DNS Server 2 - IP of Secondary/backup RPi/AGH

Secondary RPi/AGH is still receiving multiple queries per minute as is the Primary RPi/AGH

So having “strict-order’ option set to 1 has had no impact

9

In my local testing, after enabling strictorder=1, dnsmasq sent queries strictly to the first upstream DNS server in the list and continued using it until it became unavailable.

So you may want to check whether your primary RPi/AdGuard Home instance is actually always available and responding as expected.

If the issue still persists, it may be worth seeking further assistance from the active Linux/OpenWrt community regarding dnsmasq configuration and behavior.

10

Thank you for doing the testing and the confirmation that strictrder does work. After reading your reply, I was a bit more thorough on my end and did a bit more investigation.

So even with strictorder enabled, there are defintely a few queries being sent to the 2nd server, no doubt. So I disabled the 2nd server, cleared the logs & statistics, restarted it but only left it running for 2 minutes. Then shut it down again.

Now with a more defined timeframe, I compared the query logs of the 2 servers for the defined timeframe. What I finally saw was that the only time that queries were “leaking” to the 2nd server was when there was a “burst” of queries being generated by poorly behaved apps that ignored the DNS Response (whether it be dafaulet with 0.0.0.0, NXDOMAIN, REFUSED) when being blocked by AGH; e.g., api.segment.io, or applytics.napps-1.com). It is during this storm of query retrys that the 2nd server would receive queries, but it was limited in number. It wasn’t anything like a 50/50 split between the 2 servers: in a 2 minute window, ~15 on 2nd server, compared to a lot (I didn’t count, but eyeball look said it was a bunch more, went past what fit on screen and had to scroll to see them all, so a couple pages, not like 2nd server).

So removed strictorder and tried this basic test again. The # queries on 1st server was still a little more than the # on the 2nd server, but the margin was much smaller.

Sooooo, the strictorder is working, just my understanding of strict and how the router handles strict is slightly different (I am a vey literal person at times), and I now have a better understanding of why that is.

And if the understanding is correct; if only 1 server is configured, these “ghost” queries just get ignored if there is no 2nd server to send them to, but with 2nd server the ghost queries have a place to go.

Once again, thank you for your testing and leading me to me taking a little more controlled approach to my own testing, leading to a better understanding (I hope anyway :slight_smile: )

And also the link to the dnsmasq documentation, also very helpful. Thank you.

I have asked of few questions of the GL-iNet staff and always very helpful, appreciated!!!

1 Like