Potential DoS: DNS load makes router unresponsive with a large VPN policy-routing domain list

Router Cellular, USB modems
4

Hi,

Thank you for the detailed feedback. We’ve noted both of your reports about large VPN domain policy lists:

  1. Increased DNS response times with policy routing.

  2. Missing DNS replies and router unresponsiveness under DNS load.

We reproduced increased DNS latency and CPU usage internally. With 29,220 domain entries at 500 queries per second, network processing saturated one CPU core. However, all DNS queries received replies, and the router remained accessible.

Other CPU-intensive applications running at the same time could worsen the impact. This is a possible contributing factor, but we haven’t confirmed the cause of the missing replies and unresponsiveness in your setup.

We’ll review both reports with our product and engineering teams to evaluate performance improvements for large policy lists.