SFT1200 VPN DNS issue on the v4.7.2

truespeed · 2025-01-03T11:52:24.222Z

bruce:

Is the VPN Client connection normal?

The VPN connection is configured in what is normally considered to be a Road Warrior configuration.

All aspects of the configuration looked to be running normally apart from the DNS. But that's not to say I tested the functionality of all aspects of the router. I just focused on the DNS issue.

bruce:

The VPN server is from a VPN service provider or a self-built server?

I don't use any public VPN services. All the Wireguard services are running on OPNsense firewalls that I have full control of. The far-end for this one being in the USA. The VPN servers have been running for about 5 years and there were no DNS issues with 4.3.21 prior to the upgrade or after 4.3.21 had been re-installed.

bruce:

Is the ping <IP> normal, and the ping <domain name> is abnormal?

When running traceroute (mtr) to an <IP> address timings were as expected.

ping <domain name> did not work because DNS would not resolve.

Additionally when watching the far-end firewall logs, DNS requests from the router were not seen.

bruce:

Screenshot the GL GUI > Network > DNS to check.

I'll try and do this when I'm back from Europe, around the end of next week.

bruce · 2025-01-09T04:04:24.353Z

Is this profile of SFT1200 available when imported and used on the WireGuard client on your computer?

This issue has not been reproduced yet. If it does not work, we may ask you provide a remote desktop to check for the issue.

truespeed · 2025-01-09T08:20:16.045Z

I'll try and do a clean install of 4.7.2 and re-test over the weekend.
I might not manage this as I'm currently preparing to be in the US next week.

bruce · 2025-01-09T08:46:44.783Z

bruce:

Is this profile of SFT1200 available when imported and used on the WireGuard client on your computer?

Also please test the profile on the computer WireGuard APP, to see if the VPN tunnel works.

truespeed:

preparing to be in the US next week.

No problem, please contact me at that time when you available to remote check.

truespeed · 2025-01-09T09:47:07.466Z

bruce:

Also please test the profile on the computer WireGuard APP, to see if the VPN tunnel works.

The traceroute showed that the traffic was routed correctly over the VPN.

bruce · 2025-01-13T03:36:45.491Z

If available, please PM to share the VPN profile with me.

If not, please PM to share me the issue syslog.

miniM0bile · 2025-03-04T03:34:12.374Z

Hi,
New member and owner of Opal SFT1200!
Came across this post from another thread discussing the Opal and MSC cruises.

I, as OP, attempted to install 4.7.2 Beta and found myself in the same situation, no DNS when connecting via WireGuard or OpenVPN for the clients connected to the router.

I SSH'd into the router and perform a quick ping/traceroute/nslookup while I was connected to the VPN and it worked great directly from the router. Hosts that are only available via VPN responded to DNS resolution as well as ping, no issues.

When looking at the system log I came across an entry that stated:
daemon.crit dnsmasq[14743]: extraneous parameter at line 6 of /etc/dnsmasq.conf.vpn
this was followed by: dnsmasq failed to start

Reverting back to 4.3.24 and, just like OP, reloading from backup, fixed the situation and the VPN is up and running again.
Is there anything that I can provide while testing this to try and help troubleshoot this issue?

SourMilk · 2025-03-04T15:11:45.762Z

It seems the vpn scripts are also wrong in addition to the tx scripts in the beta firmware. Either that or they got completely overhauled because on the stable version there is no dnsmasq.conf.vpn -- only a dnsmasq.conf.

Line 6 of the .vpn script in the beta firmware:

enable-ubus=dnsmasq.vpn

The man page says the following:

Enable dnsmasq UBus interface. It sends notifications via UBus on DHCPACK and DHCPRELEASE events. Furthermore it offers metrics and allows configuration of Linux connection track mark based filtering. When DNS query filtering based on Linux connection track marks is enabled UBus notifications are generated for each resolved or filtered DNS query. Requires that dnsmasq has been built with UBus support. If the service name is given, dnsmasq provides service at that namespace, rather than the default which is **dnsmasq**

It seems that the option is not recognized in the dnsmasq version the Opal runs.

$ ls stable/etc/dnsmasq.*
stable/etc/dnsmasq.conf

Only 1 config for dnsmasq in the stable.

$ ls beta/etc/dnsmasq.*
beta/etc/dnsmasq.conf  beta/etc/dnsmasq.conf.mptun  beta/etc/dnsmasq.conf.vpn

A bunch more in the beta. Either they have overhauled it or like with the tx power init script used the wronf config files for our little Opal.

SourMilk · 2025-03-04T15:23:04.044Z

We're using dnsmasq version 2.80 from 2018 on the Opal and overriding the default ubus service name wasn't added until 2020.

So unless the Gl-Inet team back ported that option they are trying to use an option that does not exist in the version on the Opal. The joys of severely outdated software.

https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=d162bee356586ccddccb50fd665c4a5556ce1147

Option really does not exist:

root@GL-SFT1200:~# dnsmasq --enable-ubus=hello
dnsmasq: bad command line options: try --help

It accepts the command only without the service name change:

root@GL-SFT1200:~# dnsmasq --enable-ubus
dnsmasq: failed to create listening socket for port 53: Address in use

miniM0bile · 2025-03-09T21:32:16.394Z

Interesting. Out of curiosity I just checked their download site again and the Beta FW has been removed from it.
I'm guessing the GL-Inet team is aware of these issues.

bpwl1 · 2025-03-10T11:53:19.835Z

Beta FW is back. With different make: openwrt-sft1200-4.7.2-0308-1741428334

hecatae · 2025-03-10T13:50:54.327Z

Would you expect it to be called 4.7.2.1 or something similar?

hecatae · 2025-03-11T14:46:29.764Z

Tue Mar 11 14:32:34 2025 kern.err usbmuxd[6320]: [1] Another instance is already running (pid 4769). exiting.
Tue Mar 11 14:32:34 2025 kern.err usbmuxd[6335]: [1] Another instance is already running (pid 4769). exiting.
Tue Mar 11 14:32:36 2025 kern.err usbmuxd[6738]: [1] Another instance is already running (pid 4769). exiting.

hecatae · 2025-03-11T16:06:33.865Z

installed it's called beta2.

checking at present, is the vpn dns issue on OpenVPN or Wireguard?

Yes still broken on OpenVPN on 4.7.2, I downgrade to 4.3.24 and the VPN DNS works correctly.

This is annoying.

bpwl1 · 2025-03-11T19:21:26.111Z

Lets call it 7.4.2.1
Opened the box again, and installed it.
Just that little convenient test stream: https://www.waveform.com/tools/bufferbloat

A very quick test learns ...

TX power is OK now (-30dBm received on short distance). TXPower setting in GUI is responsive.
40MHz bandwidth is correct (but his might come from my earlier LUCI settings)
no scan/connection to DFS channels
AMPDU still breaks. This is not a wifi 802.11 n or ac device. It cannot handle that mode, as those wifi modes have up to 64 MPDU in one A-MPDU transmission.

Log claims MSDU not MPDU (typo ?)

Tue Mar 11 19:57:03 2025 kern.warn kernel: [ 585.975126] lmac[1] Error, msdu index reach maximum limit, 31
Tue Mar 11 19:57:03 2025 kern.warn kernel: [ 585.980967] lmac[1] Error, buffer is not uploaded to host buffer completely

Back in the box, this is not a good travel router for now, with that wifi driver. (only 31 MPDU are accepted, hopefully there is at least retransmit of the rest of the A-MPDU?)

Maybe I'll do some more tests, like with previous versions (eg country code), and see how bad the performance drops while using repeater. It may be sub-optimal but repeating the missed part of an A-MPDU might eventually give enough performance for a travelrouter. Have to find the config file with the "ampdu_max_cnt" configuration in this version. SFT1200 2.4 GHz Repeater Disconnects - #61 by bpwl1

bruce · 2025-03-12T08:19:52.624Z

We are aware of the issue and have updated the VPN DNS codes.

It will be merged and released in the next version.

Affected models: B3000, SFT1200.

hecatae · 2025-03-12T09:23:37.707Z

Thank you, any news on the WiFi driver issues?

bpwl1 · 2025-03-12T17:25:27.013Z

4.7.2.1 beta: Giving up again. 5GHz sometimes good for work (40Mbps), sometimes images do not load. 2.4GHz dramatic again as we have seen so many times before. (probably still needs wifi legacy mode).

hansome · 2025-03-19T06:07:54.123Z

hecatae:

Yes still broken on OpenVPN on 4.7.2, I downgrade to 4.3.24 and the VPN DNS works correctly.

I tested VPN DNS is working for 4.7.2-0308, can you check by command if dnsmasq bootstrap correctly?

root@GL-SFT1200:~# ps w|grep dnsmasq
14990 dnsmasq   2936 S    /usr/sbin/dnsmasq -C /var/etc/dnsmasq.conf.cfg01411c -k -x /var/run/dnsmasq/dnsmasq.cfg01411c.pid
14999 root      2864 S    /usr/sbin/dnsmasq -C /var/etc/dnsmasq.conf.cfg01411c -k -x /var/run/dnsmasq/dnsmasq.cfg01411c.pid
15031 root      2844 S    /usr/sbin/dnsmasq -C /etc/dnsmasq.conf.vpn -x /var/run/dnsmasq/dnsmasq.vpn.pid --server=209.244.0.3 --ser
15032 root      2840 S    /usr/sbin/dnsmasq -C /etc/dnsmasq.conf.vpn -x /var/run/dnsmasq/dnsmasq.vpn.pid --server=209.244.0.3 --ser
20854 root      1352 S    grep dnsmasq
root@GL-SFT1200:~# 
root@GL-SFT1200:~# 
root@GL-SFT1200:~# cat /etc/version.date 
2025-03-08 17:53:01
root@GL-SFT1200:~# 
root@GL-SFT1200:~# cat /etc/glversion 
4.7.2
root@GL-SFT1200:~#

hecatae · 2025-03-19T10:52:32.693Z

4.3.24:

root@GL-SFT1200:~# ps w|grep dnsmasq
 5171 dnsmasq   2936 S    /usr/sbin/dnsmasq -C /var/etc/dnsmasq.conf.cfg01411c -k -x /var/run/dnsmasq/dnsmasq.cfg01411c.pid
 5176 root      2864 S    /usr/sbin/dnsmasq -C /var/etc/dnsmasq.conf.cfg01411c -k -x /var/run/dnsmasq/dnsmasq.cfg01411c.pid
14712 root      1352 S    grep dnsmasq
root@GL-SFT1200:~# cat /etc/version.date
2025-01-15 21:27:24
root@GL-SFT1200:~# cat /etc/glversion
4.3.24

4.7.2 0308

root@GL-SFT1200:~# ps w|grep dnsmasq
 4141 root      2844 S    /usr/sbin/dnsmasq -C /etc/dnsmasq.conf.vpn -x /var/run/dnsmasq/dnsmasq.vpn.pid --server=10.243.153.1 --no
 4143 root      2840 S    /usr/sbin/dnsmasq -C /etc/dnsmasq.conf.vpn -x /var/run/dnsmasq/dnsmasq.vpn.pid --server=10.243.153.1 --no
 5897 dnsmasq   2936 S    /usr/sbin/dnsmasq -C /var/etc/dnsmasq.conf.cfg01411c -k -x /var/run/dnsmasq/dnsmasq.cfg01411c.pid
 5901 root      2864 S    /usr/sbin/dnsmasq -C /var/etc/dnsmasq.conf.cfg01411c -k -x /var/run/dnsmasq/dnsmasq.cfg01411c.pid
 7709 root      1352 S    grep dnsmasq
root@GL-SFT1200:~# cat /etc/version.date
2025-03-08 17:53:01
root@GL-SFT1200:~# cat /etc/glversion
4.7.2

Downgrading back to 4.3.24 as all DNS traffic is not routing over the VPN