SFT1200 VPN DNS issue on the v4.7.2

SourMilk · 2025-03-04T15:11:45.762Z

It seems the vpn scripts are also wrong in addition to the tx scripts in the beta firmware. Either that or they got completely overhauled because on the stable version there is no dnsmasq.conf.vpn -- only a dnsmasq.conf.

Line 6 of the .vpn script in the beta firmware:

enable-ubus=dnsmasq.vpn

The man page says the following:

Enable dnsmasq UBus interface. It sends notifications via UBus on DHCPACK and DHCPRELEASE events. Furthermore it offers metrics and allows configuration of Linux connection track mark based filtering. When DNS query filtering based on Linux connection track marks is enabled UBus notifications are generated for each resolved or filtered DNS query. Requires that dnsmasq has been built with UBus support. If the service name is given, dnsmasq provides service at that namespace, rather than the default which is **dnsmasq**

It seems that the option is not recognized in the dnsmasq version the Opal runs.

$ ls stable/etc/dnsmasq.*
stable/etc/dnsmasq.conf

Only 1 config for dnsmasq in the stable.

$ ls beta/etc/dnsmasq.*
beta/etc/dnsmasq.conf  beta/etc/dnsmasq.conf.mptun  beta/etc/dnsmasq.conf.vpn

A bunch more in the beta. Either they have overhauled it or like with the tx power init script used the wronf config files for our little Opal.

SourMilk · 2025-03-04T15:23:04.044Z

We're using dnsmasq version 2.80 from 2018 on the Opal and overriding the default ubus service name wasn't added until 2020.

So unless the Gl-Inet team back ported that option they are trying to use an option that does not exist in the version on the Opal. The joys of severely outdated software.

https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=d162bee356586ccddccb50fd665c4a5556ce1147

Option really does not exist:

root@GL-SFT1200:~# dnsmasq --enable-ubus=hello
dnsmasq: bad command line options: try --help

It accepts the command only without the service name change:

root@GL-SFT1200:~# dnsmasq --enable-ubus
dnsmasq: failed to create listening socket for port 53: Address in use

miniM0bile · 2025-03-09T21:32:16.394Z

Interesting. Out of curiosity I just checked their download site again and the Beta FW has been removed from it.
I'm guessing the GL-Inet team is aware of these issues.

bpwl1 · 2025-03-10T11:53:19.835Z

Beta FW is back. With different make: openwrt-sft1200-4.7.2-0308-1741428334

hecatae · 2025-03-10T13:50:54.327Z

Would you expect it to be called 4.7.2.1 or something similar?

hecatae · 2025-03-11T14:46:29.764Z

Tue Mar 11 14:32:34 2025 kern.err usbmuxd[6320]: [1] Another instance is already running (pid 4769). exiting.
Tue Mar 11 14:32:34 2025 kern.err usbmuxd[6335]: [1] Another instance is already running (pid 4769). exiting.
Tue Mar 11 14:32:36 2025 kern.err usbmuxd[6738]: [1] Another instance is already running (pid 4769). exiting.

hecatae · 2025-03-11T16:06:33.865Z

installed it's called beta2.

checking at present, is the vpn dns issue on OpenVPN or Wireguard?

Yes still broken on OpenVPN on 4.7.2, I downgrade to 4.3.24 and the VPN DNS works correctly.

This is annoying.

bpwl1 · 2025-03-11T19:21:26.111Z

Lets call it 7.4.2.1
Opened the box again, and installed it.
Just that little convenient test stream: https://www.waveform.com/tools/bufferbloat

A very quick test learns ...

TX power is OK now (-30dBm received on short distance). TXPower setting in GUI is responsive.
40MHz bandwidth is correct (but his might come from my earlier LUCI settings)
no scan/connection to DFS channels
AMPDU still breaks. This is not a wifi 802.11 n or ac device. It cannot handle that mode, as those wifi modes have up to 64 MPDU in one A-MPDU transmission.

Log claims MSDU not MPDU (typo ?)

Tue Mar 11 19:57:03 2025 kern.warn kernel: [ 585.975126] lmac[1] Error, msdu index reach maximum limit, 31
Tue Mar 11 19:57:03 2025 kern.warn kernel: [ 585.980967] lmac[1] Error, buffer is not uploaded to host buffer completely

Back in the box, this is not a good travel router for now, with that wifi driver. (only 31 MPDU are accepted, hopefully there is at least retransmit of the rest of the A-MPDU?)

Maybe I'll do some more tests, like with previous versions (eg country code), and see how bad the performance drops while using repeater. It may be sub-optimal but repeating the missed part of an A-MPDU might eventually give enough performance for a travelrouter. Have to find the config file with the "ampdu_max_cnt" configuration in this version. SFT1200 2.4 GHz Repeater Disconnects - #61 by bpwl1

bruce · 2025-03-12T08:19:52.624Z

We are aware of the issue and have updated the VPN DNS codes.

It will be merged and released in the next version.

Affected models: B3000, SFT1200.

hecatae · 2025-03-12T09:23:37.707Z

Thank you, any news on the WiFi driver issues?

bpwl1 · 2025-03-12T17:25:27.013Z

4.7.2.1 beta: Giving up again. 5GHz sometimes good for work (40Mbps), sometimes images do not load. 2.4GHz dramatic again as we have seen so many times before. (probably still needs wifi legacy mode).

hansome · 2025-03-19T06:07:54.123Z

hecatae:

Yes still broken on OpenVPN on 4.7.2, I downgrade to 4.3.24 and the VPN DNS works correctly.

I tested VPN DNS is working for 4.7.2-0308, can you check by command if dnsmasq bootstrap correctly?

root@GL-SFT1200:~# ps w|grep dnsmasq
14990 dnsmasq   2936 S    /usr/sbin/dnsmasq -C /var/etc/dnsmasq.conf.cfg01411c -k -x /var/run/dnsmasq/dnsmasq.cfg01411c.pid
14999 root      2864 S    /usr/sbin/dnsmasq -C /var/etc/dnsmasq.conf.cfg01411c -k -x /var/run/dnsmasq/dnsmasq.cfg01411c.pid
15031 root      2844 S    /usr/sbin/dnsmasq -C /etc/dnsmasq.conf.vpn -x /var/run/dnsmasq/dnsmasq.vpn.pid --server=209.244.0.3 --ser
15032 root      2840 S    /usr/sbin/dnsmasq -C /etc/dnsmasq.conf.vpn -x /var/run/dnsmasq/dnsmasq.vpn.pid --server=209.244.0.3 --ser
20854 root      1352 S    grep dnsmasq
root@GL-SFT1200:~# 
root@GL-SFT1200:~# 
root@GL-SFT1200:~# cat /etc/version.date 
2025-03-08 17:53:01
root@GL-SFT1200:~# 
root@GL-SFT1200:~# cat /etc/glversion 
4.7.2
root@GL-SFT1200:~#

hecatae · 2025-03-19T10:52:32.693Z

4.3.24:

root@GL-SFT1200:~# ps w|grep dnsmasq
 5171 dnsmasq   2936 S    /usr/sbin/dnsmasq -C /var/etc/dnsmasq.conf.cfg01411c -k -x /var/run/dnsmasq/dnsmasq.cfg01411c.pid
 5176 root      2864 S    /usr/sbin/dnsmasq -C /var/etc/dnsmasq.conf.cfg01411c -k -x /var/run/dnsmasq/dnsmasq.cfg01411c.pid
14712 root      1352 S    grep dnsmasq
root@GL-SFT1200:~# cat /etc/version.date
2025-01-15 21:27:24
root@GL-SFT1200:~# cat /etc/glversion
4.3.24

4.7.2 0308

root@GL-SFT1200:~# ps w|grep dnsmasq
 4141 root      2844 S    /usr/sbin/dnsmasq -C /etc/dnsmasq.conf.vpn -x /var/run/dnsmasq/dnsmasq.vpn.pid --server=10.243.153.1 --no
 4143 root      2840 S    /usr/sbin/dnsmasq -C /etc/dnsmasq.conf.vpn -x /var/run/dnsmasq/dnsmasq.vpn.pid --server=10.243.153.1 --no
 5897 dnsmasq   2936 S    /usr/sbin/dnsmasq -C /var/etc/dnsmasq.conf.cfg01411c -k -x /var/run/dnsmasq/dnsmasq.cfg01411c.pid
 5901 root      2864 S    /usr/sbin/dnsmasq -C /var/etc/dnsmasq.conf.cfg01411c -k -x /var/run/dnsmasq/dnsmasq.cfg01411c.pid
 7709 root      1352 S    grep dnsmasq
root@GL-SFT1200:~# cat /etc/version.date
2025-03-08 17:53:01
root@GL-SFT1200:~# cat /etc/glversion
4.7.2

Downgrading back to 4.3.24 as all DNS traffic is not routing over the VPN

hecatae · 2025-03-19T11:02:45.358Z

@hansome I run a pivpn pihole over on a racknerd server, so I have full query logs from the dns server end.
When the sft1200 is running 4.7.2 I never see a single dns entry.
When the sft1200 is running 4.3.24, I see every dns entry.
Same OpenVPN configuration on both firmwares.

dugliano · 2025-03-19T16:17:15.928Z

you must cancel 6th line and it works
i've the same problem on marble

hecatae · 2025-03-19T16:21:42.245Z

but is that not crackers, to have to remove something from stock firmware that GL have tested before release?

hansome · 2025-03-20T13:26:22.222Z

The log looks okay. I don't know what caused the issue. Do you use adguardhome or encrypt DNS?
I confirmed again the vpn dns is working.

image1161×136 8.83 KB

hecatae · 2025-03-20T14:06:07.498Z

@hansome AGH does not work on the Opal, I do not use encrypt DNS.
This is not a wireguard vpn, this is an OpenVPN connection.
let me know if you want a client configuration to test with

hecatae · 2025-03-21T21:04:43.387Z

@hansome do you want me to send if to the support email address or over the discord?

hansome · 2025-03-24T04:33:48.636Z

Thanks, I'll pm you