Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

https-dns-proxy is blocking DS-Lite reconnections #26052

Open
Nmrawe opened this issue Feb 25, 2025 · 7 comments
Open

https-dns-proxy is blocking DS-Lite reconnections #26052

Nmrawe opened this issue Feb 25, 2025 · 7 comments

Comments

@Nmrawe
Copy link

Nmrawe commented Feb 25, 2025

I have a problem with the DS-Lite connections being blocked when reconnecting: openwrt/openwrt#18092.

This issue doesn't happen when https-dns-proxy is not running. But If it is, https-dns-proxy needs to be stopped and started again (reloading or restaring won't help).

Probably https-dns-proxy is blocking DNS connections to AFTR domains used by DS-Lite.

https-dns-proxy 2023.12.26-r4

@Nmrawe
Copy link
Author

Nmrawe commented Feb 25, 2025

As a workaround, added

service https-dns-proxy stop
sleep 5
service https-dns-proxy start

to

proto_ipip6_teardown() {
        local cfg="$1"
}

and

proto_dslite_teardown() {
        local cfg="$1"
}

in /lib/netifd/proto/dslite.sh.

It seems to work fine, at least in case of manually restarting the interface as I don't know when my ISP is gonna trigger the prefix change.

@stangri
Copy link
Member

stangri commented Feb 25, 2025

Probably https-dns-proxy is blocking DNS connections to AFTR domains used by DS-Lite.

Configure these domains to be resolved with your ISP's resolver.

@Nmrawe
Copy link
Author

Nmrawe commented Feb 25, 2025

As list server in the dhcp file? It doesn't seem to fix this issue.

@stangri
Copy link
Member

stangri commented Mar 6, 2025

Does the issue persist if you use any non-encrypted DNS resolver other than your ISP's resolver (like Google, Cloudflare) without https-dns-proxy?

@Nmrawe
Copy link
Author

Nmrawe commented Mar 6, 2025

No, I don't use my ISP's resolver at all.

@stangri
Copy link
Member

stangri commented Mar 7, 2025

Adding proper entries to have the domains resolved without https-dns-proxy should help then.

@Nmrawe
Copy link
Author

Nmrawe commented Mar 8, 2025

DS-Lite may not like 127.0.0.1 in list server. Sadly, I am unable to do more testing right now as I'm still waiting (almost 11 days so far) for the prefix change to check my workaround.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants