DNS Privacy appears to have stopped working for me

[Goobi]

Hi Community,

Running Merlin 384.13 on a AC86U. I had DNS privacy set for a couple of month now no problem. However, I noticed in the last couple of days that all the traffic is flowing through port 53 instead of port 853.

Here are my settings:
WAN:

LAN

Tools>Other Settings:

stubby log:

 stubby -l
[14:36:18.263784] STUBBY: Read config from file /etc/stubby/stubby.yml
[14:36:18.264700] STUBBY: DNSSEC Validation is OFF
[14:36:18.265040] STUBBY: Transport list is:
[14:36:18.265344] STUBBY:   - UDP
[14:36:18.265679] STUBBY:   - TCP
[14:36:18.265960] STUBBY: Privacy Usage Profile is Opportunistic
[14:36:18.266240] STUBBY: (NOTE a Strict Profile only applies when TLS is the ONLY transport!!)
[14:36:18.266501] STUBBY: Starting DAEMON....
[14:36:20.530588] STUBBY: 1.1.1.1                                  : Upstream   : UDP - Resps=     1, Timeouts  =     0 (logged every 100 responses)
[14:36:21.340955] STUBBY: 1.0.0.1                                  : Upstream   : UDP - Resps=     1, Timeouts  =     0 (logged every 100 responses)
[14:36:21.556817] STUBBY: 9.9.9.9                                  : Upstream   : UDP - Resps=     1, Timeouts  =     0 (logged every 100 responses)
[14:36:22.248912] STUBBY: 149.112.112.112                          : Upstream   : UDP - Resps=     1, Timeouts  =     0 (logged every 100 responses)

I have tried stopping and restarting DNS privacy and rebooting but the issue persists. Any ideas what could be causing this or what else I can look at?

Thanks!

 

[QuikSilver]

Hi Community,

Running Merlin 384.13 on a AC86U. I had DNS privacy set for a couple of month now no problem. However, I noticed in the last couple of days that all the traffic is flowing through port 53 instead of port 853.

Here are my settings:
WAN:
View attachment 19858

LAN
View attachment 19859

Tools>Other Settings:
View attachment 19861

stubby log:

 stubby -l
[14:36:18.263784] STUBBY: Read config from file /etc/stubby/stubby.yml
[14:36:18.264700] STUBBY: DNSSEC Validation is OFF
[14:36:18.265040] STUBBY: Transport list is:
[14:36:18.265344] STUBBY:   - UDP
[14:36:18.265679] STUBBY:   - TCP
[14:36:18.265960] STUBBY: Privacy Usage Profile is Opportunistic
[14:36:18.266240] STUBBY: (NOTE a Strict Profile only applies when TLS is the ONLY transport!!)
[14:36:18.266501] STUBBY: Starting DAEMON....
[14:36:20.530588] STUBBY: 1.1.1.1                                  : Upstream   : UDP - Resps=     1, Timeouts  =     0 (logged every 100 responses)
[14:36:21.340955] STUBBY: 1.0.0.1                                  : Upstream   : UDP - Resps=     1, Timeouts  =     0 (logged every 100 responses)
[14:36:21.556817] STUBBY: 9.9.9.9                                  : Upstream   : UDP - Resps=     1, Timeouts  =     0 (logged every 100 responses)
[14:36:22.248912] STUBBY: 149.112.112.112                          : Upstream   : UDP - Resps=     1, Timeouts  =     0 (logged every 100 responses)

I have tried stopping and restarting DNS privacy and rebooting but the issue persists. Any ideas what could be causing this or what else I can look at?

Thanks!

Take out the DNS and WINS Server Setting (DNS Server 1) Mine is blank FYI....also do you have anything under DNS filter?

 

[Goobi]

Thanks, I removed the DNS Server 1 setting. I am still getting traffic only on port 53. I am using DNS filtering but as you can see, it is in router mode and I don't have any IPs routed to any other DNS:

 

[dave14305]

Is the time set properly?

 

[Goobi]

It does appear that the issue could be time related. I see this

I originally had 0.north-america.pool.ntp.org and tried time.nist.gov but I can't ping them, so I tested with the above which I can ping, but still time does not sync.

# date
Tue Nov 12 14:35:47 CST 2019

Could there be some kind of firewall rule that is blocking ntp traffic? Is there some way I can force a sync? I do use Skynet and Diversion if it makes a difference. Thanks!

 

[SuperDuke]

It does appear that the issue could be time related. I see this

View attachment 19864

I originally had 0.north-america.pool.ntp.org and tried time.nist.gov but I can't ping them, so I tested with the above which I can ping, but still time does not sync.

# date
Tue Nov 12 14:35:47 CST 2019

Could there be some kind of firewall rule that is blocking ntp traffic? Is there some way I can force a sync? I do use Skynet and Diversion if it makes a difference. Thanks!

Try using a different NTP server selection and see if it clears it up.....

 

[RMerlin]

Also, please read the warning about DNSFilter in your first screenshot:

What do you have configured under DNSFilter?

 

[dave14305]

It does appear that the issue could be time related. I see this

View attachment 19864

I originally had 0.north-america.pool.ntp.org and tried time.nist.gov but I can't ping them, so I tested with the above which I can ping, but still time does not sync.

# date
Tue Nov 12 14:35:47 CST 2019

Could there be some kind of firewall rule that is blocking ntp traffic? Is there some way I can force a sync? I do use Skynet and Diversion if it makes a difference. Thanks!

That time looks like it's set, but most likely the ntp client on the router can't resolve the hostname of the ntp server. Change this second setting below back to the default No and try again.

Plus what RMerlin said.

 

[CriticJay]

Also, why do you (OP) have "Disable Asusnat tunnel" enabled?

Next, to follow up on Dave's post above - NTP.ORG should work fine if you just use "pool.ntp.org".

You do not usually need to determine your own geographic site!

 

[Goobi]

That’s for the replies everyone. A few posts up I show my DNS filter settings (mode set to router and nothing else). I also did the following based on the collective feedback:

1) Disabled DNS filter just to rule it out
2) Set the NTP Server to pool.ntp.org (I can ping this hostname)
3) Set disable Asus tunnel to no
4) set WAN local caching to no

Still get the same message about not being able to sync.

Some additional commands I ran:

nvram show|grep ntp
ntp_ready=0 —-> should this not be 1?
ntp_server0=pool.ntp.org
ntp_server1=
ntp_server_tried=pool.ntp.org
ntpd_enable=0

 ntpq -p
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
+helium.constant 128.59.0.245     2 u  752 1024  377   49.443    5.925   1.905
 1.time.dbsinet. .XFAC.          16 u    - 1024    0    0.000    0.000   0.000
*159.203.158.197 128.59.0.245     2 u  680 1024  377   53.799    1.366   2.634
+t1.time.gq1.yah 208.71.46.33     2 u  767 1024  377   94.230   -1.470  12.734

Any additional suggestions on what I can check or try? Thanks !

Edit:
It now looks like the dns traffic is going through port 853. However, still getting the “Reminder: The system time has not been synchronized with an NTP server. ” message.

 

[netmik3]

Try

time.cloudflare.com

 

[Treadler]

That’s for the replies everyone. A few posts up I show my DNS filter settings (mode set to router and nothing else). I also did the following based on the collective feedback:

1) Disabled DNS filter just to rule it out
2) Set the NTP Server to pool.ntp.org (I can ping this hostname)
3) Set disable Asus tunnel to no
4) set WAN local caching to no

Still get the same message about not being able to sync.

Some additional commands I ran:

nvram show|grep ntp
ntp_ready=0 —-> should this not be 1?
ntp_server0=pool.ntp.org
ntp_server1=
ntp_server_tried=pool.ntp.org
ntpd_enable=0

 ntpq -p
     remote           refid      st t when poll reach   delay   offset  jitter
==============================================================================
+helium.constant 128.59.0.245     2 u  752 1024  377   49.443    5.925   1.905
 1.time.dbsinet. .XFAC.          16 u    - 1024    0    0.000    0.000   0.000
*159.203.158.197 128.59.0.245     2 u  680 1024  377   53.799    1.366   2.634
+t1.time.gq1.yah 208.71.46.33     2 u  767 1024  377   94.230   -1.470  12.734

Any additional suggestions on what I can check or try? Thanks !

Edit:
It now looks like the dns traffic is going through port 853. However, still getting the “Reminder: The system time has not been synchronized with an NTP server. ” message.

For what it’s worth, I’ve had zero time set hassles by just using the Cloudflare time server IP.

162.159.200.1

YMMV. ;-)