Help with errors: ERR_NAME_RESOLUTION_FAILED, DNS_PROBE_FINISHED_NXDOMAIN

[sn4k3]

Hello,

Router: RT-AC88u
Firmware Version:384.13 (Merlin)
IPv6 Disabled

Recently i start get this errors at chrome:

ERR_NAME_RESOLUTION_FAILED
DNS_PROBE_FINISHED_NXDOMAIN


While that are Chrome code errors, same also happens at all others apps: edge, whatsapps, general apps, every software is affected.
While on chrome it's random but very often, like when i click a link this can happen and the only way to proceed is refresh page tons of times until the page shows, some times more than 20xF5, frequency time is about 70% every new url.


To test I send a “ping google.com -t”, if error happen ping fails in unreachable message, otherwise it will start ping, and after starts it will never drop, it can stay hours without any timeout, this also valid for MP games, once it enter and on the match it will never drop you, so the problem seems at first host resolution, once connection been made it stays communicating.

This start to happen some days ago without any modification that I can remember, no router changes. I have amtm installed with some scripts.


The main PC I use is cable connected but also wifi capable, and using wifi perform the same.
The router is with empty dns to use the default gateway, don't renember why i get rid of google dns but i guess because amtm scripts? StubbyDNS?
What I have tried without success/fix:


- Disable Kaspersky
- Disable additional ethernet interfaces that are not required
- Try different PC, my laptop under cable and wifi (Way less frequent but still happens)
- Mi8 Android chrome (Way less frequent but still happens)
- Disable Diversion and Skynet
- Reboot router
- Flush DNSs on PC


So that being said, if I use laptop under other network ie: school, I get clean browsing without this problem. So, I guess the problem must reside on router or connection?

This is very annoying because i surf a lot of pages and have to refresh page about 20 times to enter in one is a pain. Also ajax requests can fail if url is different from the one I have entered, so main page show but dynamic content don’t, so I have to refresh until both content shows. Same is valid for form submits :|

My contract are fiber IPTV+NET+IPPhone
TV always work without interruption

Anyone have a tip about that?

 

[dave14305]

What are your WAN DNS settings? Please post a screenshot from the router GUI.

 

[sn4k3]

What are your WAN DNS settings? Please post a screenshot from the router GUI.

Please see attachment.
PS: After the main post i change router LAN dns to google DNS 8.8.8.8 / 8.8.4.4 and it seens ok so far, i will keep testing to see if it really fix the problem. Using that way will affect any of amtm scripts?

Have those installed:

1 open Diversion v4.1.6
2 open Skynet v6.9.1
j5 open uiDivStats v1.2.2
sd open Stubby DNS v1.1.1
ep manage Entware packages

EDIT: Upload to forum have a bad compression? Image is blur so i upload to:

 

[dave14305]

If DNSFilter is enabled, please post screenshots of that page plus LAN DHCP Server dns settings.

Are you still using the old Stubby script? That would be contrary to having LAN DNS configured. More info needed. If using stubby, what are the upstream servers?

 

[sn4k3]

If DNSFilter is enabled, please post screenshots of that page plus LAN DHCP Server dns settings.

Are you still using the old Stubby script? That would be contrary to having LAN DNS configured. More info needed. If using stubby, what are the upstream servers?

StubbyDNS using v1.1.1, Configured as:

So far problem gone with google DNS

 

[dave14305]

StubbyDNS using v1.1.1, Configured as:

So far problem gone with google DNS

Ok, 3 issues I see:

1. Stubby isn’t being used because LAN DHCP DNS 1 entry is forcing every client to Google DNS. Perhaps this was just because of your workaround. Remove it after fixing item #2.
2. /opt/etc/stubby/stubby.yml contains the entry:

   tls_min_version: GETDNS_TLS1_3

   Delete it and restart stubby.
3. (Late add) Use DNS Privacy in Merlin natively instead of the deprecated stubby installer as Adamm mentions below.

Cloudflare is having issues lately as discussed in this thread
[Fork] Asuswrt-Merlin 374.43 LTS releases (V39E3)

Perhaps @Xentrk or @Adamm can update github as well.

 

[Adamm]

Ok, 2 issues I see:

1. Stubby isn’t being used because LAN DHCP DNS 1 entry is forcing every client to Google DNS. Perhaps this was just because of your workaround. Remove it after fixing item #2.
2. /opt/etc/stubby/stubby.yml contains the entry:

   tls_min_version: GETDNS_TLS1_3

   Delete it and restart stubby.

Cloudflare is having issues lately as discussed in this thread
[Fork] Asuswrt-Merlin 374.43 LTS releases (V39E3)

Perhaps @Xentrk or @Adamm can update github as well.

Not sure why anyone would choose to still use this script which is no longer maintained and deprecated.

Instead use the updated built-in functionality in either Merlin or John’s forks.

 

[dave14305]

Not sure why anyone would choose to still use this script which is no longer maintained and deprecated.

Instead use the updated built-in functionality in either Merlin or John’s forks.

Yes, I forgot that was going to be my point #3.

 

[sn4k3]

Didn't know that was outdated.
So can i simple remove it? It will not affect Diversion or skynet?
How do i use and enable native Merlin solution? Only need to choose one of Global Filter Mode?

 

[dave14305]

Didn't know that was outdated.
So can i simple remove it? It will not affect Diversion or skynet?
How do i use and enable native Merlin solution? Only need to choose one of Global Filter Mode?

Yes, uninstall stubby via the script. It will reboot your router. Then configure the WAN DNS page like this using the Preset menu to choose Cloudflare.

 

[sn4k3]

Yes, uninstall stubby via the script. It will reboot your router. Then configure the WAN DNS page like this using the Preset menu to choose Cloudflare.
View attachment 20005

Thank you, will try once no one using the TV.

Can explain the difference between using the DNS-over-TLS on WAN against LAN DNSFilter?

 

[dave14305]

Thank you, will try once no one using the TV.

Can explain the difference between using the DNS-over-TLS on WAN against LAN DNSFilter?

There is no encryption of DNS using only DNSFilter.

 

[sn4k3]

Thank you, will reply once test, but i guess it will work.
Also i guess it don't worth choose a dns with filtering like cleanbrowsing (security) diversion and skynet already does that and will be kind of duplication checks right?

 

[dave14305]

Thank you, will reply once test, but i guess it will work.
Also i guess it don't worth choose a dns with filtering like cleanbrowsing (security) diversion and skynet already does that and will be kind of duplication checks right?

I didn’t like Cleanbrowsing performance over DoT when I once tested it. You can try many different ones, but overall Diversion and SkyNet will protect you from most of the bad stuff. If you had kids in the house, I might consider Cleanbrowsing again.

 

[sn4k3]

I didn’t like Cleanbrowsing performance over DoT when I once tested it. You can try many different ones, but overall Diversion and SkyNet will protect you from most of the bad stuff. If you had kids in the house, I might consider Cleanbrowsing again.

Good to know, maybe their heavy rules or filtering is slowing down stuff?
I once saw a script to test multiple dns based on our connection and determin the best, can't find it anymore, do you know about it? Right now i don't know which best, if opendns or google, both seen have same features. But opendns have 7ms to me VS 16ms at google
I only need basic stuff, malware off is ok plus i have kaspersky and Unified hosts + fakenews on my pcs. The extra protection is just for other connected devices and guesses. The ads and extra trash should go away.

 

[dave14305]

Good to know, maybe their heavy rules or filtering is slowing down stuff?
I once saw a script to test multiple dns based on our connection and determin the best, can't find it anymore, do you know about it? Right now i don't know which best, if opendns or google, both seen have same features. But opendns have 7ms to me VS 16ms at google
I only need basic stuff, malware off is ok plus i have kaspersky and Unified hosts + fakenews on my pcs. The extra protection is just for other connected devices and guesses. The ads and extra trash should go away.

https://www.grc.com/dns/benchmark.htm

Edit: if you use this utility, be sure to turn off DNSFilter otherwise it will override the test queries.

 

[sn4k3]

https://www.grc.com/dns/benchmark.htm

Edit: if you use this utility, be sure to turn off DNSFilter otherwise it will override the test queries.

1.1.1.1 wins, everything done and problem is now gone. I even feel requests are faster compared when was using StubbyDNS.
Thank you, you saved my day and some headaches