Diversion Odd DNS issues

ColinTaylor · Dec 6, 2023

Can you SSH into the router and post the output of cat /tmp/resolv.dnsmasq

colourofsound · Dec 6, 2023

Code:

admin@DSL-AX82U-4B38:/tmp/home/root# cat /tmp/resolv.dnsmasq
server=127.0.1.1
admin@DSL-AX82U-4B38:/tmp/home/root#

ColinTaylor · Dec 6, 2023

colourofsound said:

It looks like DoT is still enabled. For all testing DoT and DNS Director must be disabled.

colourofsound · Dec 6, 2023

Okay, so DNS Director is disabled, and DoT is also disabled.

Code:

admin@DSL-AX82U-4B38:/tmp/home/root# cat /tmp/resolv.dnsmasq
server=1.1.1.1
server=1.0.0.1
admin@DSL-AX82U-4B38:/tmp/home/root#
admin@DSL-AX82U-4B38:/tmp/home/root# nslookup assets.penny-arcade.com
Server:    127.0.0.1
Address 1: 127.0.0.1 localhost.localdomain

Name:      assets.penny-arcade.com
Address 1: 0.0.0.0
Address 2: ::

colourofsound · Dec 6, 2023

Forcing nslookup on the router to use google or cloudflare works:

Code:

admin@DSL-AX82U-4B38:/tmp/home/root# nslookup assets.penny-arcade.com 8.8.8.8
Server:    8.8.8.8
Address 1: 8.8.8.8 dns.google

Name:      assets.penny-arcade.com
Address 1: 104.21.64.223
Address 2: 172.67.156.39
Address 3: 2606:4700:3036::ac43:9c27
Address 4: 2606:4700:3030::6815:40df

admin@DSL-AX82U-4B38:/tmp/home/root# nslookup assets.penny-arcade.com 1.1.1.1
Server:    1.1.1.1
Address 1: 1.1.1.1 one.one.one.one

Name:      assets.penny-arcade.com
Address 1: 104.21.64.223
Address 2: 172.67.156.39
Address 3: 2606:4700:3036::ac43:9c27
Address 4: 2606:4700:3030::6815:40df

admin@DSL-AX82U-4B38:/tmp/home/root# nslookup assets.penny-arcade.com
Server:    127.0.0.1
Address 1: 127.0.0.1 localhost.localdomain

Name:      assets.penny-arcade.com
Address 1: 0.0.0.0
Address 2: ::

ColinTaylor · Dec 6, 2023

Thanks. So can we look at this output:

Code:

cat /etc/resolv.conf

Code:

netstat -nlp | grep :53

Code:

cat /etc/dnsmasq.conf

colourofsound · Dec 6, 2023

ColinTaylor said:
Code:

cat /etc/resolv.conf

Code:

nameserver 127.0.0.1

ColinTaylor said:
Code:

netstat -nlp | grep :53

Code:

netstat -nlp | grep :53
tcp        0      0 192.168.0.1:53          0.0.0.0:*               LISTEN      1826/ctrld
tcp        0      0 127.0.0.1:53            0.0.0.0:*               LISTEN      1826/ctrld
udp        0      0 192.168.0.1:53          0.0.0.0:*                           1826/ctrld
udp        0      0 127.0.0.1:53            0.0.0.0:*                           1826/ctrld
udp        0      0 192.168.0.1:5351        0.0.0.0:*                           16462/miniupnpd
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           1826/ctrld
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           1826/ctrld
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           1826/ctrld
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           1826/ctrld
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           1826/ctrld
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           1826/ctrld
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           1826/ctrld
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           1826/ctrld
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           1826/ctrld
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           1826/ctrld
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           1826/ctrld
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           1826/ctrld
udp        0   2496 0.0.0.0:5353            0.0.0.0:*                           1826/ctrld
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           2189/avahi-daemon:

ColinTaylor said:
Code:

cat /etc/dnsmasq.conf

Code:

admin@DSL-AX82U-4B38:/tmp/home/root# cat /etc/dnsmasq.conf
pid-file=/var/run/dnsmasq.pid
user=nobody
bind-dynamic
interface=br0
interface=pptp*
no-dhcp-interface=pptp*
no-resolv
no-poll
no-negcache
cache-size=1500
min-port=4096
bogus-priv
domain-needed
dhcp-range=lan,192.168.0.25,192.168.0.254,255.255.255.0,86400s
dhcp-option=lan,3,192.168.0.1
dhcp-option=lan,252,"\n"
dhcp-option-force=cpewan-id,vi-encap:3561,4,"FC3497"
dhcp-option-force=cpewan-id,vi-encap:3561,5,"FC3497584B38"
dhcp-option-force=cpewan-id,vi-encap:3561,6,"DSL-AX82U"
dhcp-authoritative
interface=br1
dhcp-range=br1,192.168.101.2,192.168.101.254,255.255.255.0,86400s
dhcp-option=br1,3,192.168.101.1
interface=br2
dhcp-range=br2,192.168.102.2,192.168.102.254,255.255.255.0,86400s
dhcp-option=br2,3,192.168.102.1
dhcp-name-match=set:wpad-ignore,wpad
dhcp-ignore-names=tag:wpad-ignore
dhcp-script=/sbin/dhcpc_lease
script-arp
edns-packet-max=1232
no-resolv
server=127.0.0.1#53
add-mac
add-subnet=32,128

ColinTaylor · Dec 6, 2023

Ah. It looks like you've installed a ctrld addon that's replaced the built-in DNS server.

colourofsound · Dec 6, 2023

Have I. Odd. I do recall considering Unbound as I had it as part of my Pihole setup; but I don't remember anything else. Let me get rid of it...

colourofsound · Dec 6, 2023

Where are you seeing that; which line is indicating a ctrld addon?

ColinTaylor · Dec 6, 2023

The output of netstat -nlp | grep :53 shows that a process called ctrld is listening on the DNS service port (53). It should be dnsmasq.

colourofsound · Dec 6, 2023

I've already uninstalled it; I remember now that I considered going down the DoT route only and came across ctrld as an option. However, I uninstalled it; but it still seems to be taking over DNS requests. I think I need to look at the dnsmasq config; ctrld's manual says it interfaces with dnsmasq. I did install it after installed Diversion.

dave14305 · Dec 6, 2023

Do clean out any crud in /jffs/scripts/dnsmasq.postconf. They dump a lot in there.

ctrld/internal/router/dnsmasq/dnsmasq.go at f1b8d1c4add2e5ba739f3adc0d6208413d3af656 · Control-D-Inc/ctrld

A highly configurable, multi-protocol DNS forwarding proxy - Control-D-Inc/ctrld

github.com

And check the service-event script too. Maybe nuke the router and start fresh if necessary.

colourofsound · Dec 6, 2023

dave14305 said:
Do clean out any crud in /jffs/scripts/dnsmasq.postconf. They dump a lot in there.

ctrld/internal/router/dnsmasq/dnsmasq.go at f1b8d1c4add2e5ba739f3adc0d6208413d3af656 · Control-D-Inc/ctrld

A highly configurable, multi-protocol DNS forwarding proxy - Control-D-Inc/ctrld

github.com

Yeah, lots of references to ctrld in there. Can I just nuke the whole file?

dave14305 · Dec 6, 2023

colourofsound said:
Yeah, lots of references to ctrld in there. Can I just nuke the whole file?

You would have to re-install Diversion afterward. Maybe nuke the router to start fresh.

Feels like they borrowed a lot from NextDNS client.

colourofsound · Dec 6, 2023

dave14305 said:
You would have to re-install Diversion afterward. Maybe nuke the router to start fresh.

Feels like they borrowed a lot from NextDNS client.

You might be right. I've killed the file, re-installed Diversion and the ctrld reference is still there in netstat. What a ballache

dave14305 · Dec 6, 2023

colourofsound said:
You might be right. I've killed the file, re-installed Diversion and the ctrld reference is still there in netstat. What a ballache

They put the “Control” in “Control-D”…

colourofsound · Dec 6, 2023

Right, got it. Using

Code:

ps | grep ctrld

I found the /jffs/controld folder, which I rm'd recursively, and rebooted.

Now, netstat gives me

Code:

admin@DSL-AX82U-4B38:/tmp/home/root# netstat -nlp | grep :53
tcp        0      0 127.0.0.1:53            0.0.0.0:*               LISTEN      5167/dnsmasq
tcp        0      0 192.168.0.1:53          0.0.0.0:*               LISTEN      5167/dnsmasq
udp        0      0 127.0.0.1:53            0.0.0.0:*                           5167/dnsmasq
udp        0      0 192.168.0.1:53          0.0.0.0:*                           5167/dnsmasq
udp        0      0 192.168.0.1:5351        0.0.0.0:*                           3845/miniupnpd
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           2889/avahi-daemon:

So we're on to a winner.

I've re-enabled DoT and DNS Director; and assets.penny-arcade.com is now resolving through the upstream Cloudflare DNS server; and the comic panels are loading on my device.

Nice sleuthing; it's been an absolute pleasure. Thank you very much!

dave14305 · Dec 6, 2023

Colin’s a legend.

colourofsound · Dec 6, 2023

dave14305 said:
Colin’s a legend.

Agreed! But you played your part too, Dave. Thanks again.

Chris

Thread starter	Title	Forum	Replies	Date
U	Odd error installing dnscrypt 2.1.5	Asuswrt-Merlin AddOns	0	Mar 15, 2024
T	DNS switch after reaching 300k requests	Asuswrt-Merlin AddOns	3	Apr 1, 2024
	Loss of Internet connection on TV and Alexa (does not pass the "DNS" step) when SSD connected with addons	Asuswrt-Merlin AddOns	8	Mar 16, 2024
B	YazFi YazFi Guest Network unable to access Pi-Hole DNS server	Asuswrt-Merlin AddOns	22	Feb 1, 2024
	Simple script for DNS fallback	Asuswrt-Merlin AddOns	8	Jan 20, 2024
	Diversion Diversion 5.0 No DNS With Certain Lists	Asuswrt-Merlin AddOns	5	Jan 19, 2024
L	Solved 2 routers with Merlin + OpenVPN + AdGuard Home: DNS does not work from OVPN client side	Asuswrt-Merlin AddOns	2	Jan 16, 2024
S	Unbound Today's DNS Replies Client IP are all 127.0.0.1 - anyway to get the actual lookup host?	Asuswrt-Merlin AddOns	5	Sep 16, 2023
J	AdGuardHome Can you hand out multiple DNS servers while running AdGuardHome on router?	Asuswrt-Merlin AddOns	5	Jul 3, 2023
	AdGuardHome Where is the DNS cache file for AdGuard Home located?	Asuswrt-Merlin AddOns	17	May 29, 2023

Diversion Odd DNS issues

Part of the Furniture

Occasional Visitor

Part of the Furniture

Occasional Visitor

Occasional Visitor

Part of the Furniture

Occasional Visitor

Part of the Furniture

Occasional Visitor

Occasional Visitor

Part of the Furniture

Occasional Visitor

Part of the Furniture

Occasional Visitor

Part of the Furniture

Occasional Visitor

Part of the Furniture

Occasional Visitor

Part of the Furniture

Occasional Visitor

Similar threads

Similar threads

Sign Up For SNBForums Daily Digest