RT-BE88U DNS-over TLS

[Robert57]

This may well be that this makes no sense. But I don't see how this can have an influence on an input that should therefore not be activatable........

 

[Robert57]

So: Checked everything again, switched off various activities and tested again.
Did not help.
I will probably go back to the factory settings and then try to set up DNS-over-TLS first.
I really don't feel like doing this, but I will try again.

 

[Tech9]

It's allowed, but verifying responses from a DNS provider you trusted already and the channel is encrypted so no MITM is expected. About what is selectable in Asuswrt - it lacks dependencies in many places and it's been like this forever.

 

[Robert57]

I'm concerned with the principle that the product should do what it claims to be able to do.
Of course, I now have the same opinion that it makes no sense to send two controls on their way at the same time.
I have already switched DNSSEC off. Even if this is switched off, DNS-over-TLS cannot be activated.

 

[Ripshod]

I'm concerned with the principle that the product should do what it claims to be able to do.

And it does. It's only in your case that something is stopping it.

 

[Tech9]

DNS-over-TLS cannot be activated.

Reset your router and try again. Who is your ISP? Are they known for blocking ports upstream? DoT needs port 853. Do you have public WAN IP or your router is behind NAT? If you have ISP provided device before the router - what is it?

 

[Robert57]

So I don't know if my provider blocks my upstream IP.
I have unblocked port 853.
The provider modem is switched to bridge. I get the IP address directly on my router

 

[dave14305]

I get the following answers:
dsnpriv_enable=0
dnspriv_profile=1
the dnspriv_rulelist is output with the data from quad9.net.

dnspriv_enable is set to 0, which means it is not active.

Add the Quad9 servers again, and if it resets to 0 again, run these commands:

nvram set dnspriv_enable=1
nvram commit
service restart_dnsmasq

See if it stays active, or if the nvram resets to 0 later.

 

[Treadler]

FWIW, using Cloudflare w/DoT, & their test site shows using DoT.

Test site:

1.1.1.1 — One of the Internet’s Fastest, Privacy-First DNS Resolver

✌️✌️ Browse a faster, more private internet.

one.one.one.one

 

[Makaveli]

So I don't know if my provider blocks my upstream IP.
I have unblocked port 853.
The provider modem is switched to bridge. I get the IP address directly on my router

Who is your ISP?

Bell Canada does block this.

Bell home internet users with Asus routers - does DoT work for you?

My in-laws have Bell FTTH internet with a Gigahub gateway and an Asus AX86U Pro configured in PPPoE passthrough. The Asus is on the latest 3.0.0.4 Merlin FW (not 3.0.0.6). When I was there today and connected to their WiFi with my iPhone that has a DoT config profile installed, I wasn’t able to...

www.snbforums.com

 

[Tech9]

Bell Canada does block this.

Any other workarounds than AGH with DoH?

 

[Makaveli]

Any other workarounds than AGH with DoH?

I think that is the only one as far as i'm aware.

 

[Robert57]

I have found the problem.
AdGuardHome is not compatible with DNS-over-TLS.
AdGuard had also put itself in a continuous loop.
I removed AdGuard and now DNS-over-TLS works.
Thanks again to everyone who helped me

 

[Ripshod]

I never saw that coming!
Glad you're sorted, enjoy!

 

[Tech9]

AdGuardHome

You never mentioned anything about AdGuard Home.

AdGuardHome - AGH not working on new firmware 3006

Everytime I try to install AdGuard Home, it hangs on starting AdGuard Home ...dead. I have tried many things; switched out my USB drive for a 2.5 inch SSD, didn't work, also tried resetting my router settings to factory default and that also didn't work. I would like to get AGH working, any help...

www.snbforums.com

 

[bluzfanmr1]

I have found the problem.
AdGuardHome is not compatible with DNS-over-TLS.
AdGuard had also put itself in a continuous loop.
I removed AdGuard and now DNS-over-TLS works.
Thanks again to everyone who helped me

I was trying to enable this as well but couldn't get it to work. Fortunately after about 5 minutes I remembered I was running AdGuard.

 

[Makaveli]

I have found the problem.
AdGuardHome is not compatible with DNS-over-TLS.
AdGuard had also put itself in a continuous loop.
I removed AdGuard and now DNS-over-TLS works.
Thanks again to everyone who helped me

Hmm I am running AdGuard home so wasn't aware of this. The last time I did have DNS over TLS was when I was running diversion..

You never mentioned anything about AdGuard Home.

AdGuardHome - AGH not working on new firmware 3006

Everytime I try to install AdGuard Home, it hangs on starting AdGuard Home ...dead. I have tried many things; switched out my USB drive for a 2.5 inch SSD, didn't work, also tried resetting my router settings to factory default and that also didn't work. I would like to get AGH working, any help...

www.snbforums.com

i'm still running an old version of AdGuard home and didn't notice any issues. I will need to review this thread thanks for the link.

 

[swejuggalo]

For those on a BE router (possibly others on newer firmware), does changing to Cloudflare actually change the DNS response time?
My ISP use an unknown filtered/secure DNS in the backend. But it's often 200-300 ms.
Cloudflare is usually lower or slightly above 20 ms. (identical or close to normal ping)
However, even though this test lists Cloudflare DNS addresses, it still shows the ISP crappy response time.
However, if using DNS Director for that client, then it shows the proper response times. With the side effect, 1.1.1.1/help does not pass DoT. It does (most of time - most likely the browser causing that randomness - but still worth to mention) pass without using DNS director.

dnscheck.tools - check your dns resolvers

A tool to test for DNS leaks, DNSSEC validation, and more

www.dnscheck.tools

 

[bbunge]

I have found the problem.
AdGuardHome is not compatible with DNS-over-TLS.
AdGuard had also put itself in a continuous loop.
I removed AdGuard and now DNS-over-TLS works.
Thanks again to everyone who helped me

Maybe it is a good thing to dump AdGuard, a Russian company which moved its offices to Cyprus to make users think their product was safe.

If you want a content blocker use Diversion, on Merlin firmware, or Pi-Hole. Control D, a Canadian company, would be a better option than AdGuard...

 

[Tech9]

Russian company

Let’s not go into politics. All the alternatives you suggest have Russian involvement as well. And this is unrelated to safety and security levels of the products.