From 606b1e5b6b8cace2bd91f76cd128297f45e40054 Mon Sep 17 00:00:00 2001 From: vitya Date: Mon, 24 Aug 2026 09:22:15 +0300 Subject: [PATCH] =?UTF-8?q?wiki:=20openwrt-router=20DNS=20=E2=80=94=20?= =?UTF-8?q?=D1=84=D0=B8=D0=BA=D1=81=202026-06-12=20(=D0=BF=D1=80=D0=BE?= =?UTF-8?q?=D0=B2=D0=B0=D0=B9=D0=B4=D0=B5=D1=80=20=D1=80=D0=B5=D0=B6=D0=B5?= =?UTF-8?q?=D1=82=20DoH=20dns.google/cloudflare-dns.com=20=E2=86=92=201.1.?= =?UTF-8?q?1.1)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .wiki/entities/openwrt-router.md | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/.wiki/entities/openwrt-router.md b/.wiki/entities/openwrt-router.md index 05516a0..f1b405d 100644 --- a/.wiki/entities/openwrt-router.md +++ b/.wiki/entities/openwrt-router.md @@ -3,7 +3,7 @@ title: OpenWRT Router (192.168.1.1) type: entity tags: [hardware, networking, openwrt, nat, dhcp] sources: [../sources/nas-recovery-session-2026-05-18.md] -updated: 2026-05-19 +updated: 2026-06-12 --- # OpenWRT Router @@ -55,6 +55,28 @@ updated: 2026-05-19 Дополнительные input rules для wan (стандартные OpenWRT): Allow-DHCP-Renew, Allow-Ping, Allow-IGMP, Allow-DHCPv6, Allow-MLD, Allow-ICMPv6-*, Allow-IPSec-ESP. +## DNS (https-dns-proxy / DoH) + +- LAN DNS обслуживает dnsmasq (`192.168.1.1:53`), который форвардит на локальные `https-dns-proxy`: `127.0.0.1#5053` (resolver 1) и `#5054` (resolver 2). +- Резолверы после фикса 2026-06-12: + - `https://1.1.1.1/dns-query` (Cloudflare) + - `https://one.one.one.one/dns-query` (Cloudflare) + +### ⚠️ Инцидент 2026-06-12: провайдер режет DoH + +Весь DNS локальной сети умер: dnsmasq логировал `Maximum number of concurrent DNS queries reached (max: 150)`, у https-dns-proxy куча соединений в FIN_WAIT1 к 8.8.4.4:443 и 104.16.249.249:443, клиенты получали таймауты. + +Проверено с роутера: **рабочие** — `https://1.1.1.1/dns-query` (HTTP 200, отвечает), UDP 8.8.8.8:53, UDP 1.1.1.1:53, ICMP. **Нерабочие** — `https://dns.google/dns-query`, `https://cloudflare-dns.com/dns-query` (таймаут TCP 443), `https://dns.quad9.net/dns-query`. Обычный TCP 443 наружу работает (1.1.1.1:443 → 301), т.е. блокировка точечная по DoH-резолверам. + +**Фикс:** +``` +uci set https-dns-proxy.@https-dns-proxy[0].resolver_url='https://1.1.1.1/dns-query' +uci set https-dns-proxy.@https-dns-proxy[1].resolver_url='https://one.one.one.one/dns-query' +uci commit https-dns-proxy +/etc/init.d/https-dns-proxy restart +/etc/init.d/dnsmasq restart # при необходимости; dnsmasq_config_update='*' обычно сам +``` + ## Config backup (с 2026-06-12) Daily UCI/config backup → [[kreknin-synology]]: