HTTPS-DNS-Proxy not starting properly after reboot

[ob45]

Describe the bug

After restarting the router the HTTPS-DNS-Proxy service does not start and work properly despite it being set to "Enabled".

It does show up as "Enabled" and the service appears to be running but the service does not actually work.

I have to manually press the button "Restart" to make it run.

It is not possible that this is a RAM issue because enough RAM is available.

Steps to reproduce

1. Install HTTPS-DNS-Proxy
2. Configure the https-DNS servers in the service tab
3. Restart the router
4. Look at the HTTPS DNS Proxy tab and check the U.I
5. Check if HTTPS over DNS is working (it is not)

I've tried waiting up to half an hour after the restart because "maybe it just takes some time" but the only thing which actually makes it work is restarting the service manually - after which all blocked sites become accessible.

Actual behaviour

The service appears to be running in the U.I but is extremely buggy.
I have to manually restart the service after restarting the router because the service does not automatically start properly.

Stopping the service can lead to nothing happening and the U.I keep showing that it is running.

Expected behaviour

The service should start and work automatically after a router restart and route all DNS requests to the configured DNS servers and use DNS over HTTPS when the service is set as "Enabled".

The U.I should show th ecorrect status of the service.

Additional info

This is my device and formware:

• Device: Xiaomi Mi Router 4A (100M International Edition V2)
• OpenWrt Version: r28304-6dacba30a7
• OpenWrt release: 24.10.0-rc5
• OpenWrt target/subtarget: ramips/mt76x8

This is a 64MB device but as shown in the screenshot enough RAM is available.

For me it is quite easy to check if it works or not because my ISP DNS blocks certain sites, which I cannot access without using DNS over HTTPS so I can just try to hit the site after a router restart and easily check it that way too.

I'm unsure if I am encountering the same issue like #23469 because it seems to be similar but in my case something gets loaded, just not the entire config.

During normal operation:

root@OpenWrt:~# uci show dhcp.@dnsmasq[0].server
dhcp.cfg01411c.server='127.0.0.1#5053' '127.0.0.1#5054' '/mask.icloud.com/' '/mask-h2.icloud.com/' '/use-application-dns.net/' '127.0.0.1#5050' '127.0.0.1#5051' '127.0.0.1#5052'

After a reboot:

root@OpenWrt:~# uci show dhcp.@dnsmasq[0].server
dhcp.cfg01411c.server='127.0.0.1#5053' '127.0.0.1#5054' '/mask.icloud.com/' '/mask-h2.icloud.com/' '/use-application-dns.net/'

Looks like something gets loaded but not the entire / my config.

After restarting the service it looks normal again:

root@OpenWrt:~# uci show dhcp.@dnsmasq[0].server
dhcp.cfg01411c.server='127.0.0.1#5053' '127.0.0.1#5054' '/mask.icloud.com/' '/mask-h2.icloud.com/' '/use-application-dns.net/' '127.0.0.1#5050' '127.0.0.1#5051' '127.0.0.1#5052'

Idk what to make of this. The op in #23469 did say he got nothing at all... meanwhile I do get something but not my entire valid config and I have to manually restart the service each time after reboot.

[stangri]

@ob45: https://docs.openwrt.melmac.net/https-dns-proxy/#GettingHelp

[ob45]

@ob45: https://docs.openwrt.melmac.net/https-dns-proxy/#GettingHelp

After device restart:

root@OpenWrt:~# ubus call system board
{
        "kernel": "6.6.69",
        "hostname": "OpenWrt",
        "system": "MediaTek MT7628AN ver:1 eco:2",
        "model": "Xiaomi Mi Router 4A (100M International Edition V2)",
        "board_name": "xiaomi,mi-router-4a-100m-intl-v2",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "24.10.0-rc5",
                "revision": "r28304-6dacba30a7",
                "target": "ramips/mt76x8",
                "description": "OpenWrt 24.10.0-rc5 r28304-6dacba30a7",
                "builddate": "1736026537"
        }
}
root@OpenWrt:~# curl -V
curl 8.10.1 (mipsel-openwrt-linux-gnu) libcurl/8.10.1 mbedTLS/3.6.2 nghttp2/1.63.0
Release-Date: 2024-09-18
Protocols: file ftp ftps http https ipfs ipns mqtt
Features: alt-svc HSTS HTTP2 HTTPS-proxy IPv6 Largefile SSL threadsafe UnixSockets
root@OpenWrt:~# dnsmasq --version
Dnsmasq version 2.90  Copyright (c) 2000-2024 Simon Kelley
Compile time options: IPv6 GNU-getopt no-DBus UBus no-i18n no-IDN DHCP no-DHCPv6 no-Lua TFTP no-conntrack no-ipset no-nftset no-auth no-cryptohash no-DNSSEC no-ID loop-detect inotify dumpfile

This software comes with ABSOLUTELY NO WARRANTY.
Dnsmasq is free software, and you are welcome to redistribute it
under the terms of the GNU General Public License, version 2 or 3.
root@OpenWrt:~# https-dns-proxy -V
2023.12.26-1
root@OpenWrt:~# uci export dhcp
package dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'
        option filter_aaaa '0'
        option filter_a '0'
        list server '127.0.0.1#5053'
        list server '127.0.0.1#5054'
        list server '/mask.icloud.com/'
        list server '/mask-h2.icloud.com/'
        list server '/use-application-dns.net/'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

root@OpenWrt:~# uci export network
package network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd3c:c7ad:bedc::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0.1'
        option macaddr '00:20:91:FE:66:10'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option delegate '0'

config device
        option name 'eth0.2'
        option macaddr '00:20:91:FE:66:11'

config interface 'wan'
        option device 'eth0.2'
        option proto 'dhcp'
        option delegate '0'
        option hostname 'OpenWrt'

config interface 'wan6'
        option device 'eth0.2'
        option proto 'dhcpv6'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '4 2 6t'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '0 6t'

root@OpenWrt:~# uci export https-dns-proxy
package https-dns-proxy

config main 'config'
        option canary_domains_icloud '1'
        option canary_domains_mozilla '1'
        option dnsmasq_config_update '*'
        option force_dns '1'
        list force_dns_port '53'
        list force_dns_port '853'
        option procd_trigger_wan6 '0'

config https-dns-proxy
        option resolver_url 'https://208.67.220.220/dns-query'
        option listen_addr '127.0.0.1'
        option listen_port '5050'
        option user 'nobody'
        option group 'nogroup'

config https-dns-proxy
        option resolver_url 'https://45.11.45.11/dns-query'
        option listen_addr '127.0.0.1'
        option listen_port '5051'
        option user 'nobody'
        option group 'nogroup'

config https-dns-proxy
        option resolver_url 'https://208.67.222.222/dns-query'
        option listen_addr '127.0.0.1'
        option listen_port '5052'
        option user 'nobody'
        option group 'nogroup'

root@OpenWrt:~# service https-dns-proxy status
running
root@OpenWrt:~# service https-dns-proxy info
{
        "https-dns-proxy": {
                "instances": {
                        "instance1": {
                                "running": true,
                                "pid": 2777,
                                "command": [
                                        "/usr/sbin/https-dns-proxy",
                                        "-r",
                                        "https://208.67.220.220/dns-query",
                                        "-a",
                                        "127.0.0.1",
                                        "-p",
                                        "5050",
                                        "-b",
                                        "1.1.1.1,1.0.0.1,8.8.8.8,8.8.4.4",
                                        "-4",
                                        "-u",
                                        "nobody",
                                        "-g",
                                        "nogroup"
                                ],
                                "term_timeout": 5,
                                "data": {
                                        "firewall": [
                                                {
                                                        "type": "redirect",
                                                        "target": "DNAT",
                                                        "src": "lan",
                                                        "proto": "tcp udp",
                                                        "src_dport": "53",
                                                        "dest_port": "53",
                                                        "family": "any",
                                                        "reflection": false
                                                },
                                                {
                                                        "type": "rule",
                                                        "src": "lan",
                                                        "dest": "*",
                                                        "proto": "tcp udp",
                                                        "dest_port": "853",
                                                        "target": "REJECT"
                                                }
                                        ],
                                        "mdns": {
                                                "https-dns-proxy_5053": {
                                                        "service": "_https-dns-proxy._udp.local",
                                                        "port": 5053,
                                                        "txt": [
                                                                "DNS over HTTPS proxy"
                                                        ]
                                                }
                                        }
                                },
                                "respawn": {
                                        "threshold": 3600,
                                        "timeout": 5,
                                        "retry": 5
                                }
                        },
                        "instance2": {
                                "running": true,
                                "pid": 2778,
                                "command": [
                                        "/usr/sbin/https-dns-proxy",
                                        "-r",
                                        "https://45.11.45.11/dns-query",
                                        "-a",
                                        "127.0.0.1",
                                        "-p",
                                        "5051",
                                        "-b",
                                        "1.1.1.1,1.0.0.1,8.8.8.8,8.8.4.4",
                                        "-4",
                                        "-u",
                                        "nobody",
                                        "-g",
                                        "nogroup"
                                ],
                                "term_timeout": 5,
                                "data": {
                                        "mdns": {
                                                "https-dns-proxy_5054": {
                                                        "service": "_https-dns-proxy._udp.local",
                                                        "port": 5054,
                                                        "txt": [
                                                                "DNS over HTTPS proxy"
                                                        ]
                                                }
                                        }
                                },
                                "respawn": {
                                        "threshold": 3600,
                                        "timeout": 5,
                                        "retry": 5
                                }
                        },
                        "instance3": {
                                "running": true,
                                "pid": 2779,
                                "command": [
                                        "/usr/sbin/https-dns-proxy",
                                        "-r",
                                        "https://208.67.222.222/dns-query",
                                        "-a",
                                        "127.0.0.1",
                                        "-p",
                                        "5052",
                                        "-b",
                                        "1.1.1.1,1.0.0.1,8.8.8.8,8.8.4.4",
                                        "-4",
                                        "-u",
                                        "nobody",
                                        "-g",
                                        "nogroup"
                                ],
                                "term_timeout": 5,
                                "data": {
                                        "mdns": {
                                                "https-dns-proxy_5055": {
                                                        "service": "_https-dns-proxy._udp.local",
                                                        "port": 5055,
                                                        "txt": [
                                                                "DNS over HTTPS proxy"
                                                        ]
                                                }
                                        }
                                },
                                "respawn": {
                                        "threshold": 3600,
                                        "timeout": 5,
                                        "retry": 5
                                }
                        }
                },
                "triggers": [
                        [
                                "interface.*.up",
                                [
                                        [
                                                "run_script",
                                                "/etc/init.d/https-dns-proxy",
                                                "restart",
                                                "on_interface_up"
                                        ]
                                ],
                                3000
                        ],
                        [
                                "config.change",
                                [
                                        "if",
                                        [
                                                "eq",
                                                "package",
                                                "https-dns-proxy"
                                        ],
                                        [
                                                "run_script",
                                                "/etc/init.d/https-dns-proxy",
                                                "reload",
                                                "on_config_change"
                                        ]
                                ],
                                1000
                        ]
                ]
        }
}
root@OpenWrt:~# nslookup google.com 127.0.0.1:5053
nslookup: write to '127.0.0.1:5053': Connection refused
;; connection timed out; no servers could be reached

After restarting the service again:

root@OpenWrt:~# ubus call system board
{
        "kernel": "6.6.69",
        "hostname": "OpenWrt",
        "system": "MediaTek MT7628AN ver:1 eco:2",
        "model": "Xiaomi Mi Router 4A (100M International Edition V2)",
        "board_name": "xiaomi,mi-router-4a-100m-intl-v2",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "24.10.0-rc5",
                "revision": "r28304-6dacba30a7",
                "target": "ramips/mt76x8",
                "description": "OpenWrt 24.10.0-rc5 r28304-6dacba30a7",
                "builddate": "1736026537"
        }
}
root@OpenWrt:~# curl -V
curl 8.10.1 (mipsel-openwrt-linux-gnu) libcurl/8.10.1 mbedTLS/3.6.2 nghttp2/1.63.0
Release-Date: 2024-09-18
Protocols: file ftp ftps http https ipfs ipns mqtt
Features: alt-svc HSTS HTTP2 HTTPS-proxy IPv6 Largefile SSL threadsafe UnixSockets
root@OpenWrt:~# dnsmasq --version
Dnsmasq version 2.90  Copyright (c) 2000-2024 Simon Kelley
Compile time options: IPv6 GNU-getopt no-DBus UBus no-i18n no-IDN DHCP no-DHCPv6 no-Lua TFTP no-conntrack no-ipset no-nftset no-auth no-cryptohash no-DNSSEC no-ID loop-detect inotify dumpfile

This software comes with ABSOLUTELY NO WARRANTY.
Dnsmasq is free software, and you are welcome to redistribute it
under the terms of the GNU General Public License, version 2 or 3.
root@OpenWrt:~# https-dns-proxy -V
2023.12.26-1
root@OpenWrt:~# uci export dhcp
package dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'
        option filter_aaaa '0'
        option filter_a '0'
        list server '127.0.0.1#5053'
        list server '127.0.0.1#5054'
        list server '/mask.icloud.com/'
        list server '/mask-h2.icloud.com/'
        list server '/use-application-dns.net/'
        list server '127.0.0.1#5050'
        list server '127.0.0.1#5051'
        list server '127.0.0.1#5052'
        option doh_backup_noresolv '-1'
        option noresolv '1'
        list doh_backup_server '127.0.0.1#5053'
        list doh_backup_server '127.0.0.1#5054'
        list doh_backup_server '/mask.icloud.com/'
        list doh_backup_server '/mask-h2.icloud.com/'
        list doh_backup_server '/use-application-dns.net/'
        list doh_server '127.0.0.1#5050'
        list doh_server '127.0.0.1#5051'
        list doh_server '127.0.0.1#5052'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

root@OpenWrt:~# uci export network
package network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fd3c:c7ad:bedc::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0.1'
        option macaddr '00:20:91:FE:66:10'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option delegate '0'

config device
        option name 'eth0.2'
        option macaddr '00:20:91:FE:66:11'

config interface 'wan'
        option device 'eth0.2'
        option proto 'dhcp'
        option delegate '0'
        option hostname 'OpenWrt'

config interface 'wan6'
        option device 'eth0.2'
        option proto 'dhcpv6'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '4 2 6t'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '0 6t'

root@OpenWrt:~# uci export https-dns-proxy
package https-dns-proxy

config main 'config'
        option canary_domains_icloud '1'
        option canary_domains_mozilla '1'
        option dnsmasq_config_update '*'
        option force_dns '1'
        list force_dns_port '53'
        list force_dns_port '853'
        option procd_trigger_wan6 '0'

config https-dns-proxy
        option resolver_url 'https://208.67.220.220/dns-query'
        option listen_addr '127.0.0.1'
        option listen_port '5050'
        option user 'nobody'
        option group 'nogroup'

config https-dns-proxy
        option resolver_url 'https://45.11.45.11/dns-query'
        option listen_addr '127.0.0.1'
        option listen_port '5051'
        option user 'nobody'
        option group 'nogroup'

config https-dns-proxy
        option resolver_url 'https://208.67.222.222/dns-query'
        option listen_addr '127.0.0.1'
        option listen_port '5052'
        option user 'nobody'
        option group 'nogroup'

root@OpenWrt:~# service https-dns-proxy status
running
root@OpenWrt:~# service https-dns-proxy info
{
        "https-dns-proxy": {
                "instances": {
                        "instance1": {
                                "running": true,
                                "pid": 4968,
                                "command": [
                                        "/usr/sbin/https-dns-proxy",
                                        "-r",
                                        "https://208.67.220.220/dns-query",
                                        "-a",
                                        "127.0.0.1",
                                        "-p",
                                        "5050",
                                        "-b",
                                        "1.1.1.1,1.0.0.1,8.8.8.8,8.8.4.4",
                                        "-4",
                                        "-u",
                                        "nobody",
                                        "-g",
                                        "nogroup"
                                ],
                                "term_timeout": 5,
                                "data": {
                                        "firewall": [
                                                {
                                                        "type": "redirect",
                                                        "target": "DNAT",
                                                        "src": "lan",
                                                        "proto": "tcp udp",
                                                        "src_dport": "53",
                                                        "dest_port": "53",
                                                        "family": "any",
                                                        "reflection": false
                                                },
                                                {
                                                        "type": "rule",
                                                        "src": "lan",
                                                        "dest": "*",
                                                        "proto": "tcp udp",
                                                        "dest_port": "853",
                                                        "target": "REJECT"
                                                }
                                        ],
                                        "mdns": {
                                                "https-dns-proxy_5053": {
                                                        "service": "_https-dns-proxy._udp.local",
                                                        "port": 5053,
                                                        "txt": [
                                                                "DNS over HTTPS proxy"
                                                        ]
                                                }
                                        }
                                },
                                "respawn": {
                                        "threshold": 3600,
                                        "timeout": 5,
                                        "retry": 5
                                }
                        },
                        "instance2": {
                                "running": true,
                                "pid": 4967,
                                "command": [
                                        "/usr/sbin/https-dns-proxy",
                                        "-r",
                                        "https://45.11.45.11/dns-query",
                                        "-a",
                                        "127.0.0.1",
                                        "-p",
                                        "5051",
                                        "-b",
                                        "1.1.1.1,1.0.0.1,8.8.8.8,8.8.4.4",
                                        "-4",
                                        "-u",
                                        "nobody",
                                        "-g",
                                        "nogroup"
                                ],
                                "term_timeout": 5,
                                "data": {
                                        "mdns": {
                                                "https-dns-proxy_5054": {
                                                        "service": "_https-dns-proxy._udp.local",
                                                        "port": 5054,
                                                        "txt": [
                                                                "DNS over HTTPS proxy"
                                                        ]
                                                }
                                        }
                                },
                                "respawn": {
                                        "threshold": 3600,
                                        "timeout": 5,
                                        "retry": 5
                                }
                        },
                        "instance3": {
                                "running": true,
                                "pid": 4966,
                                "command": [
                                        "/usr/sbin/https-dns-proxy",
                                        "-r",
                                        "https://208.67.222.222/dns-query",
                                        "-a",
                                        "127.0.0.1",
                                        "-p",
                                        "5052",
                                        "-b",
                                        "1.1.1.1,1.0.0.1,8.8.8.8,8.8.4.4",
                                        "-4",
                                        "-u",
                                        "nobody",
                                        "-g",
                                        "nogroup"
                                ],
                                "term_timeout": 5,
                                "data": {
                                        "mdns": {
                                                "https-dns-proxy_5055": {
                                                        "service": "_https-dns-proxy._udp.local",
                                                        "port": 5055,
                                                        "txt": [
                                                                "DNS over HTTPS proxy"
                                                        ]
                                                }
                                        }
                                },
                                "respawn": {
                                        "threshold": 3600,
                                        "timeout": 5,
                                        "retry": 5
                                }
                        }
                },
                "triggers": [
                        [
                                "interface.*",
                                [
                                        "if",
                                        [
                                                "eq",
                                                "interface",
                                                "wan"
                                        ],
                                        [
                                                "run_script",
                                                "/etc/init.d/https-dns-proxy",
                                                "restart",
                                                "on_interface_trigger"
                                        ]
                                ],
                                1000
                        ],
                        [
                                "config.change",
                                [
                                        "if",
                                        [
                                                "eq",
                                                "package",
                                                "https-dns-proxy"
                                        ],
                                        [
                                                "run_script",
                                                "/etc/init.d/https-dns-proxy",
                                                "reload",
                                                "on_config_change"
                                        ]
                                ],
                                1000
                        ]
                ]
        }
}
root@OpenWrt:~# nslookup google.com 127.0.0.1:5053
nslookup: write to '127.0.0.1:5053': Connection refused
;; connection timed out; no servers could be reached

What I've noticed are that some entries in dnsmasq seem to be missing.

These entries for example only exist after I restart the service:

list server '127.0.0.1#5050'
        list server '127.0.0.1#5051'
        list server '127.0.0.1#5052'
        option doh_backup_noresolv '-1'
        option noresolv '1'
        list doh_backup_server '127.0.0.1#5053'
        list doh_backup_server '127.0.0.1#5054'
        list doh_backup_server '/mask.icloud.com/'
        list doh_backup_server '/mask-h2.icloud.com/'
        list doh_backup_server '/use-application-dns.net/'
        list doh_server '127.0.0.1#5050'
        list doh_server '127.0.0.1#5051'
        list doh_server '127.0.0.1#5052'

I think it might be the same issue #23469 faced back then...

[stangri]

There may be an issue when no servers are defined for the dnsmasq instance.

If you capture the output of logread -ehttps-dns-proxy -- right after reboot and the once again after service restart, what does it say? The default behaviour is to stop the service if it's started too early and with no servers defined for dnsmasq your DNS would be broken then.

[Angel996]

Confirmed, got exactly the same issue. Just installed https-dns-proxy today. Could the reason be that dnsmasq starts before https-dns-proxy and fails to connect to it so defaults to DNS provided by the ISP?

Can check the DNS setting by using a web service http://edns.ip-api.com/

[ob45]

There may be an issue when no servers are defined for the dnsmasq instance.

If you capture the output of logread -ehttps-dns-proxy -- right after reboot and the once again after service restart, what does it say?

Right after device reboot:

root@OpenWrt:~# logread -ehttps-dns-proxy
Tue Jan 21 17:56:34 2025 user.notice https-dns-proxy: Starting service instances on_boot ✓✓✓
Tue Jan 21 17:56:35 2025 user.notice https-dns-proxy: Updating dnsmasq config ✓
Tue Jan 21 17:56:42 2025 user.notice https-dns-proxy: Restarting dnsmasq on_config_update ✓
Tue Jan 21 17:56:43 2025 user.notice https-dns-proxy: Setting service raw_trigger for 'interface.*.up'✓
Tue Jan 21 17:56:58 2025 user.notice https-dns-proxy: Stopping service on_failed_health_check ✓
Tue Jan 21 17:56:58 2025 user.notice https-dns-proxy: Setting service raw_trigger for 'interface.*.up'✓

After manually restarting the service:

root@OpenWrt:~# logread -ehttps-dns-proxy
Tue Jan 21 17:56:34 2025 user.notice https-dns-proxy: Starting service instances on_boot ✓✓✓
Tue Jan 21 17:56:35 2025 user.notice https-dns-proxy: Updating dnsmasq config ✓
Tue Jan 21 17:56:42 2025 user.notice https-dns-proxy: Restarting dnsmasq on_config_update ✓
Tue Jan 21 17:56:43 2025 user.notice https-dns-proxy: Setting service raw_trigger for 'interface.*.up'✓
Tue Jan 21 17:56:58 2025 user.notice https-dns-proxy: Stopping service on_failed_health_check ✓
Tue Jan 21 17:56:58 2025 user.notice https-dns-proxy: Setting service raw_trigger for 'interface.*.up'✓
Tue Jan 21 18:01:33 2025 user.notice https-dns-proxy: Starting service instances ✓✓✓
Tue Jan 21 18:01:33 2025 user.notice https-dns-proxy: Updating dnsmasq config ✓
Tue Jan 21 18:01:40 2025 user.notice https-dns-proxy: Restarting dnsmasq on_config_update ✓

I think that @Shine- might be onto something openwrt/openwrt#17651 (comment)

[stangri]

I don't understand why you have:

        list server '127.0.0.1#5053'
        list server '127.0.0.1#5054'
        list server '/mask.icloud.com/'
        list server '/mask-h2.icloud.com/'
        list server '/use-application-dns.net/'

In your dhcp config when the service isn't running. It doesn't look like you've added those manually, it may be an artefact from the older version not cleaning up after itself.

I'd recommend you stop the https-dns-proxy service, delete those entries if they persist and then start the https-dns-proxy service again. You may want to add some non-encrypted servers to your dhcp config first, after cleaning erroneous entries and starting the https-dns-proxy again.

[ob45]

I don't understand why you have:

        list server '127.0.0.1#5053'
        list server '127.0.0.1#5054'
        list server '/mask.icloud.com/'
        list server '/mask-h2.icloud.com/'
        list server '/use-application-dns.net/'

In your dhcp config when the service isn't running. It doesn't look like you've added those manually, it may be an artefact from the older version not cleaning up after itself.

I don't understand either. I haven't added them and it can't be an artefact from an older version because it is a fresh OpenWrt installation, where I had to add this service again.

I had this issue on the 24.10.0-rc4 and 24.10.0-rc3 release too...

I am unsre but if I remember correctly I didn't have this issue on one of the older LuCI less snapshots of the device.

[stangri]

it can't be an artefact from an older version because it is a fresh OpenWrt installation, where I had to add this service again.

I'll have to review the code, but if it's a fresh install it's definitely a bug most likely due to the fact that no servers are defined for dnsmasq instance before the proxy starts.

[ve1mi]

I have the same problem on versions of routers xiaomi 4ac, 4c. Tested on both versions on both routers 23.05.5 and 24.10 rc5.
The problem is full static from the provider, as well as dhcp from another provider.
After a reboot or new installation, doh doesnt work without rebooting HTTPS-DNS-Proxy
same this
list server '127.0.0.1#5053'
list server '127.0.0.1#5054'
list server '/mask.icloud.com/'
list server '/mask-h2.icloud.com/'
list server '/use-application-dns.net/'

[Angel996]

I have these entries too, fresh https-dns-proxy install, never used it before. The lines also appear in /etc/config/dhcp file.

[ob45]

The problem is full static from the provider, as well as dhcp from another provider.'

Do you mean a static IP address from the ISP? I live in a student dorm and all rooms have a static IP assigned to them so maybe that's one of the reasons?

[ve1mi]

Do you mean a static IP address from the ISP? I live in a student dorm and all rooms have a static IP assigned to them so maybe that's one of the reasons?

This is a bug in this package, it is not about isp and router settings. The same problem on different isp (static and dhcp)

[sinancetinkaya]

I don't understand why you have:

        list server '127.0.0.1#5053'
        list server '127.0.0.1#5054'
        list server '/mask.icloud.com/'
        list server '/mask-h2.icloud.com/'
        list server '/use-application-dns.net/'

In your dhcp config when the service isn't running. It doesn't look like you've added those manually, it may be an artefact from the older version not cleaning up after itself.

I don't understand either. I haven't added them and it can't be an artefact from an older version because it is a fresh OpenWrt installation, where I had to add this service again.

I had this issue on the 24.10.0-rc4 and 24.10.0-rc3 release too...

I am unsre but if I remember correctly I didn't have this issue on one of the older LuCI less snapshots of the device.

He adds them himself 🤦‍♀️ https://github.com/stangri/https-dns-proxy/blob/db135baeca1a9fa263ff77c66dcd56ccd0a77e5d/files/etc/init.d/https-dns-proxy#L362

[ob45]

He adds them himself 🤦‍♀️ https://github.com/stangri/https-dns-proxy/blob/db135baeca1a9fa263ff77c66dcd56ccd0a77e5d/files/etc/init.d/https-dns-proxy#L362

I just looked the entries up and it seems like you're right 😂

Now we just need to know why this default config gets loaded on every restart instead of our actual config ^_^

[stangri]

I haven't added them and it can't be an artefact from an older version because it is a fresh OpenWrt installation, where I had to add this service again.

Can you walk me thru steps how you got from default install to your current setup?

For the issue at hand -- can you try:

1. stop https-dns-proxy
2. remove the following from dhcp config

        list server '127.0.0.1#5053'
        list server '127.0.0.1#5054'

3. start https-dns-proxy, make sure it works
4. reboot your router, immediately after it boots up capture the output of logread -ehttps
5. check if dns resolution works

[ob45]

Can you walk me thru steps how you got from default install to your current setup?

Sure!

1. I just open LuCI, go to System > Software
2. Click on "Update Lists"
3. After it is done updating the list I search for "HTTPS-DNS-Proxy"
4. Then I download "luci-app-https-dns-proxy" because it installs the "HTTPS-DNS-Proxy" package too
5. After it is done I lose the ability to use the normal net because this package configures google and cloudflare DNS servers and my ISP is seething at the thought of people using their own DNS servers
6. I logout & login again for luci to load the "Services tab"
7. I go to Services > HTTPS-DNS-Proxy and delete the default DNS servers, which are pre configured
8. I configure the DNS servers, which can be seen above
9. Internet works again because these DNS servers haven't been blacklisted

That's basically it. After I restart the router my internet is gone again because the default config gets loaded with ISP banned DNS servers. Then I restart the service, which loads my DNS servers mentioned above and the internet works again.

The question now is why the default stuff gets loaded on router restart...