Closed cwyin7788 closed 2 years ago
ainar-g
commented
2 years ago Hello and thank you for the very thorough report! A couple of questions to clarify:
Do you see any certificate errors in the verbose logs?
Are there any issues with DoH and DoT?
Do these servers have some kind of firewall rules? The errors look like AGH just doesn't receive any requests. Does nc -u -v -z adguard1.abc.com 784 show something like Connection to … 784 port [udp/*] succeeded!?
Thanks!
cwyin7788
commented
2 years ago Hello and thank you for the very thorough report! A couple of questions to clarify:
- Do you see any certificate errors in the verbose logs?
- Are there any issues with DoH and DoT?
- Do these servers have some kind of firewall rules? The errors look like AGH just doesn't receive any requests. Does
nc -u -v -z adguard1.abc.com 784show something likeConnection to … 784 port [udp/*] succeeded!?Thanks!
Thanks for your quick reply
1. Do you see any certificate errors in the [verbose logs]
seems the log do not have any error about certificate
Here is the DoH question section:
;; QUESTION SECTION:
;safebrowsing-proxy.g.aaplimg.com. IN A
2021/12/25 02:09:58.407068 120956#449 [debug] github.com/AdguardTeam/dnsproxy/proxy.(*Proxy).ServeHTTP(): Incoming HTTPS request on /dns-query/iphonex
2021/12/25 02:09:58.407440 120956#449 [debug] github.com/AdguardTeam/dnsproxy/proxy.remoteAddr(): Using IP address from HTTP request: xxx.xxx.xxx.xxx
2021/12/25 02:09:58.407669 120956#449 [debug] request came from proxy server 127.0.0.1:47730
2021/12/25 02:09:58.407948 120956#449 [debug] github.com/AdguardTeam/dnsproxy/proxy.(*Proxy).logDNSMessage(): IN: ;; opcode: QUERY, status: NOERROR, id: 8921
;; flags: rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 02. Are there any issues with DoH and DoT?
DoH and DoT, both adguard1 & adguard2 also works perfect.
*3. show something like `Connection to … 784 port [udp/] succeeded!`?**
In adguard2 terminal, nc to adguard1 udp port 784, the result show it succeeded.
Merry Christmas！
cwyin7788
commented
2 years ago Hello and thank you for the very thorough report! A couple of questions to clarify:
- Do you see any certificate errors in the verbose logs?
- Are there any issues with DoH and DoT?
- Do these servers have some kind of firewall rules? The errors look like AGH just doesn't receive any requests. Does
nc -u -v -z adguard1.abc.com 784show something likeConnection to … 784 port [udp/*] succeeded!?Thanks!
I just tried to open verbose log in adguard2, so when I repeat this step to test adguard1 DOQ :
Under adguard2, tail -f, the verbose log show the above information:
Will these messages be helpful for your debugging?
thanks for your help.
ainar-g
commented
2 years ago @cwyin7788, thank you for the data! Unfortunately, I still have no idea what could be wrong. It seems like both AGH and the external clients see the port as open.
There is a way to check if there is something wrong with the port or with our DoQ implementation:
Switch the DoQ and DoT ports. So, for example, set the DoT port to 784 and DoQ port 853.
Try making the following requests using dnslookup (making sure that you use the latest version that implements RFC 9000):
dnslookup 'example.com' 'tls://adguard1.abc.com:784'dnslookup 'example.com' 'quic://adguard1.abc.com:853'If the first one fails, but the second succeeds, there is an issue with port 784. If the first one succeeds, but the second one fails, it may have something to do with our DoQ server.
cwyin7788
commented
2 years ago After I do more test, I know what happen,I solved the problem.
I have configured cloudflare warp with wgcf in both adguard1 and adguard2
I just remembered that cloudflare warp uses wireguard, and wireguard uses udp, and quic also uses udp.
so I stop adguard2 cloudflare warp with command "service wg-quick@wg0 stop"
and run "dnslookup 'yahoo.com' quic://adguard1.abc.com:784" test again.
it works.
cwyin7788
commented
2 years ago This experience, let me know that cloudflare warp and DNS-Over-QUIC are not compatible with each other. This is a compatibility issue, not a bug of AGH or DOQ. I'm sorry to bother you for a few days.
Prerequisites
Please answer the following questions for yourself before submitting an issue. YOU MAY DELETE THE PREREQUISITES SECTION.
Issue Details
Expected Behavior
DNS-over-QUIC work properly
Actual Behavior
DNS-over-QUIC not work
Screenshots
I have 2 Raspberry Pi, adguard1.abc.com, adguard2.abc.com , both Pi already installed the AGH, adguard1 is behind the router, adguard2 is not, both pi also not work as DOQ server, here is the screen capture from adguard1.abc.com
adguard1.abc.com, I didn't use any CDN service, so, connect my domain, it will connect my IP directly
AGH setup page show the DOQ address is quic://adguard1.abc.com:784
AGH already listen udp port 784
My router configured port forward
I want to test DOQ working or not, so under adguard2.abc.com's AGH, I set my adguard1 DOQ as the upstream
but when I click "Test upstreams" it show this error
Under adguard2 terminal, I use this command:
https://github.com/ameshkov/dnslookup
try to test my adguard1 DOQ, it also failed
in adguard1 AGH, my certificate do not have any problem
Is this a bug or any wrong settings？
thanks for help.