celzero / rethink-app

DNS over HTTPS / DNS over Tor / DNSCrypt client, WireGuard proxifier, firewall, and connection tracker for Android.
https://rethinkfirewall.com/
Apache License 2.0
3.02k stars 154 forks source link

Advanced DNS filtering mucks with DNS caches #1763

Open aviv926 opened 3 weeks ago

aviv926 commented 3 weeks ago

For some reason Rethink keeps the DNS cache for a long time even though the DNS booster option is not working, even after changing the DNS provider it still happens.

Background: I host a service on my personal computer and I access it remotely, when I'm at home and connected but the wifi I set up a DNS record with rewrite in NextDNS and my router in order to route the request to the internal network that is when connected to NextDNS and I'm on wifi at home then: movie.mydomain.com addresses 192.168.1.2 image

Then when I'm not at home I change my DNS provider from Rethink to Rethink DNS or to another provider, so that rewrite will no longer apply

But for some unknown reason Rethink still redirects the address movie.mydomain.com to 192.168.1.2 instead of the public address that should be received from the server

When I disable Rethink everything works fine.

I think it's worth adding to Rethink an option to "clear DNS cache" manually and automatically when changing to another DNS server. Or is this a different bug?

ignoramous commented 3 weeks ago

But for some unknown reason Rethink still redirects the address movie.mydomain.com to 192.168.1.2 instead of the public address that should be received from the server

In Rethink, what do you see (search this domain name movie.mydomain.com to filter) in the DNS Logs (at Configure -> Logs -> swipe to the DNS tab) for the queries sent out after you've changed your DNS (to the one that doesn't do rewrites)? Tap on the log entries (note the timestamp and make sure you're seeing the latest) to bring up a bottomsheet which should show the answered IP and just below it the resolver that answered it (which should say "Cache" if it was answered by Rethink's on-device cache instead).

Note that the issue you're seeing could also be that no queries are sent out at all and the installed apps or the OS (Android) are caching the DNS answers for longer than necessary (or for as long as requested in the answer sent by NextDNS. Ideally, the time-to-live on rewritten answers from NextDNS is 1min or less).

I think it's worth adding to Rethink an option to "clear DNS cache" manually and automatically when changing to another DNS server.

By default, Rethink has a per-DNS cache. So, whenever you change DNS, a new cache is created. But if Configure -> DNS -> Advanced DNS filtering is enabled, it uses a global cache (and I can see how this can be problematic in this particular scenario).

To flush Rethink's DNS cache (if enabled by turning ON DNS booster):

  1. Go to Configure -> DNS
  2. Tap on the refresh icon (πŸ”ƒ) in the top right-hand corner.

To flush Android's DNS cache (if Rethink is running):

  1. From the homescreen, tap on the STOP button.
  2. Then, START Rethink again.

From: r/rethinkdns / (mirror).

aviv926 commented 3 weeks ago

But if Configure -> DNS -> Advanced DNS filtering is enabled, it uses a global cache (and I can see how this can be problematic in this particular scenario).

I turned it off and it solved the problem for me!!

To flush Rethink's DNS cache (if enabled by turning ON DNS booster):

  1. Go to Configure -> DNS
  2. Tap on the refresh icon (πŸ”ƒ) in the top right-hand corner.

To flush Android's DNS cache (if Rethink is running):

  1. From the homescreen, tap on the STOP button.
  2. Then, START Rethink again.

From: r/rethinkdns / (mirror).

Thanks for the info, maybe it should appear in the documentation.

Thank you for your help πŸ˜„

ignoramous commented 3 weeks ago

But if Configure -> DNS -> Advanced DNS filtering is enabled, it uses a global cache (and I can see how this can be problematic in this particular scenario).

I turned it off and it solved the problem for me!

I will try to fix this in v055o, the upcoming version. Mostly an annoying thing to implement (as one would not hit the bug you did unless they do a bunch of unexpected things) and so I've punted it for long. Let's see.

Thanks for the info, maybe it should appear in the documentation.

In the age of all-ensembling LLMs, do we really need docs? ;)

https://g.co/gemini/share/8cd7fce48b04 / (mirror).