DoT breaks DNS on GT-BE98

Router Model Affected Models: GT-BE98

Firmware Version Affected 3006.102.1_beta1

Is this bug present in upstream Merlin releases too? No

Describe the bug Enabling DoT on the GT-BE98 on 3006.102.1_beta1 causes DNS to stop resolving on clients until DoT is disabled and router is rebooted. I wasn't sure whether to post an issue as the firmware is not officially released but I figure bug reports are still helpful.

To Reproduce Steps to reproduce the behavior:

Enable DoT
Try resolve DNS on any clients

Expected behavior Stubby to work as normal.

Screenshots

Nslookup on a windows client after enabling DoT

C:\Users\Adamm>nslookup adam.com Server: GT-BE98-38A4 Address: 192.168.1.1

DNS request timed out. timeout was 2 seconds. DNS request timed out. timeout was 2 seconds. DNS request timed out. timeout was 2 seconds. DNS request timed out. timeout was 2 seconds. *** Request to GT-BE98-38A4 timed-out

The router can still directly resolve DNS though;

skynet@GT-BE98-38A4:/tmp/home/root# nslookup adam.com Server: 1.1.1.1 Address 1: 1.1.1.1 one.one.one.one

Name: adam.com Address 1: 20.110.222.158

Syslog output after enabling DoT;

Jun 25 17:44:02 pppd[5024]: Hangup (SIGHUP) Jun 25 17:44:02 pppd[5024]: Terminating on signal 15 Jun 25 17:44:02 pppd[5024]: Connect time 1333.0 minutes. Jun 25 17:44:02 pppd[5024]: Sent 3385129152 bytes, received 3069596647 bytes. Jun 25 17:44:02 lldpd[4275]: removal request for address of 220.233.1.54%30, but no knowledge of it Jun 25 17:44:02 pppd[5024]: Connection terminated. Jun 25 17:44:02 kernel: Freeing devid[2078] for ppp0 Jun 25 17:44:02 pppd[5024]: Sent PADT Jun 25 17:44:02 pppd[5024]: Exit. Jun 25 17:44:02 lldpd[4275]: removal request for address of 169.254.10.11%19, but no knowledge of it Jun 25 17:44:04 pppd[16853]: Plugin rp-pppoe.so loaded. Jun 25 17:44:04 pppd[16853]: RP-PPPoE plugin version 3.11 compiled against pppd 2.4.7 Jun 25 17:44:04 pppd[16855]: pppd 2.4.7 started by skynet, uid 0 Jun 25 17:44:04 custom_script: Running /jffs/scripts/service-event (args: restart stubby) Jun 25 17:44:04 pppd[16855]: PPP session is 44224 (0xacc0) Jun 25 17:44:04 pppd[16855]: Connected to 88:1d:fc:68:3a:00 via interface eth0 Jun 25 17:44:04 kernel: Assigning idx[35] for ppp0 Jun 25 17:44:04 pppd[16855]: Using interface ppp0 Jun 25 17:44:04 pppd[16855]: Connect: ppp0 <--> eth0 Jun 25 17:44:15 services: apply rules error(21849) Jun 25 17:44:16 custom_script: Running /jffs/scripts/firewall-start (args: ) Jun 25 17:44:16 zcip_client: configured 169.254.10.11 Jun 25 17:44:16 Skynet: [] Private WAN IP Detected 0.0.0.0 - Please Put Your Modem In Bridge Mode / Disable CG-NAT Jun 25 17:44:16 WAN(0)_Connection: Fail to connect with some issues. Jun 25 17:44:19 pppd[16855]: CHAP authentication succeeded Jun 25 17:44:19 pppd[16855]: CHAP authentication succeeded Jun 25 17:44:19 pppd[16855]: peer from calling number 88:1D:FC:68:3A:00 authorized Jun 25 17:44:19 lldpd[4275]: removal request for address of xx.xx.xx.xx%35, but no knowledge of it Jun 25 17:44:19 pppd[16855]: local IP address xx.xx.xx.xx Jun 25 17:44:19 pppd[16855]: remote IP address 220.233.1.54 Jun 25 17:44:19 lldpd[4275]: removal request for address of 220.233.1.54%35, but no knowledge of it Jun 25 17:44:19 lldpd[4275]: removal request for address of xx.xx.xx.xx%35, but no knowledge of it Jun 25 17:44:19 lldpd[4275]: removal request for address of xx.xx.xx.xx%35, but no knowledge of it Jun 25 17:44:20 custom_script: Running /jffs/scripts/firewall-start (args: ppp0) Jun 25 17:44:20 wan: finish adding multi routes Jun 25 17:44:20 openvpn-routing: Applying all killswitches Jun 25 17:44:20 miniupnpd[7682]: shutting down MiniUPnPd Jun 25 17:44:22 WAN(0)_Connection: WAN was restored. Jun 25 17:44:25 miniupnpd[17709]: HTTP listening on port 33491 Jun 25 17:44:25 miniupnpd[17709]: no HTTP IPv6 address, disabling IPv6 Jun 25 17:44:25 miniupnpd[17709]: Listening for NAT-PMP/PCP traffic on port 5351 Jun 25 17:44:25 rc_service: ip-up 17322:notify_rc start_vpnserver1 Jun 25 17:44:25 rc_service: ip-up 17322:notify_rc start_vpnserver2 Jun 25 17:44:25 rc_service: waitting "start_vpnserver1" via ip-up ... Jun 25 17:44:25 custom_script: Running /jffs/scripts/service-event (args: start vpnserver1) Jun 25 17:44:25 kernel: Assigning idx[36] for tun21 Jun 25 17:44:25 ovpn-server1[17736]: OpenVPN 2.6.10 arm-buildroot-linux-gnueabi [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] Jun 25 17:44:25 ovpn-server1[17736]: library versions: OpenSSL 1.1.1w 11 Sep 2023, LZO 2.10 Jun 25 17:44:25 ovpn-server1[17737]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts Jun 25 17:44:25 ovpn-server1[17737]: PLUGIN AUTH-PAM: initialization succeeded (fg) Jun 25 17:44:25 ovpn-server1[17737]: PLUGIN_INIT: POST /usr/lib/openvpn-plugin-auth-pam.so '[/usr/lib/openvpn-plugin-auth-pam.so] [openvpn]' intercepted=PLUGIN_AUTH_USER_PASS_VERIFY Jun 25 17:44:25 ovpn-server1[17737]: Diffie-Hellman initialized with 2048 bit key Jun 25 17:44:25 ovpn-server1[17737]: TUN/TAP device tun21 opened Jun 25 17:44:25 ovpn-server1[17737]: TUN/TAP TX queue length set to 1000 Jun 25 17:44:25 ovpn-server1[17737]: /usr/sbin/ip link set dev tun21 up mtu 1500 Jun 25 17:44:25 vpnserver1[17738]: PLUGIN AUTH-PAM: BACKGROUND: initialization succeeded Jun 25 17:44:25 ovpn-server1[17737]: /usr/sbin/ip link set dev tun21 up Jun 25 17:44:25 ovpn-server1[17737]: /usr/sbin/ip addr add dev tun21 10.8.0.1/24 Jun 25 17:44:25 ovpn-server1[17737]: ovpn-up 1 server tun21 1500 0 10.8.0.1 255.255.255.0 init Jun 25 17:44:25 ovpn-server1[17737]: Socket Buffers: R=[524288->524288] S=[524288->524288] Jun 25 17:44:25 ovpn-server1[17737]: UDPv4 link local (bound): [AF_INET][undef]:1194 Jun 25 17:44:25 ovpn-server1[17737]: UDPv4 link remote: [AF_UNSPEC] Jun 25 17:44:25 ovpn-server1[17737]: MULTI: multi_init called, r=256 v=256 Jun 25 17:44:25 ovpn-server1[17737]: IFCONFIG POOL IPv4: base=10.8.0.2 size=253 Jun 25 17:44:25 ovpn-server1[17737]: Initialization Sequence Completed Jun 25 17:44:26 custom_script: Running /jffs/scripts/service-event (args: start vpnserver2) Jun 25 17:44:26 kernel: Assigning idx[37] for tun22 Jun 25 17:44:26 ovpn-server2[17781]: OpenVPN 2.6.10 arm-buildroot-linux-gnueabi [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] Jun 25 17:44:26 ovpn-server2[17781]: library versions: OpenSSL 1.1.1w 11 Sep 2023, LZO 2.10 Jun 25 17:44:26 ovpn-server2[17782]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts Jun 25 17:44:26 ovpn-server2[17782]: PLUGIN AUTH-PAM: initialization succeeded (fg) Jun 25 17:44:26 ovpn-server2[17782]: PLUGIN_INIT: POST /usr/lib/openvpn-plugin-auth-pam.so '[/usr/lib/openvpn-plugin-auth-pam.so] [openvpn]' intercepted=PLUGIN_AUTH_USER_PASS_VERIFY Jun 25 17:44:26 ovpn-server2[17782]: Diffie-Hellman initialized with 2048 bit key Jun 25 17:44:26 ovpn-server2[17782]: TUN/TAP device tun22 opened Jun 25 17:44:26 ovpn-server2[17782]: TUN/TAP TX queue length set to 1000 Jun 25 17:44:26 ovpn-server2[17782]: /usr/sbin/ip link set dev tun22 up mtu 1500 Jun 25 17:44:26 vpnserver2[17784]: PLUGIN AUTH-PAM: BACKGROUND: initialization succeeded Jun 25 17:44:26 ovpn-server2[17782]: /usr/sbin/ip link set dev tun22 up Jun 25 17:44:26 ovpn-server2[17782]: /usr/sbin/ip addr add dev tun22 10.16.0.1/24 Jun 25 17:44:26 ovpn-server2[17782]: ovpn-up 2 server tun22 1500 0 10.16.0.1 255.255.255.0 init Jun 25 17:44:26 ovpn-server2[17782]: Socket Buffers: R=[524288->524288] S=[524288->524288] Jun 25 17:44:26 ovpn-server2[17782]: UDPv4 link local (bound): [AF_INET][undef]:1195 Jun 25 17:44:26 ovpn-server2[17782]: UDPv4 link remote: [AF_UNSPEC] Jun 25 17:44:26 ovpn-server2[17782]: MULTI: multi_init called, r=256 v=256 Jun 25 17:44:26 ovpn-server2[17782]: IFCONFIG POOL IPv4: base=10.16.0.2 size=253 Jun 25 17:44:26 ovpn-server2[17782]: Initialization Sequence Completed Jun 25 17:44:27 BWDPI: force to flush flowcache entries Jun 25 17:44:27 kernel: IDPfw: Exit IDPfw Jun 25 17:44:27 kernel: mod epilog takes 0 jiffies Jun 25 17:44:27 kernel: IDPfw: Exit IDPfw Jun 25 17:44:27 kernel: Exit chrdev /dev/idpfw with major 191 Jun 25 17:44:27 kernel: udb_core lock_num = 37 Jun 25 17:44:27 kernel: Exit chrdev /dev/idp with major 190 Jun 25 17:44:27 BWDPI: rollback fc Jun 25 17:44:27 kernel: Init chrdev /dev/idp with major 190 Jun 25 17:44:27 kernel: tdts: tcp_conn_max = 8000 Jun 25 17:44:27 kernel: tdts: tcp_conn_timeout = 300 sec Jun 25 17:44:29 wlceventd: wlceventd_proc_event(662): wl0: Disassoc 4A:12:01:04:FE:C3, status: 0, reason: Disassociated because sending station is leaving (or has left) BSS (8), rssi:0 Jun 25 17:44:29 wlceventd: wlceventd_proc_event(645): wl0: Deauth_ind 4A:12:01:04:FE:C3, status: 0, reason: Deauthenticated because sending station is leaving (or has left) IBSS or ESS (3), rssi:0 Jun 25 17:44:29 hostapd: wl0: STA 4a:12:01:04:fe:c3 IEEE 802.11: disassociated Jun 25 17:44:29 hostapd: wl0: STA 4a:12:01:04:fe:c3 IEEE 802.11: disassociated Jun 25 17:44:29 kernel: tdts_udb: unknown parameter 'qos_wan' ignored Jun 25 17:44:29 kernel: tdts_udb: unknown parameter 'qos_lan' ignored Jun 25 17:44:29 kernel: SHN Release Version: 2.0.7 No_GPL_b5e749f_RELS_0126 Jun 25 17:44:29 kernel: UDB Core Version: 0.2.20 Jun 25 17:44:29 kernel: Init chrdev /dev/idpfw with major 191 Jun 25 17:44:29 kernel: Registered DNS Req parsing Jun 25 17:44:29 kernel: IDPfw: flush fc Jun 25 17:44:29 kernel: IDPfw: IDPfw is ready Jun 25 17:44:29 kernel: sizeof forward pkt param = 280 Jun 25 17:44:29 BWDPI: fun bitmap = 43f Jun 25 17:44:30 custom_script: Running /jffs/scripts/firewall-start (args: ppp0) Jun 25 17:44:30 rc_service: ip-up 17322:notify_rc stop_samba Jun 25 17:44:30 custom_script: Running /jffs/scripts/service-event (args: stop samba) Jun 25 17:44:30 wsdd2[8489]: terminating. Jun 25 17:44:30 Samba_Server: smb daemon is stopped Jun 25 17:44:30 Skynet: [] Lock File Detected (start skynetloc=/tmp/mnt/USB/skynet) (pid=17063) - Exiting (cpid=18176) Jun 25 17:44:31 rc_service: ip-up 17322:notify_rc start_samba Jun 25 17:44:31 custom_script: Running /jffs/scripts/service-event (args: start samba) Jun 25 17:44:31 custom_config: Appending content of /jffs/configs/dnsmasq.conf.add. Jun 25 17:44:31 custom_script: Running /jffs/scripts/dnsmasq.postconf (args: /etc/dnsmasq.conf) Jun 25 17:44:31 Diversion: restarted Dnsmasq to apply settings Jun 25 17:44:31 Samba_Server: daemon is started Jun 25 17:44:31 wsdd2[18351]: starting. Jun 25 17:44:32 wan_up: Restart DDNS Jun 25 17:44:32 hostapd: wl0: STA 4a:12:01:04:fe:c3 IEEE 802.11: associated (aid 2) Jun 25 17:44:32 wlceventd: wlceventd_proc_event(722): wl0: Assoc 4A:12:01:04:FE:C3, status: Successful (0), rssi:-72 Jun 25 17:44:32 hostapd: wl0: STA 4a:12:01:04:fe:c3 RADIUS: starting accounting session 8BD55EB32C33BD2F Jun 25 17:44:32 hostapd: wl0: STA 4a:12:01:04:fe:c3 WPA: pairwise key handshake completed (RSN) Jun 25 17:44:32 rc_service: service 18512:notify_rc restart_dnsmasq Jun 25 17:44:32 custom_script: Running /jffs/scripts/service-event (args: restart dnsmasq) Jun 25 17:44:32 custom_config: Appending content of /jffs/configs/dnsmasq.conf.add. Jun 25 17:44:32 custom_script: Running /jffs/scripts/dnsmasq.postconf (args: /etc/dnsmasq.conf) Jun 25 17:44:33 Diversion: restarted Dnsmasq to apply settings Jun 25 17:44:47 wlceventd: wlceventd_proc_event(662): wl0: Disassoc EA:9B:5D:3F:8A:5D, status: 0, reason: Disassociated because sending station is leaving (or has left) BSS (8), rssi:0 Jun 25 17:44:47 wlceventd: wlceventd_proc_event(645): wl0: Deauth_ind EA:9B:5D:3F:8A:5D, status: 0, reason: Deauthenticated because sending station is leaving (or has left) IBSS or ESS (3), rssi:0 Jun 25 17:44:47 hostapd: wl0: STA ea:9b:5d:3f:8a:5d IEEE 802.11: disassociated Jun 25 17:44:47 hostapd: wl0: STA ea:9b:5d:3f:8a:5d IEEE 802.11: disassociated Jun 25 17:44:48 Skynet: [i] Mounting Skynet Web Page As user2.asp Jun 25 17:44:49 Skynet: [#] 36186 IPs (+0) -- 3131 Ranges Banned (+0) || 0 Inbound -- 0 Outbound Connections Blocked! [start] [33s] Jun 25 17:44:51 hostapd: wl0: STA ea:9b:5d:3f:8a:5d IEEE 802.11: associated (aid 1) Jun 25 17:44:51 wlceventd: wlceventd_proc_event(722): wl0: Assoc EA:9B:5D:3F:8A:5D, status: Successful (0), rssi:-61 Jun 25 17:44:51 hostapd: wl0: STA ea:9b:5d:3f:8a:5d RADIUS: starting accounting session 5B6F5803ACE8756B Jun 25 17:44:51 hostapd: wl0: STA ea:9b:5d:3f:8a:5d WPA: pairwise key handshake completed (RSN) Jun 25 17:44:56 ovpn-server1[17737]: xxx.xxx.xxx.xxx:39205 VERIFY OK: depth=1, C=TW, ST=TW, L=Taipei, O=ASUS, OU=Home/Office, CN=GT-BE98, emailAddress=me@asusrouter.lan Jun 25 17:44:56 ovpn-server1[17737]: xxx.xxx.xxx.xxx:39205 VERIFY OK: depth=0, C=TW, ST=TW, L=Taipei, O=ASUS, OU=Home/Office, CN=client, emailAddress=me@asusrouter.lan Jun 25 17:44:56 ovpn-server1[17737]: xxx.xxx.xxx.xxx:39205 peer info: IV_VER=2.6.10 Jun 25 17:44:56 ovpn-server1[17737]: xxx.xxx.xxx.xxx:39205 peer info: IV_PLAT=linux Jun 25 17:44:56 ovpn-server1[17737]: xxx.xxx.xxx.xxx:39205 peer info: IV_TCPNL=1 Jun 25 17:44:56 ovpn-server1[17737]: xxx.xxx.xxx.xxx:39205 peer info: IV_MTU=1600 Jun 25 17:44:56 ovpn-server1[17737]: xxx.xxx.xxx.xxx:39205 peer info: IV_NCP=2 Jun 25 17:44:56 ovpn-server1[17737]: xxx.xxx.xxx.xxx:39205 peer info: IV_CIPHERS=AES-256-GCM:AES-128-GCM:AES-256-CBC:AES-128-CBC:CHACHA20-POLY1305 Jun 25 17:44:56 ovpn-server1[17737]: xxx.xxx.xxx.xxx:39205 peer info: IV_PROTO=990 Jun 25 17:44:56 ovpn-server1[17737]: xxx.xxx.xxx.xxx:39205 peer info: IV_LZO_STUB=1 Jun 25 17:44:56 ovpn-server1[17737]: xxx.xxx.xxx.xxx:39205 peer info: IV_COMP_STUB=1 Jun 25 17:44:56 ovpn-server1[17737]: xxx.xxx.xxx.xxx:39205 peer info: IV_COMP_STUBv2=1 Jun 25 17:44:56 ovpn-server1[17737]: xxx.xxx.xxx.xxx:39205 PLUGIN_CALL: POST /usr/lib/openvpn-plugin-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0 Jun 25 17:44:56 ovpn-server1[17737]: xxx.xxx.xxx.xxx:39205 TLS: Username/Password authentication succeeded for username 'skynet' Jun 25 17:44:56 ovpn-server1[17737]: xxx.xxx.xxx.xxx:39205 TLS: move_session: dest=TM_ACTIVE src=TM_INITIAL reinit_src=1 Jun 25 17:44:56 ovpn-server1[17737]: xxx.xxx.xxx.xxx:39205 TLS: tls_multi_process: initial untrusted session promoted to trusted Jun 25 17:44:56 ovpn-server1[17737]: xxx.xxx.xxx.xxx:39205 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_CHACHA20_POLY1305_SHA256, peer certificate: 2048 bits RSA, signature: RSA-SHA256, peer temporary key: 253 bits X25519 Jun 25 17:44:56 ovpn-server1[17737]: xxx.xxx.xxx.xxx:39205 [client] Peer Connection Initiated with [AF_INET]xxx.xxx.xxx.xxx:39205 (via [AF_INET]xx.xx.xx.xx%ppp0) Jun 25 17:44:56 ovpn-server1[17737]: client/xxx.xxx.xxx.xxx:39205 MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=(Not enabled) Jun 25 17:44:56 ovpn-server1[17737]: client/xxx.xxx.xxx.xxx:39205 MULTI: Learn: 10.8.0.2 -> client/xxx.xxx.xxx.xxx:39205 Jun 25 17:44:56 ovpn-server1[17737]: client/xxx.xxx.xxx.xxx:39205 MULTI: primary virtual IP for client/xxx.xxx.xxx.xxx:39205: 10.8.0.2 Jun 25 17:44:56 ovpn-server1[17737]: client/xxx.xxx.xxx.xxx:39205 SENT CONTROL [client]: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0 vpn_gateway 500,dhcp-option DNS 192.168.1.1,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 15,ping-restart 60,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM,protocol-flags cc-exit tls-ekm dyn-tls-crypt,tun-mtu 1500' (status=1) Jun 25 17:44:57 ovpn-server1[17737]: client/xxx.xxx.xxx.xxx:39205 Data Channel: cipher 'AES-256-GCM', peer-id: 0 Jun 25 17:44:57 ovpn-server1[17737]: client/xxx.xxx.xxx.xxx:39205 Timers: ping 15, ping-restart 120 Jun 25 17:44:57 ovpn-server1[17737]: client/xxx.xxx.xxx.xxx:39205 Protocol options: protocol-flags cc-exit tls-ekm dyn-tls-crypt Jun 25 17:45:20 dropbear[20020]: Child connection from 192.168.1.150:54053 Jun 25 17:45:20 dropbear[20020]: Pubkey auth succeeded for 'skynet' with ssh-rsa key SHA256:xxxxxxxxxxxxxxxxxxxxxxxx from 192.168.1.150:54053 Jun 25 17:45:21 hostapd: wl2: STA c4:c1:7d:a2:cf:cd IEEE 802.11: disassociated Jun 25 17:45:21 wlceventd: wlceventd_proc_event(645): wl2: Deauth_ind C4:C1:7D:A2:CF:CD, status: 0, reason: Station requesting (re)association is not authenticated with responding station (9), rssi:-51 Jun 25 17:45:21 wlceventd: wlceventd_proc_event(662): wl2: Disassoc C4:C1:7D:A2:CF:CD, status: 0, reason: Disassociated because sending station is leaving (or has left) BSS (8), rssi:-51 Jun 25 17:45:21 hostapd: wl2: STA c4:c1:7d:a2:cf:cd IEEE 802.11: disassociated Jun 25 17:45:22 wlceventd: wlceventd_proc_event(685): wl2: Auth C4:C1:7D:A2:CF:CD, status: Successful (0), rssi:0 Jun 25 17:45:22 hostapd: wl2: STA c4:c1:7d:a2:cf:cd IEEE 802.11: associated (aid 1) Jun 25 17:45:22 wlceventd: wlceventd_proc_event(722): wl2: Assoc C4:C1:7D:A2:CF:CD, status: Successful (0), rssi:-52 Jun 25 17:45:22 hostapd: wl2: STA c4:c1:7d:a2:cf:cd RADIUS: starting accounting session 12D79CE761D47CE0 Jun 25 17:45:22 hostapd: wl2: STA c4:c1:7d:a2:cf:cd WPA: pairwise key handshake completed (RSN)

gnuton / asuswrt-merlin.ng

DoT breaks DNS on GT-BE98 #617