AdguardTeam / AdguardTeam/AdGuardHome

DNS Failure when pointing to a FreeIPA server upstream

Open
#5,291 6 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
36.9k
Forks
2.5k
PR merge metrics
No merged PRs in 30d

Description

### Prerequisites

- [X] I have checked the [Wiki](https://github.com/AdguardTeam/AdGuardHome/wiki) and [Discussions](https://github.com/AdguardTeam/AdGuardHome/discussions) and found no answer

- [X] I have searched other issues and found no duplicates

- [X] I want to report a bug and not ask a question

### Operating system type

FreeBSD

### CPU architecture

AMD64

### Installation

Other (please mention in the description)

### Setup

On a router, DHCP is handled by the router

### AdGuard Home version

v0.107.21

### Description

#### What did you do?
Configured a conditional forwarding rule to point a specific domain and all subdomains to a FreeIPA server running Bind.

#### Expected result
Adguard queries the FreeIPA DNS server and receives a response.

#### Actual result
A query is sent to the server, corroborated by firewall/router logs showing the packet passed to the server, but AGH shows an error that the server is not responding. This occurs with the server configured as a global upstream as well, it is not limited to conditional forwarding.

#### Screenshots (if applicable)
![image](https://user-images.githubusercontent.com/67663172/209002744-98e9e72c-26af-455a-b3de-a4639e663859.png)
DNS resolution error

![image](https://user-images.githubusercontent.com/67663172/209002864-ed9629e0-41ff-4579-98ee-48d3a11f5be2.png)
Firewall log showing the DNS traffic during the "test upstreams"

![image](https://user-images.githubusercontent.com/67663172/209003178-08c0c3d7-4e34-492a-baae-ad0ee9b7f132.png)
A successful query to the server is executed from the firewall console

#### Additional information
AGH is running on an OPNSense firewall/router, installed from the mimugmail community repo. This is just a wrapper for a FreeBSD installation. It's configured to listen on all LAN interfaces, including the 192.168.2.1/24 interface shown in the screenshot. If I grab a console on the OPNSense host and do a `drill` pointing to the FreeIPA server, the queries work perfectly, so something is broken involving AGH here, not the host or network configuration. No ACLs restricting access are present on the Bind/FreeIPA server.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.