SmartDNS: Starts before wireguard tunnels - DNS over VPN refused

Package Name

smartdns

Maintainer

@pymumu

OpenWrt Version

All

OpenWrt Target/Subtarget

All

Steps to Reproduce

1. Setup a Wireguard tunnel (named vpn)
2. Setup smartdns in port 53 (main server, no dnsmasq proxy) and bind it to the tunnel interface as well
3. Reboot the router
4. On a tunnel peer try to run a DNS query using the smartdns as server

root@Swift:~# cat /etc/config/smartdns

config smartdns
        option enabled '1'
        option server_name 'swift'
        option port '53'  <--- important, not set as dnsmasq upstream proxy
        option auto_set_dnsmasq '1'
        option tcp_server '1'
        option ipv6_server '1'
        option bind_device '1'
        option dualstack_ip_selection '1'
        option serve_expired '1'
        option cache_persist '1'
        option resolve_local_hostnames '1'
        option force_https_soa '1'
        option rr_ttl_min '60'
        option seconddns_port '6553'
        option seconddns_tcp_server '1'
        option bind_device_name 'br-lan,vpn' <--- bound to the br-lan and also the wireguard interface
        option old_port '53'
        option old_enabled '1'
        option old_auto_set_dnsmasq '1'
(...)

Actual Behaviour

SmartDNS replied from the LAN but not to wireguard peers.

• Lan machine test => works fine.
• Now a remote peer on the VPN, sometimes it works, others I get "connection refused".

Looks to me like there's some timing issue around wireguard and smartdns where smartdns starts before the tunnel is working properly and never binds to the tunnel IP.

Thank you.

Confirmation Checklist

• The package is maintained in this repository.
• I understand that issues related to the base OpenWrt repository or LuCI repository will be closed.
• I am reporting an issue for OpenWrt, not an unsupported fork.

Reproduce the reboot sequence with smartdns bound to br-lan and vpn, then inspect the smartdns service startup configuration and how it handles the WireGuard interface. Done when remote WireGuard peers consistently receive DNS responses after startup, including when the tunnel is not ready before smartdns starts.