Why can't I use Linked IP with my configuration for my router?

Darth Maul Where in the Huawei router were you entering the DNS IP addresses? They need to be in the DHCP setup so that devices connecting to the router will automatically be using Nextdns. 

R P M 

thank ya for the follow up. Huawei had nextDNS IP set in DHCP settings and can confirm endpoints are pulling the nextDNS IPs down for their local DNS host entries. still no luck

this is a lack of understanding on my part. I just watched some crazy cat video of how complex DNS is which didn't make me feel any better.(A Cat Explains DNS - YouTube). 

The Huawei shows the public IP on the modem interface. this  matches the IP in NO-IP DNS portal config with the huawei. I see the same IP auto update in nextDNS properly after a change is made.

however when done so it states "This device is using NextDNS with no configuration. Make sure to link your IP address in the Linked IP section below.". If I hit link IP it goes greenlight. all good!

If I manually hit the URL under advanced, the URL stringhttps[:]//link-ip.nextdns.io/##ABCD#####, it outputs same as my IP from google and for a moment refreshing repeatedly instead of the "device is using NEXT DNS with no config..etc" it will show 

greenlit "All good! This device is using NextDNS with this configuration." and auto link itself. but I have to trigger it. Then shortly after auto reverts back to the IP matching NoIP and the router public interface IP. and "this device NEXT DNS with no config ..etc"

with the same macOS endpoint and having the DUP client installed, it will update the no-ip portal with the same google IP match as desired. unlike the router config which updates noIP with the public IP on huawei interface

by putting in something bogus like diff port 9999 on the router to down the interface, go to noIP portal and put a bogus IP, then bring the router interface port back to 80, the noIP portal updates with the public IP on the huawei interface.

I'll give it another shot tomorrow night. thanks again

Darth Maul Oops, you shouldn’t show your full update link. Can you edit the post to remove it?

Oh, it seems like the Huawei is not quite right with no-ip. Running a no-ip client on another device might be a good option or just use the ip update link for nextdns regularly. 

R P M 

i appreciate the help! it actually was a bogus string for the link a1, b2, c,3 d4 =O

Nautilus 

i was able to login with the telecomadmin account. It does show NAT enabled in my screenshot

I'm going to guess if I set to static, it will break things without paying for a static IP (might have to go that route..there is no always on device in the house.). Same if. I tamper with NAT settings?

The wifi on the huawei is bad..so today I just bought a newfi3 router and put openWRT on it.  I then disabled wifi on huawei and enabled wifi on the openWRT. DHCP still running on huawei without issues. This took a lot of googlefu to get it working on it, but was proud of myself. LOL

I don't think my sister in law has any PPoE info from converge, but I will ask if that would help instead of DHCP. I thought of this last night, but disregarded the thought because didn't think it was possible with the Huawei being inline of the bridged openWRT via LANport. If the openWRT is just a dhcp client, I can configure DYNDNS on the openWRT and problem solved? Just like if I were to run a DUP on an endpoint. I will try that as well. fingers crossed for tonight on that approach. the openWRT webgui interface is intimidating

Darth Maul From that screenshot you posted it looks like it’s connecting to the internet via DHCP, this is not a good sign as it could well be CGNAT you are connected to, as @Nautilus suggested. 

With OpenWRT you have the option to set up DNS-over-https or DNS-over-TLS on device which will bypass the CGNAT issues you could be experiencing. 

Here’s the setup page for NextDNS on openWRT. 
https://github.com/nextdns/nextdns/wiki/OpenWRT

Very simple for newer versions of OpenWRT, check further down the page. 

R P M 

 

thank you for that. I wasted a lot of time on the noip stuff (I removed it altogether after having same issue with duckDNS).

After running thru. the KB above. it installed successfully. here are screenshots. I've properly populated the config with ID. With DoH there is no need for dynamicDNS correct? because its making DNS queries over https from the openWRT to nextDNS ?

 

In the NextDNS web portal it still shows:

This device is using NextDNS with no configuration.

Make sure you set the config ID below shown in the app settings

Shouldn't that be greenlit / protected now?

I should note that before I saw your reply this morning, I ran this set of uci commands (replacing the google IPs with my nextDNS ones).  I also tried replacing the uci command with the other line item

uci set https-dns-proxy.dns.resolver_url="https://dns.nextdns.io/#####”

I figured it is irrelevant because its http proxy, but I didn't remove. it

ok after removing that pkg and rerunning the config, i looked at the log and have different results. here we go

root@OpenWrt:~# nextdns config

bogus-priv true

max-inflight-requests 256

listen localhost:53

report-client-info true

discovery-dns

config #####

setup-router true

auto-activate true

control /var/run/nextdns.sock

cache-size 10MB

hardened-privacy false

use-hosts true

detect-captive-portals false

timeout 5s

log-queries true

cache-max-age 0s

max-ttl 5s

mdns all

ongoing in log. no other entries

Sat Jun 25 08:26:17 2022 daemon.notice nextdns[3673]: Connected 45.11.104.186:443 (con=39ms tls=71ms, TCP, TLS13)

Sat Jun 25 08:27:52 2022 daemon.notice nextdns[3673]: Connected 45.11.104.186:443 (con=26ms tls=50ms, TCP, TLS13)

Sat Jun 25 08:34:04 2022 daemon.notice nextdns[3673]: Connected 45.11.104.186:443 (con=23ms tls=46ms, TCP, TLS13)

Sat Jun 25 08:38:04 2022 daemon.notice nextdns[3673]: Connected 45.11.104.186:443 (con=21ms tls=48ms, TCP, TLS13)

Sat Jun 25 08:39:45 2022 daemon.notice nextdns[3673]: Connected 45.11.104.186:443 (con=26ms tls=52ms, TCP, TLS13)

Sat Jun 25 08:41:31 2022 daemon.notice nextdns[3673]: Connected 45.11.104.186:443 (con=26ms tls=52ms, TCP, TLS13)

Darth Maul I’m not sure it is completely configured correctly. Will see how it goes. 

Only issue I see, from what you’ve said, is that the DHCP DNS server setting should be using the local IP of the OpenWRT box. Unless devices are picking it up automatically?

R P M 

This late at night I seem to be verbose on the nonsense, but fail on the needed details to help triage woops. The "agentless" endpoints behind the router do pick up the nextDNS ok yep! The huwei has the nextDNS IPs and the DHCP server is running on huawei..but its in two diff GUI spots. when i hit test.nextdns.io they show up as DoH. Since it is working, I take it I don't need to put the OpenWRT's local DNS server IPs?

However, I ran into new issue. When I turn on secure DNS drop down on any of the browsers under privacy &  security there is a drop down for DNS vendors, one of which NextDNS built in. I try that and I get below:

This device is using NextDNS with no configuration.Make sure you use the DNS-over-HTTPS endpoint shown below.

If I put in custom URL in there instead with https[:]//dns.nextdns.io/a1b2c3  it works. All is good!  I thought it was an issue since I have to manually put it in when there's an OOBE setting. I tested with android firefox/chrome (android edge didn't seem to have secure DNS setting anywhere).  All work fine..I'm assuming the OOBE drop down NextDNS is for the free tier?

So..in any circumstance, It seems I still need to go into each browser on each device and set the custom string? Otherwise, I think I'm fully up and running. If I don't set browser secureDNS and hit test.nextdns.io, it comes across as UDP instead of DoH despite the nextDNS setup on router/openWRT.

Is that just the nature of the beast on browsers? I imagine thats why JAMF/Kandji/Intune/etc are so important for tamper proof for enterprise companies when 'these are 'managed by your org' etc. If that is the case, I am good to! if not, I've got some more troubleshooting to do

 

thank you RPM!

Darth Maul 

You should not be changing the secure dns settings in browsers, they need to be set to off or disabled. 
When you use test.nextdns.io you’re getting UDP which means that it’s not using the openWRT box and the nextdns CLI client.

Without being able to see the router interface myself I can’t help in pointing you where to set the dns ip of the openWRT box. 
It’s a shame Huawei aren’t providing a emulator for the interface. That would be useful!

R P M 

my screenshot above was bad. i had plugged in the nextDNS IPs into the DNS search list instead of static DNS config. i tried putting in the local openWRT DNS entry on theproper static DNS on  huawei

since it didn't work, I popped in the local openwrt IP on huawei and openWRT, but still getting UDP. it does show the proper DNS IP for dst though on test.nextdns.io. below is the screenshot of DNS on openWRT as well. I manually pointed to itself 192.168.100.5. unless it requires 127.0.0.1?

I tried with huawei DNS of 192.168.100.5 and the openWRT as the nextDNS IP as well. no luck. surprised that all still. worked though to get to the web. I had the nextDNS entry in openWRT already before so I overwrote it.

rebooted all devices: endpoint, huawei, and the openwrt in between changes, but same results

dang thought I had it too!

{
"status": "ok",
"protocol": "UDP",
"destIP": "45.90.xx",
"anycast": true,
"server": "zepto-tyo-1",
"clientName": "unknown"
}

Darth Maul

 

found another location of the network interface status in openWRT just to confirm

my DHCP scope starts at 192.168.100.9

Darth Maul All those screenshots seem to be looking correct. 

In the Huawei is there any dns setting in the Lan page? 

R P M 

i love you!! <3

that. was it. I forgot there were settings only available to see when logged in as the built in telecomadmin account for the ISP tech.  It's funny the user telecomadmin w/ admintelecom for passwd. keeps popping up as breach in Google and to change the pwd. its locked though and can't.

 I'm not super technical, but I have my Security+ for Gov contracts which was required at the time back in 2010. Sounds like I should've taken the Network+ too LOL

 

OMG thank. you again.!!!

 

across all devices:
{
"status": "ok",
"protocol": "DOH",
"
}

I'm sooo glad we got this to work before I head back home because I only visit once a year.I think I will open another thread with. the actual working config to hopefully help someone in the future without having to read my late night mumbo jumbo

Truly appreciate the community help!