Repository: nextdns/nextdns

Issue #711: Must manually input iptables rules on UDMP (UniFi Dream Machine Pro)
Created: 2022-07-25T21:09:09Z
Context

CLI Version: nextdns version 1.37.11
IPv4 and IPv6 native (via Prefix Delegation and RA)
Platform:  UDM Pro

Device information summary:
   Subsystem ID: ea15
   Family: UniFi Dream Machine (UDM)
   Model: UniFi Dream Machine Pro (UDM-Pro)
   Firmware: 1.12.22 (1.12.22)

Expected
Installing on UbiOS should automatically start routing DNS to NextDNS over DoH
Actual
nextdns service was started and running, but DNS resolution was going to my ISP instead
Debug Steps
I installed NextDNS via the UniFi NextDNS wiki without any errors. Once installed, the service said it was installed and nextdns status showed running - nextdns log had no errors
When viewing my.nextdns.io I noticed the status showed red and then sometimes went green as configured properly. When viewing logs, no traffic was coming through regularly, however. I verified my dns server handed out by DHCP pointed to my UDM / router. When it went red, it was showing that it was using my ISP's NS which was a little fishy since only the UDM should be using that... After reviewing the go setup code for ubi (https://github.com/nextdns/nextdns/blob/master/router/ubios/setup.go#L97-L118) I saw iptables were used to reroute DNS traffic over to nextdns so I went to verify this. Surprisingly, nothing was there except the ipv4 chain... so I restarted the service, and there still were no rules. I then proceeded to create the ipv4 rules, ipv6 chain, and ipv6 rules manually over ssh.
After setting these rules, it instantly worked on all of my devices leading me to believe there is something funky going on in the go code.
Workaround
Manually running the following commands on the UDM / Gateway
iptables -t nat -N NEXTDNS
iptables -t nat -I PREROUTING 1 -m addrtype --dst-type LOCAL -j NEXTDNS
iptables -t nat -A NEXTDNS -p udp -m udp --dport 53 -j DNAT --to-destination 127.0.0.1:5553
iptables -t nat -A NEXTDNS -p tcp -m tcp --dport 53 -j DNAT --to-destination 127.0.0.1:5553
# if using IPv6 run the following too
ip6tables -t nat -N NEXTDNS
ip6tables -t nat -I PREROUTING 1 -m set --match-set UBIOS6ADDRv6_br0 dst -j NEXTDNS
ip6tables  -t nat -A NEXTDNS -p udp -m udp --dport 53 -j REDIRECT --to-port 5553
ip6tables  -t nat -A NEXTDNS -p tcp -m tcp --dport 53 -j REDIRECT --to-port 5553

I also could get NextDNS resolution working if I changed the WAN DNS settings in the control panel to use the given IPs in the NextDNS setup, but this would not run through DoH. This is how I got my UniFi gear to resolve through NextDNS though, as they wouldn't happily use the gateway's proxy.

Duplicate issue #747: UDM Pro IPv6 setup only enables first LAN interface
Created: 2022-10-15T00:17:54Z
Context

CLI Version: 1.37.11
Platform: ubios

<Describe the bug>
The fix for #422 appears to only bind NextDNS CLI to the first LAN interface on the system and only sets up ip6tables to redirect port 53 to nextdns on port 5555 on the first LAN interface IPv6 GUA. Other networks defined on the controller IPv6 DNS continues to be answered by dnsmasq.
On my Ubiquity setup I have a LAN network (used only for Unifi devices), Comp, IoT, and Guest networks. UDM's DHCP6 and RA server hands out the IPv6 DNS address to match the UDM's interface IP in that subnet. From the LAN subnet, DNS queries to the UDM's router address are intercepted by iptables and routed to NextDNS. On the other networks, queries to the UDM's address in that subnet are answered by dnsmasq and not sent to the NextDNS daemon. Further, the way iptables are being set up, DNS requests to the LAN interface IPv6 address from other subnets are dropped, so changing DHCP6 and RA configuration to hand out the LAN interface address instead of the subnet's UDM interface address is not an option as a workaround.
IPv4 does not have this issue. NextDNS binds to all interfaces in the system and iptables are configured to redirect 53 to 5555 on all interfaces.

Closing comment (2022-12-01T20:00:36Z): May be a duplicate of #711 as well. I have the same issue so every time I restart my UDMP I connect via SSH and run the ip6tables commands to make it operate as expected.