AdGuard DNNSEC vs router DNSSEC settings on

[privacyguy123]

I imagine having both is redunant/unncessary CPU work. Which settings are "better" ... in Adguard or router settings panel?

 

[Morris]

Are you talking about the WAN tab on the left?

 

[privacyguy123]

Are you talking about the WAN tab on the left?

Yep.

DNSSEC enabled here:

Vs here:

 

[Morris]

I don't recognize the second page. Is that an add on?

 

[privacyguy123]

I don't recognize the second page. Is that an add on?

Adguard Home addon yes!

 

[Morris]

Try asking on the Asuswrt-Merlin AddOns forum

 

[Tech9]

in Adguard or router settings panel

Depending on how you installed AdGuard Home (remember the questions what do you want to use AdGuard Home for?) the WAN settings are used for router's needs only or for nothing. They basically don't matter because AGH is doing your queries upstream. I would leave in WAN settings everything on No and in AGH settings select Enable EDNS client subnet only. Test your DNS (link below) and you'll see DNSSEC authenticated responses anyway.

dnscheck.tools - check your dns resolvers

A tool to test for DNS leaks, DNSSEC validation, and more

dnscheck.tools

 

[privacyguy123]

Depending on how you installed AdGuard Home (remember the questions what do you want to use AdGuard Home for?) the WAN settings are used for router's needs only or for nothing. They basically don't matter because AGH is doing your queries upstream. I would leave in WAN settings everything on No and in AGH settings select Enable EDNS client subnet only. Test your DNS (link below) and you'll see DNSSEC authenticated responses anyway.

dnscheck.tools - check your dns resolvers

A tool to test for DNS leaks, DNSSEC validation, and more

dnscheck.tools

Interesting, I've never had anybody suggest to turn that setting on in AdGuard, what does it do?

It's safe to have DNS rebind off in the WAN setting panel? Or it it doing nothing as AdGuard overwrites this section entirely?

 

[Tech9]

I told you how to set it and how to test it. If you think I'm suggesting you unsafe settings - do whatever you feel is better. About EDNS - it may help with better routing telling the upstream resolver where are you physically located. I don't know what upstream resolvers you use in AGH settings.

 

[privacyguy123]

DNSSEC is working fine, I'm just attempting to understand the settings in my new router.

 

[Tech9]

I'm just attempting to understand the settings in my new router

I have a different advice about this:

- don't change the defaults before you understand what the settings do
- don't copy someone else's settings, they may not apply to your configuration

 

[privacyguy123]

I have a different advice about this:

- don't change the defaults before you understand what the settings do
- don't copy someone else's settings, they may not apply to your configuration

I've ran Adguard for years on a Pi, this is a different environment I need to learn. I know AG Ui in and out, (minus that EDNS toggle) how they interact with ASUS in built settings though? No idea.

 

[Tech9]

AdGuard Home is a DNS server with blocking options and UI. It replaces the built-in Dnsmasq. Your router has limited resources and if you push AGH blocking too much with millions entries in blocklists it will slow down or may even make the router unstable. The hardware inside routers is RPi-like with about 0.5GB RAM available after boot (1GB RAM models). I don't know what model router you have. If you use common USB stick for Entware/Swap - you are looking for trouble already, Your router is as reliable as the USB stick. USB sticks often fail from heat or constant writes.

 

[privacyguy123]

AdGuard Home is a DNS server with blocking options and UI. It replaces the built-in Dnsmasq. Your router has limited resources and if you push AGH blocking too much with millions entries in blocklists it will slow down or may even make the router unstable. The hardware inside routers is RPi-like with about 0.5GB RAM available after boot (1GB RAM models). I don't know what model router you have. If you use common USB stick for Entware/Swap - you are looking for trouble already, Your router is as reliable as the USB stick. USB sticks often fail from heat or constant writes.

Is there a standard of USB stick you'd recommend? I have sa SanDisk Cruzer Blade 8GB in there.

 

[Tech9]

Is there a standard of USB stick you'd recommend?

No, I recommend something like this:

USB recommendations for Diversion / Skynet?

Looking for recommendations for USB drives to be used for scripts / swap running Diversion / Skynet on an AX86U pro. Not interested in anything large-ish, as I only use this drive for running the amtm scripts and not for NAS in any way. Try to keep my io to a minimum since it pushes the CPU so...

www.snbforums.com