Asus XT8 DNS madness

[Digilog]

At the moment the DNS server has changed and it is working as expected with the settings as shown (the issue was resolved after a hard reset). Why would it be more beneficial to switch “Prevent client auto DoH” and “Enable DNSSEC support” to Yes? And would that mean that then I could disable the Dns over Tls as it would honour the wan dns settings? Or I got that wrong??

If you want real security, the router's DNS should be the resolver instead of a caching forwarder.
DNSSEC encrypts the connection between the local DNS in the router and the external DNS.
DOH is used to bypass the system DNS stack which would cause DNS leaks on the client. That is why this activity should be forbidden to perform on your network if you want real security.

 

[Digilog]

I'm using ChatGPT...

It shows in more ways than one.
I don't know which one is dumber, the one that relies on AI to answer anything correctly, or the programmer of AI thinking its going to find the correct answer to everything.

 

[Digilog]

And would that mean that then I could disable the Dns over Tls as it would honour the wan dns settings? Or I got that wrong??

DNS over TLS setting is neither here nor there and depends on the DNS server your DNS server in the router connects to. The software in the router works like this: if the DNS server doesn't support TLS usuyually it will drop to TCP to see if the DNS is going to connect at a different port, then it reverts to UDP to see if DNS is served by UDP.
The only reason why you have this control available to you is if the older DNS systems that you connect to don't use TLS (TCP at port 8953) and have issues with it and times out the connection before the router retries with tcp or udp.

 

[Tech9]

Surprisingly it works fine when changing the dns entries of the providers router. Just tried cloudflare

This ISP provided gateway has some fancy features then...

Keep your current configuration, you don't need anything else to fix.

 

[dave14305]

DNSSEC encrypts the connection between the local DNS in the router and the external DNS.

Does it?

 

[Digilog]

Does it?

it uses a cryptography based on a public key, but its primary use is preventing DNS poisoning. Without this, a hacker can intercept and read the DNS stack query,
Btw most ISP DNS servers are UDP or TCp and almost never TLS and issues with connecting to your ISP is usually because TLS is used. Most will connect TCP or UDP even though UDP is the standard.

 

[ColinTaylor]

DNSSEC encrypts the connection between the local DNS in the router and the external DNS.

DNSSEC digitally signs DNS records but it does not encrypt the connection.

The only reason why you have this control available to you is if the older DNS systems that you connect to don't use TLS (TCP at port 8953) and have issues with it and times out the connection before the router retries with tcp or udp.

Typo? DoT uses port 853 not 8953.

This ISP provided gateway has some fancy features then...

Reading some more about his ISP router I don't think this is particularly "fancy". It appears to use simple DNS redirection for safer browsing, but only when the ISP's DNS servers are selected. This seems to have caused issues for some of the ISP's customers as this behaviour is not well publicised.

 

[Tech9]

Interesting approach, something new and good to know in my case.

Thanks @tournakos for the heads up because I'll need Internet service in Greece soon.

 

[tournakos]

Interesting approach, something new and good to know in my case.

Thanks @tournakos for the heads up because I'll need Internet service in Greece soon.

Although the Greek Tel Commission has made it obligatory that ISPs cannot bind you down to their own router, it is very difficult to avoid using them altogether because fixed line VOIP is available through them and difficult to set up with third party gateways (passwords expire etc). In any case I would go with Cosmote as the quality of the service is ridiculously good both fixed and mobile.

 

[Tech9]

Thank you. I need to research available options first because the place is not exactly in a city. Need internet only.

 

[tournakos]

Thank you. I need to research available options first because the place is not exactly in a city. Need internet only.

There is no fiber optics network outside of the bigger cities, your best bet would alsmot certainly be the below. Outdoor equipment offered is very decent.

https://www.cosmote.gr/cs/cosmote/en/5g-wifi.html