Enabling DNS-over-TLS Breaks My Emporia Smart Plug Connection

[Tech9]

The basic unbound install/ setup from amtm would be consider a "resolver" setup?

I remember you have both options, but I need to look at the script again. The easiest check - click on the link below and if you see some upstream DNS servers - forwarder; if you see your own external IP address assigned by your ISP's DHCP - resolver.

DNS Leak Test

The DNS Leak Test is a tool used to determine which DNS servers your browser is using to resolve domain names. This test attempts to resolve 50 randomly generated domain names, of which 25 are IPv4-only and 25 are IPv6-only.

browserleaks.com

I don't use IPV6.

Good. You obviously don't need it.

 

[sfx2000]

Thanks. I came across this thread where someone dug deeper with a similar issue on Wyze cameras. My guess is the same thing is happening here, the Emporia devices can’t handle the responses they are receiving from the router.

Wondering if those plugs have DNS hard-coded - that could be a problem with some of the scripts that are wrapped around DNS over TLS due to folks using VPN to geo-unlock content regarding DNS leaks...

 

[Kingp1n]

I remember you have both options, but I need to look at the script again. The easiest check - click on the link below and if you see some upstream DNS servers - forwarder; if you see your own external IP address assigned by your ISP's DHCP - resolver.

DNS Leak Test

The DNS Leak Test is a tool used to determine which DNS servers your browser is using to resolve domain names. This test attempts to resolve 50 randomly generated domain names, of which 25 are IPv4-only and 25 are IPv6-only.

browserleaks.com

Good. You obviously don't need it.

I appreciate it. Just checked and it's currently setup as a resolver.

 

[Tech9]

Keep it simple @Kingp1n. Your "gaming" router is weaker that RPi with just enough RAM to run core services. You don't need all other scripts within amtm. You probably need none on a home network. The fact something is available doesn't mean you must have it installed or running.

 

[kngklla]

Wondering if those plugs have DNS hard-coded - that could be a problem with some of the scripts that are wrapped around DNS over TLS due to folks using VPN to geo-unlock content regarding DNS leaks...

I'd think it would be better if they did - then they would bypass the router's DNS and go direct. As far as I know, the router isn't stopping clients from using whatever DNS they want. At least I haven't knowingly configured anything like that.

 

[Kingp1n]

Keep it simple @Kingp1n. Your "gaming" router is weaker that RPi with just enough RAM to run core services. You don't need all other scripts within amtm. You probably need none on a home network. The fact something is available doesn't mean you must have it installed or running.

Thanks for that...I had to update my signature.

In the past i was using alot of those addon scripts but I'm currently using Diversion lite, Skynet, Unbound & FlexQoS. Maybe still a little too much for the routers RAM.

 

[Tech9]

Your Internet experience will be perhaps better is you remove the rest as well. Or offload Unbound + Pi-hole on RPi. I don't know what you need IP blocker and QoS for. You perhaps have >400Mbps ISP line. Your firewall is already blocking all unsolicited connections by default.

 

[sfx2000]

I'm currently using Diversion lite, Skynet, Unbound & FlexQoS.

In the process of debugging things - maybe remove those script add-ons and factory reset...

 

[iDontLikeComputers]

I’ve been struggling with keeping another IoT device, a Schlage Encode smart lock, connected. I think that I’ve finally narrowed down the issue to turning DNS-over-TLS on in my ASUS RT-AX3000 router’s settings. I agree that this makes no sense: the device should be querying the router, and the router is doing DoT but returning the DNS resolution back over regular DNS to the device. It’s super disappointing and confusing that this is the issue. I have no idea how to debug it or if it’s even fixable. The lock would constantly lose connection; at least, it would think it’s disconnected even though the router clearly shows it connected to WiFi and assigned an IP address, which was my hint that maybe it just wasn’t communicating upstream. I even briefly tried using NextDNS to intercept and display its queries, but that didn’t give me any useful information.

 

[doczenith1]

Thanks. I came across this thread where someone dug deeper with a similar issue on Wyze cameras. My guess is the same thing is happening here, the Emporia devices can’t handle the responses they are receiving from the router. I’m not sure which vendor is really to blame, but I imagine it’s the IoT devices running insufficient software:

DNS over TLS support

I don’t think that Wyze really pays attention to complaints. Calling support is like talking to a brick wall where they run the same script over and over again. I agree DNS over TLS causes Wyze cams to drop ‘offline’ from the perspective of the app the thumbnails say offline, but when you click...

forums.wyze.com

I didn't click into the Wyze link but I've been using both Wyze cameras and DoT for 2+ years now without issue.

 

[kngklla]

I didn't click into the Wyze link but I've been using both Wyze cameras and DoT for 2+ years now without issue.

Interesting. Who are you using for DoT and how do you have it configured?

Thanks

 

[truglodite]

https://support.wyze.com/hc/en-us/articles/360026245231-Wyze-Cam-RTSP

...then you just need a browser, but a cam server with lots of platter space to spare is usually helpful.

[edit: I don't actually have wyze cameras, but I do have a few Dahua cams with RTSP and an older x86 PC for a camera server. If you have a nas it may have software that makes it easy to setup a cam server. It is a cloud free solution with openvpn server that works great. I'm not a big fan of cloud computing.]

 

[doczenith1]

Interesting. Who are you using for DoT and how do you have it configured?

Thanks

I'm using Cloudflare via the WAN tab in the Asuswrt-Merlin firmware. I have DNSFilter set on the router to re-route all DNS queries through Cloudflare. I'm IPV4 only also if that might matter.

 

[kngklla]

I'm using Cloudflare via the WAN tab in the Asuswrt-Merlin firmware. I have DNSFilter set on the router to re-route all DNS queries through Cloudflare. I'm IPV4 only also if that might matter.

Ah OK. I am using the OEM firmware. Maybe certain firmware cameras aren't impacted. In the end it seems that the devices I have can't handle the replies that they are receiving from the router. I've disabled DoT for now, maybe I'll look into it again the future when I have more time to spend on it.

Thanks