Nest Protect cannot connect with DoT enabled - RT-AX88U 384.18

[john9527]

Thanks and I'll report back if SmartThings still has issues,

It's up.....be interested to see if SmartThings works.....

 

[Calkulin]

I got it installed, rebooted twice already and it still connects fine. The problem is not consistent though, sometimes after a reboot it will connect fine and sometimes it won't until I turn off DoT, so I'll have to keep rebooting to see if the issue happens again,

 

[john9527]

I got it installed, rebooted twice already and it still connects fine. The problem is not consistent though, sometimes after a reboot it will connect fine and sometimes it won't until I turn off DoT, so I'll have to keep rebooting to see if the issue happens again,

Well at least we're off to a good start

 

[wraithdu]

I would really be interested to know what @RMerlin thinks about all this. While it's great we have a workaround, the getdns patch is the correct behavior according to spec. I feel like there has to be a better option.

 

[RMerlin]

I would really be interested to know what @RMerlin thinks about all this. While it's great we have a workaround, the getdns patch is the correct behavior according to spec. I feel like there has to be a better option.

I don't think anything at all, as I haven't looked at it.

I would have a look at the latest getdns and dnsmasq git code to see if there's any fix upstream.

 

[john9527]

I don't think anything at all, as I haven't looked at it.

I would have a look at the latest getdns and dnsmasq git code to see if there's any fix upstream.

I tried the dnsmasq 2.82RC1 snapshot this morning and didn't help.....

 

[wraithdu]

I don't think it's a bug, so I don't expect any upstream "fixes". I was thinking along the lines of config options... but I don't even know what to suggest. I mean, the IoT devices are bad DNS clients that don't follow spec. The only thing that could help and not be an ugly hack would be some kind of response compression on the stubby side, or an option to strip dnssec keys if you know you're not going to use them. Something to legitimately reduce the response size, even though it's just kicking the can down the road.

 

[john9527]

Or you accept the backout as the 'hack' (it was without this change up to Feb of this year). Or you can try contacting each of the IoT mfg and convince them to fix their clients. It wouldn't be the first time a router had to do something to accommodate 'bad' clients. My feeling is that what you are suggesting is worse.

And....I'm not convinced yet that there isn't something else going on. It shows up for me in OpenVPN trying to resolve it's server names. I don't think of OpenVPN as a bad client.

 

[Calkulin]

Just to update, SmartThings has been reconnecting fine every time I've rebooted it or the router with the test firmware and DoT enabled. I'll keep playing with it to see if I can get it to fail but so far, the results look promising,

 

[jsbeddow]

Really interesting discussion here, even if I don't use Nest or SmartThings, I do have an Arlo system. I went through a similar trouble period last fall (2019) with DoT and one of the Arlo firmware updates that broke DNS resolution for the Arlo system for a short period: the temporarory workaround was to exclude the Arlo from the DoT setup (DNS Filter exclusion), until they released a subsequent firmware that fixed it. Nice to see a bit more background on what was the likely root cause.

 

[Kingp1n]

I tried that actually. Removed from my account, full factory reset. It fails when trying to add back. Best guess is the device can't communicate at the last stage when ashociating with the account (P009 0.80 error).

I guessed at the root problem really. Tried it with my laptop as a hotspot and ran Wireshark. I saw a DNS resolution failure to a nest domain from the device, and it resulted in the same error.

Started playing with the router DNS config, and it worked after I disabled DoT. I was able to add back the device and all my others came back online.

Thanks for tip. After I disabled DoT, I was able to reconnect my Nest Connect again.

 

[CriticJay]

Just to update, SmartThings has been reconnecting fine every time I've rebooted it or the router with the test firmware and DoT enabled. I'll keep playing with it to see if I can get it to fail but so far, the results look promising,

Man, I have such short memory ... I participated in this thread, but forgot about it when I recently got a SmartThings device and noticed some minor upstream connection issues. I'm going to flash @john9527 custom 384.18 firmware and ensure my new SmartThings device can connect without issues.

Does anyone have any update on whether this custom fix will get pushed up to RMerlin mainline?

 

[L&LD]

@CriticJay I don't think you have a john9527 supported router to flash to?

 

[Chuckles67]

RT-AC66U-B1
Merlin 384.18
I see my two Nest Protect devices have not connected in 29 days - which I think is when I did a factory reset and installed 384.18. My router is set to use CloudFlare with DoT. Today I reprogrammed the Guest WiFi connection of both Nest Protects through the iOS app, which was reported as successful, however both are still "offline" after thirty minutes. I'm now trying to connect both Nest Protect devices using DNSFilter to custom setting 8.8.8.8 (e.g.: Google DNS).

UPDATE: ~6 hours after the above changes with iOS Nest app continuing to report both devices "offline", then I heard the Nest Protects run a sound check and since that iOS Nest app says both are connected to WiFi.

UPDATE 2: I confirmed this by testing again: using CloudFlare DoT, DNSFilter Custom setting to 8.8.8.8 for Nest Protect devices gets them connected (tested by disabling this DNSFilter setting and saw next day that both Nest Protect device disconnected; then enabling this DNSFilter setting and they reconnected).

 

[CriticJay]

@CriticJay I don't think you have a john9527 supported router to flash to?

AC86U build available here:

Nest Protect cannot connect with DoT enabled - RT-AX88U 384.18

I installed @john9527 's patched build and it seems like the protects can connect to their network with DoT enabled. I'll give it 24 hours to make sure they stay connected and report back. If I have a bit more time tomorrow I may try to remove / re-add a device as well.

www.snbforums.com

 

[Morris]

It may be Google

A Critical Google Assistant Bug Is Causing Nest Devices To De-Link Without Warning

A rather strange issue has reared its head that could impact those who are removing some Google Assistant devices from their network.

hothardware.com

Good Luck,

Morris

 

[wraithdu]

That's an unrelated issue. I think what's going on here has been well identified at this point. The question is how to deal with it.

I've posted on the issue in getdns's project, but no solution has yet been proposed.

Packet size limit exceeded when forwarding back to UDP client from TCP/TLS server · Issue #430 · getdnsapi/getdns

When stubby receives a request from an UDP client without an edns0 option, and it forwards it via TLS or plain TCP, if the reply is larger than 512 bytes, stubby will forward the large reply back t...

github.com

 

[CriticJay]

@john9527 @RMerlin

I don't know how much further testing is needed, but I have used John's custom AC86U build of 384.18 for the last 14-15 hours without any issue. Both Samsung SmartThings and Google Nest IoT are continuing to function normally.

 

[wraithdu]

The getdns dev replied in the issue. He has suggested he's going to add name compression and a config option to disable truncation.

 

[Kingp1n]

@john9527 @RMerlin

I don't know how much further testing is needed, but I have used John's custom AC86U build of 384.18 for the last 14-15 hours without any issue. Both Samsung SmartThings and Google Nest IoT are continuing to function normally.

Thats good to know. My nest connect keeps disconnecting when DoT is enabled. I have to disabled and readd it during this time. Once its back online, I enable DoT again but it will drop out eventually and will show offline again.