Trying to use Quad9 with new ASUS RT-AX88U Pro

[bluzfanmr1]

Sorry if this is going too far off the original post but I found this listing of public DNS servers in the US. It can also be used to find foreign country locations for those outside the US.

https://dnschecker.org/public-dns/us

 

[TheLyppardMan]

Nothing is wrong with it. @TheLyppardMan sold his by mistake and wanted it back.

I forgot to mention that I also had problems with trying to set up a VPN with the FRITZ!Box. It only had the choice of IPsec, but that wouldn't work on my Android mobile (I did read somewhere that it's not currently compatible with the latest Android OS). They have now made Wireguard an option, but it's not yet been officially released on all models, although one does have the option of trying beta firmware. Also, there's no SNMP, which is what I need for Networx. The RT-AX88U Pro does have SNMP available via the GUI, but I think I'll need to reinstall the script I used before as the built-in SNMP doesn't want to work with Networx, so without that, my only option would be to switch on UPnP (it does work with that).

 

[Jonnny]

I would leave the setting above "Prevent auto client DoH" to default No though.

Seems like with the new router you have started a new playing with the settings cycle and I expect more threads to come.

Hi @Tech9,

Can you explain why you recommend putting "NO"?

I have the same configuration as @TheLyppardMan, but use Google DNS and and the option "Prevent client auto DoH = YES". More DNS Director enable, Global Redirection = Router. Some devices lan redirect to CloudForge DNS (1.1.1.3).

Any recommendation to use CloudForge DNS as primary? I have nothing against it. But on the main router I use Google's DNS, in others use CloudForge. I'm also thinking of changing the main one, because when I do a test on the DNS Leak site, more and more servers of China have been appeared from Google DNS.

Thanks.

 

[Tech9]

Can you explain why you recommend putting "NO"?

Fail safe. This is the default setting for a reason. If you run the DNS tests above you'll see DNSSEC validation working well with default settings.

Any recommendation to use CloudForge DNS as primary?

Cloudflare perhaps? Use whatever you like better. There is a choice of free public DNS servers. See what's faster around you and fits your needs.

 

[Jonnny]

Fail safe. This is the default setting for a reason. If you run the DNS tests above you'll see DNSSEC validation working well with default settings.

The default setting is not = AUTO?

Right, I look for definitions with stability + security (balance), because 100% security does not exist...

Cloudflare perhaps? Use whatever you like better. There is a choice of free public DNS servers. See what's faster around you and fits your needs.

Yes I know, it can also vary from ISP, city, region, country. So nothing like carrying out a test by ourselves in "our environment".

Thanks.

 

[Tech9]

The default setting is not = AUTO?

Read carefully again:

I would leave the setting above "Prevent auto client DoH" to default No though.

Did I say once I eat mandalorians and steal their armor?

 

[TheLyppardMan]

Fail safe. This is the default setting for a reason. If you run the DNS tests above you'll see DNSSEC validation working well with default settings.



Cloudflare perhaps? Use whatever you like better. There is a choice of free public DNS servers. See what's faster around you and fits your needs.

The default setting on my new ASUS RT-AX88U Pro was "auto" and I haven't changed it so far as I don't know what the difference is. I do remember that I did try using "yes" on my previous router and I found I had some problems (I can't remember the details but I think I had trouble accessing some web sites), so I won't be using that option again. So my only consideration is whether to use "no" as per your suggestion or leave it on auto. Can you explain the difference for me (in simple terms) so that I can make an informed choice?

 

[Piotrek]

RT-AX86S, Firmware Version:3.0.0.4.388_22525

 

[Quoc Huynh]

The default setting on my new ASUS RT-AX88U Pro was "auto" and I haven't changed it so far as I don't know what the difference is. I do remember that I did try using "yes" on my previous router and I found I had some problems (I can't remember the details but I think I had trouble accessing some web sites), so I won't be using that option again. So my only consideration is whether to use "no" as per your suggestion or leave it on auto. Can you explain the difference for me (in simple terms) so that I can make an informed choice?

In my Asus RT-AX88U with newly loaded Merlin 388.2 firmware, the default setting of "Prevent client auto DoH" is also "Auto" Maybe I will change to "No" after DNS check tools confirming of no DNS leakage.

 

[Tech9]

We have some misunderstanding here. This:

Located above DoH setting. Perhaps "the three settings above" is more clear. DoH is Auto by default, but doesn't work for many clients. I believe it's Firefox browser specific when they switched to DoH. Apple devices do DoH via iCloud Private Relay regardless if the service is not blocked.

 

[Unetwork]

Hi guys,
below is my configuration.
The prevent auto DOH client is on Auto by default for me too. and everything works since more than 260 days (AX88U firmware 386.8 and i use firefox)
I never understood why some people leave the ISP's DNS server on automatic at the beginning of the options. Personally I forced the cloudflare one.
It seems to me that if I let the ISP's dns be retrieved automatically when the router starts up, I have no internet.
For DoT options, no problem.

 

[Jonnny]

Read carefully again:

Now it's clear what caused the confusion, the word "above" being left in limbo and the focus only on the description of the option "Prevent auto client DoH" in ON/OFF/AUTO.

English is not my native language, sorry.

Did I say once I eat mandalorians and steal their armor?

You don't need to eat Mandalorians as it can cause indigestion. Besides, I think there is space in this world for everyone including species

Now back to the topic, I turned off both options:

Enable DNSSEC support = No
Validate unsigned DNSSEC replies = No

Tested on 3 different sites, as a result they got DNSSEC supported .

https://wander.science/projects/dns/dnssec-resolver-test/

http://conn.internet.nl/connection/

http://0skar.cz/dns/en/

https://dnscheck.tools/

My settings:

 

[Tech9]

You can leave Rebind protection to default No as well. The upstream servers won't resolve non-routable addresses anyway.

 

[Jonnny]

You can leave Rebind protection to default No as well. The upstream servers won't resolve non-routable addresses anyway.

Since I have this option enable, alerts have been appearing in the log like this:

dnsmasq[2526]: possible DNS-rebind attack detected:

Now I don't know if it's a false alarm or simply because the option is active, referring to what you mentioned above...

 

[Tech9]

False alarm because of option enabled.

 

[TheLyppardMan]

Excellent discussion folks. I think I've learnt some useful stuff today. I've changed my settings as per Tech9's recommendations before my feeble short-term memory kicks in!

 

[SomeWhereOverTheRainBow]

Two more:

dnscheck.tools - check your dns resolvers

A tool to test for DNS leaks, DNSSEC validation, and more

dnscheck.tools

DNS Leak Test

The DNS Leak Test is a tool used to determine which DNS servers your browser is using to resolve domain names. This test attempts to resolve 50 randomly generated domain names, of which 25 are IPv4-only and 25 are IPv6-only.

browserleaks.com

Quad9 often takes me on a journey across the USA. Sometimes we may visit exotic destinations.

Same, sometimes I am using Miami servers, other times I am using them in New York, George, or Texas. I am in Florida, you would figure all my request would be hitting Miami, but apparently quad9 load balances across all servers, or it is using some randomized round Robin algorithms. That must be how it ensures each users privately load balanced. I think I saw some of my queries passing @Tech9 On their return trip home, but I cannot say for sure.

 

[TheLyppardMan]

Same, sometimes I am using Miami servers, other times I am using them in New York, George, or Texas. I am in Florida, you would figure all my request would be hitting Miami, but apparently quad9 load balances across all servers, or it is using some randomized round Robin algorithms. That must be how it ensures each users privately load balanced.

My list of IT Tools in my Google Chrome bookmarks is getting longer and longer (but it's very useful for me as a reminder of how to do stuff).

 

[ColinTaylor]

The upstream servers won't resolve non-routable addresses anyway.

Yes they will (or at least most of them do). That's the entire point of having the rebind protection option.

 

[SomeWhereOverTheRainBow]

Yes they will (or at least most of them do). That's the entire point of having the rebind protection option.

I have seen some of those upscream local requests, they can be ugly.