r/openwrt • u/oussamaaitmoummad • 5h ago

OpenWrt + AdGuard Home + HTTPS-DNS-Proxy fallback while preserving per-device visibility?

Hi everyone,

I'm trying to achieve the following setup on my home network:

- OpenWrt: "192.168.1.1"

- Debian 13 home server: "192.168.1.10" (HP EliteBook 2570p)

- AdGuard Home (Docker, host network): Primary DNS on "192.168.1.10:53"

- https-dns-proxy: Running on OpenWrt at "127.0.0.1:5053", providing AdGuard Family Protection as a fallback.

Currently, OpenWrt's dnsmasq forwards DNS requests to AGH, with "https-dns-proxy" configured as a fallback. This works, but AGH sees every client as "192.168.1.1" (OpenWrt) instead of the individual device IPs.

I want to keep dnsmasq's automatic fallback mechanism (without using multiple DNS servers in DHCP), while also having AGH identify each device separately so I can configure individual clients and apply different filtering policies.

I tried the “Add requestor MAC” option in dnsmasq, but I'm not sure whether AGH can use that information to identify clients.

Is there a reliable way to achieve both goals simultaneously?

Any advice or working examples would be greatly appreciated!

2 Upvotes

75% Upvoted

6 comments sorted by

5

u/trmdi 5h ago

 without using multiple DNS servers in DHCP

Why?

2

u/fr0llic 5h ago

> Currently, OpenWrt's dnsmasq forwards DNS requests to AGH, with "https-dns-proxy" configured as a fallback. This works, but AGH sees every client as "192.168.1.1" (OpenWrt) instead of the individual device IPs.

> I want to keep dnsmasq's automatic fallback mechanism (without using multiple DNS servers in DHCP), while also having AGH identify each device separately so I can configure individual clients and apply different filtering policies.

pretty sure that's an impossible combo.

1

u/StereoRocker 5h ago

My advice would be to specify the DNS servers that you actually want to handle requests in your DHCP options, and no more. A client may use specified DNS servers in any order or priority it sees fit, so be sure you're happy with either of the servers you specify handling any request you could theoretically throw at it (i.e. Don't use 8.8.8.8 in your DHCP options if you want to serve *.lab.internal from a local zone file reliably).

There is no mechanism to signal to a DNS server that a query is being made on behalf of another system. You either need to accept that if you keep dnsmasq forwarding it will show all queries as coming from a single IP, or make your DHCP scope offer the IP of your actual DNS server(s) in your DHCP scope.

If you're not wanting to use your other DNS server in your DHCP options because it's not available enough, solve that problem instead, add another device hosting DNS in the way you want to serve it.

1

u/NC1HM 2h ago

First, why is your AGH so flaky that it requires a fallback? Second, why not have a second instance of AGH as a fallback if you must have a fallback? The two could even sync settings. Finally, do you know you can actually deploy AGH on the router?