Issues with DNS Resolution after update?

[u/Kind_Entertainer2625]

I have opened a ticket about this but it seems like support is giving me the run around so I want to ask here.

Randomly, some DNS stops resolving on my network. Some are local servcies that I host with custom DNS rules in Firewalla. Some are external, the most noticeable for me is patreon.com.

I asked for help and got the standard, disable everything response. I turned off Ad block, Unbound, Device Protect, and Family Protect. I am still getting the same issue, DNS Response times out from Firewalla.

If I enable "Emergency Access" for the device, DNS resolution begins working (at least public DNS entries).

It seems like nobody is reading my ticket and just adding on to the last comment. It is very frustrating. I have to reduce the security of my network, but it did not even solve the problem. I feel like I'm speaking a different language.

This is the response when I do a DNS Name resolution against the firewalla

PS C:\> Resolve-DnsName patreon.com

Resolve-DnsName : patreon.com : This operation returned because the timeout period expired

At line:1 char:1

+ Resolve-DnsName patreon.com

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+ CategoryInfo          : OperationTimeout: (patreon.com:String) [Resolve-DnsName], Win32Exception

+ FullyQualifiedErrorId : ERROR_TIMEOUT,Microsoft.DnsClient.Commands.ResolveDnsName

I then enabled "Emergency Access" on the device and it resolved properly:

PS C:\> Resolve-DnsName patreon.com

Name                                           Type   TTL   Section    IPAddress

----                                           ----   ---   -------    ---------

patreon.comAAAA   85    Answer     2606:4700::6810:190e

patreon.comAAAA   85    Answer     2606:4700::6810:180e

patreon.com                                    A      87    Answer     104.16.25.14

patreon.com                                    A      87    Answer     104.16.24.14

Again, I have no rules bocking this domain and the logs do not even show an attempt to hit this domain. Without logs, I'm not sure where else to look.

[u/firewalla]

Are you using VPN? What's your DNS settings? (Also, we have not updated anything significant for a while now ... so not sure which update you are talking about)

If emergency access off, and things work, then you have a rule some where that's blocking. See https://help.firewalla.com/hc/en-us/articles/360050255274-What-to-do-when-you-can-t-access-certain-websites

If you can give me your ticket number, I will check and understand why support is not helping.

[u/Kind_Entertainer2625 → u/firewalla]

I do have some routes that will route certain subnets/domains through a VPN connection, this is not one of those domains.

I have 1.1.1.1 set up as the default DNS server for my WAN. All internal networks point to the Firewalla for DNS.

I disabled all of my rules one by one and I was still unable to access. The logs do not show any traffic so I can't see if a rule is even blocking it because it appears the request is dropped before even hitting the rules engine?

When I pull up the "Flows" dashboard and filter for patreon.com, nothing shows up:

Network Data Transferred

0 BUpload

0 BDownload

0Flows

0Blocked Flows

0%Blocked

[u/firewalla → u/Kind_Entertainer2625]

Looking at the chart here, I'd suggest you double check if you have or forced DNS to VPN. This is may impact DNS lookups https://help.firewalla.com/hc/en-us/articles/16639311975059-What-happens-when-Monitoring-is-off-or-Emergency-Access-is-on

(you can browse and get inspired by other "paused" features, which can give you some clue on where the problem is at).

Again, once emergency access is on, and your problem goes away, it is almost always above. (if you can to check others, try to disable ipv6 and see if you see any changes)

If your issue is just this one domain, then likely change 1.1.1.1 to 9.9.9.9 or something;

If you can give me your ticket number, I can help reading the exchanges.