Configure DNS and verify router, client and browser

E2Reproduced in a lab VM

Applicable environmentTested

Firmware

OpenWrt

Version

25.12.6

Package manager

apk

Device

x86 VM

Last lab run 2026-10-20Test record

Outcome

You can answer three questions separately:

• Which upstream DNS server does the router use?
• Which DNS server does a client receive from OpenWrt?
• Does the browser bypass the system resolver with DoH?

And you can return to a resolving state after a failed change.

Applicable environment

• OpenWrt 25.12.6, default dnsmasq + odhcpd; 25.12 uses apk, 24.10 uses opkg.
• The inspection commands need no extra packages. If the device runs unbound or https-dns-proxy, check whether it owns port 53 first.
• Menu labels and config keys are close on 24.10, but package commands differ; do not copy apk commands into 24.10.

DNS path and responsibilities

Location	Default owner	What to check
WAN upstream	DHCP/PPPoE client	cat /tmp/resolv.conf.d/resolv.conf.auto
Router resolver	dnsmasq	nslookup openwrt.org 127.0.0.1
LAN advertisement	dnsmasq DHCP option 6 / odhcpd RDNSS	the DNS shown on a client
Browser	system resolver or browser DoH	the browser’s secure DNS setting

Diagnose the layer before replacing DNS servers.

Before you change anything

Router shellBack up the DHCP/DNS config

cp /etc/config/dhcp /etc/config/dhcp.bak.$(date +%F)
uci export dhcp > /tmp/dhcp.before
uci show dhcp | grep -E 'dns|resolv|server|option'

Keep a wired LAN path to LuCI/SSH. Do not make the only management path depend on the DNS you are changing.

ExpectedA backup exists and you know how to restore it.

Minimal steps

Router shellRead the upstream DNS and dnsmasq settings

cat /tmp/resolv.conf.d/resolv.conf.auto
uci show dhcp.@dnsmasq[0]
uci show network.wan | grep -E 'peerdns|dns'

/tmp/resolv.conf.d/resolv.conf.auto is written by the WAN client. Check the actual dhcp.@dnsmasq[0].resolvfile value. If noresolv='1', dnsmasq ignores that file and uses its server list.

ExpectedYou can name the current resolvfile, server and noresolv values.

LuCISet custom DNS on the WAN (safest first change)

Open Network → Interfaces → WAN → Advanced Settings:

1. Clear “Use DNS servers advertised by peer” (peerdns becomes 0).
2. Add the DNS servers you trust under “Use custom DNS servers”, for example 1.1.1.1 and 9.9.9.9.
3. Save and apply, then reconnect WAN if needed.

This briefly interrupts WAN but leaves the LAN DHCP/DNS structure intact, which makes rollback easier.

ExpectedAfter reconnecting WAN, the upstream resolver is the value you set.

Router shellConfirm dnsmasq is listening and loaded the new upstream

netstat -lnp | grep ':53'
/etc/init.d/dnsmasq restart
logread -e dnsmasq | tail -20

If dnsmasq fails to start, stop changing DHCP options. Use the error text to find a syntax error or port conflict.

ExpectedPort 53 is listening and the log has no config error.

LuCICheck the DNS advertised to clients

Open Network → DHCP/DNS → DHCP Server → Advanced Settings and inspect “DHCP Options”. Without option 6, clients normally use the router LAN address as DNS. With option 6, they receive that address directly.

Do not point clients at an address that is not listening on port 53.

ExpectedThe client receives the OpenWrt LAN address, or the explicit option 6 you intended.

Router shellCLI equivalent (optional)

uci set network.wan.peerdns='0'
uci -q delete network.wan.dns
uci add_list network.wan.dns='1.1.1.1'
uci commit network
ifup wan
cat /tmp/resolv.conf.d/resolv.conf.auto

After the change, use logread -e dnsmasq to confirm the new upstream. If clients still receive the old DNS, restart dnsmasq or inspect DHCP option 6.

Expectedresolv.auto shows 1.1.1.1 and queries succeed.

Verify from clients

Router shellCheck A and AAAA on the router

nslookup openwrt.org 127.0.0.1
nslookup -type=AAAA openwrt.org 127.0.0.1

ExpectedBoth queries return an answer without timing out.

ComputerCheck the DNS the client actually received

Linux:

resolvectl status
cat /etc/resolv.conf
nslookup openwrt.org

Windows:

ipconfig /all
nslookup openwrt.org

macOS:

scutil --dns
nslookup openwrt.org

ExpectedThe client DNS matches DHCP/static config and resolves a name.

ComputerCheck whether the browser bypasses the router

Chrome/Edge: chrome://settings/security or “Privacy and security → Security → Use secure DNS”. Firefox: Settings → Privacy & Security → DNS over HTTPS. If DoH is on, the system resolver may not be used at all; that looks like “router DNS did not take effect”.

ExpectedDoH is off during the test, or you know exactly where it points.

ComputerCheck IPv6 resolution and RA/RDNSS

nslookup -type=AAAA openwrt.org
ip -6 route

Do not infer healthy IPv6 DNS from an IPv4 result when the upstream has no IPv6 prefix.

ExpectedAAAA resolves when IPv6 upstream exists; otherwise record the missing condition.

Failure branches and recovery

Pages do not load, but IP ping works

Suspect DNS first:

1. Check the client resolver: resolvectl status, ipconfig /all, or scutil --dns.
2. Check port 53 and dnsmasq logs on the router: netstat -lnp | grep ':53', logread -e dnsmasq.
3. Check browser DoH and disable it temporarily.
4. Check DHCP option 6 for a wrong address.

LuCI/SSH is unreachable

Stop changing DNS. Connect a wired client to LAN, give it a static address in the same subnet, and confirm the gateway is the OpenWrt LAN address. Restore from console or SSH:

cp /etc/config/dhcp.bak.YYYY-MM-DD /etc/config/dhcp
uci commit dhcp
/etc/init.d/dnsmasq restart

If you changed WAN DNS, restore automatic upstream DNS:

uci set network.wan.peerdns='1'
uci -q delete network.wan.dns
uci commit network
ifup wan

WAN DNS changed but clients still use the old resolver

Check whether resolv.auto changed, then whether dnsmasq loaded the new upstream:

cat /tmp/resolv.conf.d/resolv.conf.auto
logread -e dnsmasq | tail -20
/etc/init.d/dnsmasq restart

If resolv.auto did not change, inspect network.wan.dns and peerdns. If clients still receive the old DNS, inspect DHCP option 6 and browser DoH.

dnsmasq does not start

Read the error instead of restarting repeatedly:

logread -e dnsmasq | tail -50
dnsmasq --test

Common causes are another resolver holding port 53, a syntax error, or an unreachable upstream. Restore the backup first, then reintroduce custom settings one at a time.

E2 lab run (2026-10-20)

• Environment: PVE 9.2.2 single NIC; OpenWrt 25.12.6 VM 200; WAN 192.168.50.77/24, LAN 192.168.1.1/24.
• Baseline: resolv.auto was nameserver 192.168.50.1; nslookup openwrt.org 127.0.0.1 returned A/AAAA.
• Custom: peerdns=0 + network.wan.dns=1.1.1.1; resolv.auto changed to nameserver 1.1.1.1; queries still worked.
• Failure: dnsmasq upstream set to unreachable 192.0.2.1; a random .example.com query returned connection timed out; no servers could be reached; deleting noresolv/server and restoring peerdns=1 recovered resolution.
• Client: netns DHCP received 192.168.1.116/24, DNS 192.168.1.1; dig @192.168.1.1 openwrt.org worked; ping 192.168.50.1 worked.
• Not tested: browser DoH, IPv6 upstream/RA/RDNSS, physical LAN clients, long-run stability.

Sources and review

• This page has an E2 lab reproduction; browser DoH and IPv6 upstream are still untested and must not be described as verified.
• Evidence: docs/dns-e2-run.md and tests/recipes/dns-25.12-x86.md.
• Update testedVersions and lastVerifiedAt when the menu or version changes; do not put 24.10 opkg commands into a 25.12 procedure.

Test recordStatus: E2 lab reproduced

Environment

PVE 9.2.2 single NIC; OpenWrt 25.12.6 VM 200; netns DHCP client

Recipe

tests/recipes/dns-25.12-x86.md

Date

2026-10-20

Result

WAN DNS 192.168.50.1 → 1.1.1.1 applied; bad upstream timed out; recovery worked; client DHCP DNS 192.168.1.1, resolution OK

E2 lab reproduced; not independently reviewed or tested on a physical network. E3 still needs real hardware.

Sources

• OpenWrt DHCP and DNS configuration
• OpenWrt dnsmasq
• OpenWrt 25.12 release notes
• OpenWrt apk package manager