DNS lookup on local machine not working via UDP (but TCP works fine)

[alichaudry]

Using AdGuard Home v0.106.1 via docker. Port 53 (tcp + udp) and port 80 (tcp) have been tied to all interfaces on the host.

$ docker container ls
CONTAINER ID        IMAGE                  COMMAND                  CREATED             STATUS              PORTS                  NAMES
51b41c2cbc65        adguard/adguardhome    "/opt/adguardhome/Ad…"   34 minutes ago      Up 34 minutes       67-68/udp, 443/udp, 443/tcp, 853/tcp, 3000-3001/tcp, 784/udp, 0.0.0.0:53->53/tcp, 0.0.0.0:53->53/udp, 5443/udp, 5443/tcp, 0.0.0.0:7979->80/tcp   adguardhome

When I perform a DNS lookup on this host machine via TCP it works fine, but not via UDP:

$ dig @127.0.0.1 google.com +tcp

; <<>> DiG 9.16.1-Ubuntu <<>> @127.0.0.1 google.com +tcp
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38848
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;google.com.                    IN      A

;; ANSWER SECTION:
google.com.             115     IN      A       172.217.10.142

;; Query time: 4 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sun May 02 19:11:29 EDT 2021
;; MSG SIZE  rcvd: 55

$ dig @127.0.0.1 google.com +notcp

; <<>> DiG 9.16.1-Ubuntu <<>> @127.0.0.1 google.com +notcp
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

Ports seem to be open on the host machine:

$ sudo ss -tulpn | egrep 'docker'
udp    UNCONN   0        0                       *:53                   *:*      users:(("docker-proxy",pid=2997542,fd=4))

tcp    LISTEN   0        4096                    *:7979                 *:*      users:(("docker-proxy",pid=2997498,fd=4))

tcp    LISTEN   0        4096                    *:53                   *:*      users:(("docker-proxy",pid=2997512,fd=4))

For some bizarre reason, hitting this host from another machine on the network works fine (that is, DNS resolution on the network via this DNS server works well):

$ dig @192.168.1.115 google.com +notcp

; <<>> DiG 9.11.3-1ubuntu1.15-Ubuntu <<>> @192.168.1.115 google.com +notcp
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23376
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;google.com.                    IN      A

;; ANSWER SECTION:
google.com.             50      IN      A       172.217.10.142

;; Query time: 5 msec
;; SERVER: 192.168.1.115#53(192.168.1.115)
;; WHEN: Sun May 02 19:12:33 EDT 2021
;; MSG SIZE  rcvd: 55

Although I'm by no means an expert at network debugging, I've perused the firewall rules in great detail but nothing really jumps out at me (here are some of the port 53 rules):

# nat rules
$ sudo iptables -L -v -n -t nat | grep '\b53\b'
    0     0 MASQUERADE  tcp  --  *      *       172.23.0.3           172.23.0.3           tcp dpt:53
    0     0 MASQUERADE  udp  --  *      *       172.23.0.3           172.23.0.3           udp dpt:53
    1    60 DNAT       tcp  --  !br-874a4918a51f *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53 to:172.23.0.3:53
58630 4218K DNAT       udp  --  !br-874a4918a51f *       0.0.0.0/0            0.0.0.0/0            udp dpt:53 to:172.23.0.3:53

# firewall rules
$ sudo iptables -L -v -n | grep '\b53\b'
    1    60 ACCEPT     tcp  --  !br-874a4918a51f br-874a4918a51f  0.0.0.0/0            172.23.0.3           tcp dpt:53
58687 4222K ACCEPT     udp  --  !br-874a4918a51f br-874a4918a51f  0.0.0.0/0            172.23.0.3           udp dpt:53

I don't think it's the firewall as I stopped the server and ran a UDP listener and tcpdump on port 53 and sent quite a few msgs on this port (all of them got picked up by both tcpdump as well as the netcat listener).

Any tips would be greatly appreciated!

[ameshkov]

Tbh this looks like a Docker issue, not sure we can do anything with that.

Consider running AGH container with --net host.