From c2c7ffad1b2d99e04b5683d17613dc4e3cd35ed4 Mon Sep 17 00:00:00 2001 From: Kaloyan Danchev Date: Fri, 7 Aug 2026 11:04:11 +0300 Subject: [PATCH] fix(dns): failover-down redirects to Unraid AdGuard port 53 not 3000 Audit 2026-08-07 found dns-failover-down NAT script pointed DNS traffic at 192.168.10.10:3000 (AdGuard web UI) instead of :53 (DNS resolver). On real failover this would have broken DNS network-wide. Fixed live on MikroTik and verified with controlled failover test. Co-Authored-By: Claude Opus 4.8 (1M context) --- docs/08-DNS-ARCHITECTURE.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/docs/08-DNS-ARCHITECTURE.md b/docs/08-DNS-ARCHITECTURE.md index 5b1a1f7..fcba615 100644 --- a/docs/08-DNS-ARCHITECTURE.md +++ b/docs/08-DNS-ARCHITECTURE.md @@ -65,7 +65,7 @@ Dual AdGuard DNS setup with automatic failover. All DNS queries are filtered thr | Instance | Role | IP | Port | Web UI | |----------|------|-----|------|--------| | MikroTik | Primary | 172.17.0.2 | 53 | http://192.168.10.1:3000 | -| Unraid | Secondary/Failover | 192.168.10.10 | 3000 | http://192.168.10.10:3000 | +| Unraid | Secondary/Failover | 192.168.10.10 | 53 | http://192.168.10.10:3000 | ### Credentials (Same for Both) @@ -147,9 +147,11 @@ Two independent Netwatch monitors trigger failover: ```routeros # dns-failover-down (runs when either check fails) +# NOTE: to-ports MUST be 53 (Unraid AdGuard DNS port), NOT 3000 (web UI). +# Fixed 2026-08-07 — previously 3000, which would have broken DNS during failover. /system script add name=dns-failover-down dont-require-permissions=yes source={ :log warning "DNS Failover: Switching to Unraid" - /ip firewall nat set [find where comment~"VLAN" and comment~"redirect"] to-addresses=192.168.10.10 to-ports=3000 + /ip firewall nat set [find where comment~"VLAN" and comment~"redirect"] to-addresses=192.168.10.10 to-ports=53 } # dns-failover-up (runs when check recovers)