jazzymc/infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(dns): failover-down redirects to Unraid AdGuard port 53 not 3000
ci/woodpecker/push/woodpecker Pipeline was successful
Details

Browse Source 
Audit 2026-08-07 found dns-failover-down NAT script pointed DNS traffic
at 192.168.10.10:3000 (AdGuard web UI) instead of :53 (DNS resolver).
On real failover this would have broken DNS network-wide. Fixed live on
MikroTik and verified with controlled failover test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Kaloyan Danchev
2026-08-07 11:04:11 +03:00
parent 83bc6f4e1d
commit c2c7ffad1b
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/08-DNS-ARCHITECTURE.md
+4 -2
View File
@@ -65,7 +65,7 @@ Dual AdGuard DNS setup with automatic failover. All DNS queries are filtered thr
| Instance | Role | IP | Port | Web UI | | Instance | Role | IP | Port | Web UI |
|----------|------|-----|------|--------| |----------|------|-----|------|--------|
| MikroTik | Primary | 172.17.0.2 | 53 | http://192.168.10.1:3000 | | MikroTik | Primary | 172.17.0.2 | 53 | http://192.168.10.1:3000 |
| Unraid | Secondary/Failover | 192.168.10.10 | 3000 | http://192.168.10.10:3000 | | Unraid | Secondary/Failover | 192.168.10.10 | 53 | http://192.168.10.10:3000 |
### Credentials (Same for Both) ### Credentials (Same for Both)
@@ -147,9 +147,11 @@ Two independent Netwatch monitors trigger failover:
```routeros ```routeros
# dns-failover-down (runs when either check fails) # dns-failover-down (runs when either check fails)
# NOTE: to-ports MUST be 53 (Unraid AdGuard DNS port), NOT 3000 (web UI).
# Fixed 2026-08-07 — previously 3000, which would have broken DNS during failover.
/system script add name=dns-failover-down dont-require-permissions=yes source={ /system script add name=dns-failover-down dont-require-permissions=yes source={
:log warning "DNS Failover: Switching to Unraid" :log warning "DNS Failover: Switching to Unraid"
/ip firewall nat set [find where comment~"VLAN" and comment~"redirect"] to-addresses=192.168.10.10 to-ports=3000 /ip firewall nat set [find where comment~"VLAN" and comment~"redirect"] to-addresses=192.168.10.10 to-ports=53
} }
# dns-failover-up (runs when check recovers) # dns-failover-up (runs when check recovers)