Blue DNS and 203 upgrade

[lowres (None Sausages)]

Hello, After upgrading from 202 to 203 my Blue devices nolonger could resolve DNS.

Green/Orange DNS were fine but Blue was not.

192.168.1.1:53 (Green interface) and 192.168.2.1:53 (Blue interface) were both accessible but DNS queries from Blue would not reply.

In the /etc/sysconfig/firewall.local I added:
iptables -t nat -A POSTROUTING -p udp --sport 53 -s 102.168.2.1 -j SNAT --to-source 192.168.1.1
iptables -t nat -A POSTROUTING -p tcp --sport 53 -s 102.168.2.1 -j SNAT --to-source 192.168.1.1

restarted the firewall.local and all was working again.

What I want to understand is why this stopped working after the upgrade? i.e. is this really the solution or am I missing a route somewhere else in the config?

[pscar13]

Please take a look at this thread starting from this point:

DDNS Failing Core 203 [SOLVED]

For Core Update 203, if you want DNS resolution to work correctly on the BLUE network, you must explicitly configure the IP address of the BLUE interface as the DNS server in the DHCP settings for that network. [Capture d’écran 2026-08-09 204654] Otherwise, clients on the BLUE network may receive an incorrect DNS server (or none at all), resulting in DNS resolution failures. Edit : With previous releases, it was possible either the GREEN or the BLUE interface address as the DNS server worked…

It contains some troubleshooting ideas for a similar issue.

[lowres (None Sausages)]

Yes this was setup… and hasen’t changed except to test Primay DNS with 8888 and 192.168.1.1.

Primary set to 8.8.8.8 worked fine, its really some routing issue or something that changed/did not change with the 203 update..

[pscar13]

@lowres

iptables -t nat -A POSTROUTING -p udp --sport 53 -s 102.168.2.1 -j SNAT --to-source 192.168.1.1
iptables -t nat -A POSTROUTING -p tcp --sport 53 -s 102.168.2.1 -j SNAT --to-source 192.168.1.1

-s 102.168.2.1 ?

[lowres (None Sausages)]

oops, sorry, bad typing there…
iptables -t nat -A POSTROUTING -p udp --sport 53 -s 192.168.2.1 -j SNAT --to-source 192.168.1.1
iptables -t nat -A POSTROUTING -p tcp --sport 53 -s 192.168.2.1 -j SNAT --to-source 192.168.1.1

[pscar13]

These SNAT rules are a workaround for DNS responses being sent with the wrong source address.
If you have to add them, there is likely a source address issue in your Blue network configuration.
Are you using a Wi‑Fi access point? If so, please check its LAN settings (bridge mode, DHCP, VLAN, …).

[lowres (None Sausages)]

OK, When I get some time next week I will spin up a new Installation on my backup device and see where the issue lies. I have had the current system and running for years so could be something I forgot I did years ago…

Thanks.