On Sun, Mar 06, 2022 at 11:26:38PM +0100, Koen Drai wrote:
Hi,
I am running an AdGuard Home DNS server in my home network (on Debian 11, which is
v0.9.3).
Works fine so far, but I am getting the following error messages in syslog:
Mar 6 20:48:33 fook kernel: [160941.334608] "filter_IN_knet_REJECT: "IN=enp2s0
OUT= MAC=<MAC> SRC=5.9.164.112 DST=192.168.1.1 LEN=40 TOS=0x00 PREC=0x00 TTL=53 ID=0
DF PROTO=TCP SPT=853 DPT=46170 WINDOW=0 RES=0x00 RST URGP=0
A TCP RESET will be sent if the remote/server does not have a socket
listening on that port. This may indicate the packet passes through the
firewall, but no service is listening.
However, this request should not be rejected according to the
configuration:
/etc/firewalld/zones/knet.xml
(...)
<rule family="ipv4">
<!-- 853 TCP AdGuard Home-->
<source-port port="853" protocol="tcp"/>
<accept/>
</rule>
(...)
This is using _source_ port. If this node is running a DNS-over-TLS
service then you want to use `<port ... />` instead.
--list-all:
(...)
rich rules:
(...)
rule family="ipv4" source-port port="853"
protocol="tcp" accept
(...)
Similar behavior for source-port 443 TCP.
Am I missing something?
Is this a known error (and fixed in a later version?)?
I think you should check that your application is actually listening.
# ss -n -l |grep 853