AdGuard Home doesn't work when outgoing port 443 blocked

[rodalpho]

AdGuard Home running in docker is unable to resolve addresses when I have my firewall set to block all outgoing connections to ports other than 53.

The "Test Upstreams" button says everything is working. Inside the docker container DNS lookups work fine too. My upstream DNS line just contains "1.1.1.1" to keep it simple for troubleshooting.

Running TCPdump on the host device shows zero outgoing packets to port 53 when querying through AdGuard Home from another host, and does show packets working when I run a nslookup inside the docker container.

Something is weird with AdGuard Home. If I disable that firewall rule it works. If I allow outgoing port 443, it works. But why would AGH need any ports other than 53? Any thoughts?

NSlookup inside the container:

docker exec -it adguardhome /bin/sh
/opt/adguardhome/work # nslookup yahoo.com 1.1.1.1
Server:         1.1.1.1
Address:        1.1.1.1:53

Non-authoritative answer:
Name:   yahoo.com
Address: 2001:4998:44:3507::8001
Name:   yahoo.com
Address: 2001:4998:44:3507::8000
Name:   yahoo.com
Address: 2001:4998:124:1507::f000
Name:   yahoo.com
Address: 2001:4998:24:120d::1:1
Name:   yahoo.com
Address: 2001:4998:24:120d::1:0
Name:   yahoo.com
Address: 2001:4998:124:1507::f001

Non-authoritative answer:
Name:   yahoo.com
Address: 74.6.143.26
Name:   yahoo.com
Address: 74.6.231.20
Name:   yahoo.com
Address: 98.137.11.163
Name:   yahoo.com
Address: 74.6.143.25
Name:   yahoo.com
Address: 74.6.231.21
Name:   yahoo.com
Address: 98.137.11.164

My docker run line:

docker run -d --name=adguardhome \
-e TZ=America/New_York \
-v /volume1/docker/adguardhome/config:/opt/adguardhome/conf \
-v /volume1/docker/adguardhome/data:/opt/adguardhome/work/data \
-p 53:53 \
--net=host \
--restart always \
adguard/adguardhome

[rodalpho]

I changed the AGH docker container to use a MacVLAN network, so it was given a real IP on my LAN, because I figured I would need 443 anyway to update blocklists after reflecting a bit, and wanted to allow AGH that access but not the rest of my NAS for security reasons.

Anyway, it should work with 443 blocked.

[ameshkov]

Try examining AdGuard Home logs to see what's wrong:

1. Configure AdGuard Home to write verbose-level log.
2. Reproduce the issue.
3. Examine the log file.

Note, that if you have "safe browsing" or "parental control" enabled, AGH will use DOH to do the lookups.

[rodalpho]

It works fine now-- my theory is this is because it works with a separate macVLAN IP but something with docker's internal bridge broke it.