Port 53 conflict and DNS chain ambiguity

[ElixBerd]

Hi, I made sure to read the tutorial several times as well as read FAQ two times and read other topic before I decided to make this one. I'm running an LXC on Proxmox, and I already had AdGuard set-up and running. So I've decided to use AdGuard + Knot + DNSCrypt combination but the problem has risen when I tried to run Knot. It is not specifically stated in the tutorial which port should be used for AdGuard (but you can see on screenshots that it is used on port 53), meanwhile in Knot config file the port used is also 53. So it's no surprise that I get this error when I try to start Knot service:

root@adguard:/tmp# sudo systemctl enable [email protected] && sudo systemctl start [email protected]
Job for [email protected] failed because the control process exited with error code.
See "systemctl status [email protected]" and "journalctl -xeu [email protected]" for details.

Starting [email protected] - Knot Resolver daemon...
Jan 23 21:16:53 adguard kresd[1455]: [net   ] bind to '127.0.0.1@53' (TCP): Address already in use

Obviously AdGuard home is running on port 53, and on the other hand, in the 'setting up AdGuard' section you tell to put 127.0.0.1:53 in upstream DNS. Does that imply that AdGuard is told to address itself, as it's been shown previously that it's using port 53? But that doesn't make sense.

It is not obvious in the tutorial which DNS service in the end should be the first to receive requests at your own DNS resolver's IP address (meaning which one should be at port 53). I can only assume it should be AdGuard as filtering and forwarding service but putting it's own address (127.0.0.1:53) in upstream DNS servers makes no sense to me (and I'm certain it would cause issues). So, should the port that Knot uses be changed in the config to something different?

[trinib]

Resolving Port Conflict: AdGuard Home + Knot Resolver + DNSCrypt on Proxmox

When running AdGuard Home and Knot Resolver on the same system, both services try to bind to port 53 (the default DNS port), causing a conflict. Below are steps to resolve this issue and configure the services correctly.

---

Understanding the Problem

• Port Conflict: Both AdGuard Home and Knot Resolver are configured to use port 53 by default. This results in one service (e.g., Knot) failing to start because the port is already in use.
• AdGuard Upstream Configuration: Setting 127.0.0.1:53 as an upstream DNS server for AdGuard while it’s already bound to port 53 creates a loop and misconfiguration.

---

Solution

Option 1: AdGuard on Port 53, Knot Resolver on a Different Port

This setup is ideal if AdGuard Home is your primary interface for DNS filtering.

1. Keep AdGuard on Port 53:

   • AdGuard Home will handle DNS requests on port 53.

2. Change Knot Resolver’s Listening Port:

   • Edit the Knot Resolver configuration file (usually located at /etc/knot-resolver/kresd.conf):

     net.listen('127.0.0.1', 5353)  -- Change the port to 5353

   • Restart Knot Resolver:

     sudo systemctl restart [email protected]

3. Set Knot Resolver as Upstream for AdGuard:

   • In AdGuard Home’s upstream DNS settings, add Knot Resolver:

     127.0.0.1:5353
     

   • This tells AdGuard to forward unresolved queries to Knot Resolver.

---

Option 2: Knot Resolver on Port 53, AdGuard on a Different Port

This setup works if you want Knot Resolver to act as the primary DNS service.

1. Change AdGuard’s Listening Port:

   • In AdGuard Home, modify its binding port from 53 to another port (e.g., 5353). Update the AdGuardHome.yaml configuration file:

     bind_host: 0.0.0.0
     bind_port: 5353

   • Restart AdGuard Home:

     sudo systemctl restart AdGuardHome

2. Keep Knot Resolver on Port 53:

   • Ensure Knot Resolver is configured to bind to port 53. The default setting in /etc/knot-resolver/kresd.conf should already include:

     net.listen('127.0.0.1', 53)

3. Set Knot Resolver as AdGuard’s Upstream:

   • Add Knot Resolver as an upstream DNS in AdGuard Home:

     127.0.0.1:53
     

---

Debugging Tips

• Check Listening Ports:
  Use the following command to verify which services are bound to which ports:

  sudo ss -tuln | grep :53
  

---

Verify Service Logs:

AdGuard: Check logs at /opt/AdGuardHome/AdGuardHome.log or /var/log/AdGuardHome.log.
Knot Resolver: Use journalctl -xeu [email protected] for detailed logs.

Test Configuration: Use dig or nslookup to confirm queries are resolved correctly:

dig @127.0.0.1 -p 53 example.com
dig @127.0.0.1 -p 5353 example.com