Estimated reading time: 3 minutes

Have you ever had to set up a local DNS server (come AdGuard Home the Pi-hole) to clean your network of ads and trackers, see everything work wonderfully and then, after a few days, suddenly find yourself without internet?

Maybe some devices navigate, others show the classic warning “Connected network, internet not available”, and the only way to resolve the situation seems to be a router reboot or activating a VPN on the phone.

If this situation sounds familiar to you, you could be the victim of a DNS Loop (or name resolution loop). Let's see what this phenomenon is and how to correctly configure any router to avoid it once and for all.

---

What is a DNS Loop?

It DNS (Domain Name System) It's the Internet phone book: translates an understandable name as google.com into a numeric IP address.

When you install a local DNS filter in your LAN (often inside a Docker container on a NAS or mini-PC), you have to tell your network to use that specific IP to resolve domains. The problem arises when the chain of requests breaks down “bites the tail”.

A DNS loop typically occurs when:

• Your smartphone asks the Router to resolve a site.
• The Router forward the request to your Server DNS Locale (AdGuard/Pi-hole).
• The Local DNS Server does not know the answer e, to find her, question your surroundings… the Router.
• The Router sends the ball back to the Local DNS Server.

This continuous cycle repeats endlessly at the speed of light. Initially everything seems to work, but within a few hours or days the router's flow table becomes saturated, the cache goes crazy and name resolution hangs, leaving your devices “connected but without internet”.

---

The most common configuration error in routers

Many users, to cut off the bull's head, enter the IP of your local DNS server in the section Internet / WAN of your router (often under the voice Account Settings / Public DNS).

By configuring the router like this, he is being told: “Use this local IP for anything going out”. It is precisely this move that generates the loop as soon as the local server tries to make a “upstream” (that is, to ask an external authoritative server for a domain that it does not have in cache).

---

How to fix on any router model

To solve the root problem we need to separate the flows. The golden rule is: local clients must talk to local DNS, but the local DNS must speak directly to the outside.

Here are the steps to follow, valid for the vast majority of routers on the market (Fritz!Box, ASUS, Netgear, TP-Link, etc..):

1. Configure DNS in the LAN section (DHCP)

Look for the section in your router menus Local Network / LAN / Server DHCP. This is where you need to enter the local IP address of your AdGuard Home or Pi-hole (this is. 192.168.1.50) come Primary Local DNS.

Why do it here? In this way, when a device connects to Wi-Fi, the router will tell you: “Here is your IP, and for DNS don't knock on my door, talk directly to the local server”. The router is cut off from the first pass, breaking the potential loop.

2. Configure external DNS in the WAN section (Internet)

Move to the section Internet / WAN / Connection del router. Check it out regarding the DNS server and remove your local server IP. In his place, enter public and stable DNS like those of Google (8.8.8.8) o Cloudflare (1.1.1.1).

In this way, if your router will need to connect to the internet on its own (or for the Guest/Guests network, which is usually isolated from the main LAN), will use external servers and will not be trapped in the local network.

3. Set the “Upstream” correct on your Local DNS

In the end, open the dashboard of your AdGuard Home or Pi-hole. In the section DNS settings, make sure the servers “Upstream” (those who the software asks for help when it doesn't know a site) are external public servers (9.9.9.9, 1.1.1.1) and May the IP address of your router.

---

A bonus tip for modern devices

If after fixing the DNS you notice that your smartphone or your Linux PC continues to lose connection after a few days, Check your device's privacy settings.

Modern operating systems (come Android, iOS is the ultimate Linux distro) they use by default the MAC Address Casuale. Every few days they change theirs “identity card” network to avoid being tracked. This behavior can confuse your router and DNS server, causing them to end up in restricted or unrecognized network profiles.

If you encounter this problem, go into your smartphone's Wi-Fi settings for your home network and change the Privacy option from “Use MAC Casual” a “Use Device MAC”.