The Great DNS Delusion: How One IP Saved the Network

Hello homelabbers, here a add-on (technitium article that i posted here)

I wrote this with a smile on my face

The Great DNS Delusion: How One IP Saved the Network.

This is the tale of a modern home network. A digital kingdom meticulously built around a high-end Asus RT-BE88U Wi-Fi 7 router, a blistering 10GbE QNAP QSW-M804-4C switch, and a beefy Proxmox VE cluster. The proud owner (thats me)segmented everything into four beautiful, functional VLANs: Management (VLAN 1), Trusted (VLAN 21), Media (VLAN 31), and Monitoring (VLAN 41).

To provide this masterpiece🤣 with secure, independent, and recursive name resolution, two Technitium DNS servers were deployed in LXC containers across different Proxmox hosts. A flawless setup, right?

Until doom struck: a Proxmox node rebooted for a routine update. Suddenly, the entire internet froze for what felt like business days.

How is that even possible when there are literally two DNS servers sitting right there in the DHCP scope?

The Great Myth of "Primary" and "Secondary" DNS

In the IT world, people love to believe in a fairy tale: "If DNS server 1 goes down, my computer will instantly ask DNS server 2."

Sadly, reality is a chaotic mess. Operating systems are programmed to be selfish, lazy, and utterly unpredictable.

The Windows and iPhone Trap

Let’s say your DHCP server hands out two DNS servers to your devices: 192.168.11.51 (DNS-1) and 192.168.11.50 (DNS-2). Here is how they actually behave:

The Windows Chaos ("Fastest Wins"): Windows computers often blast their DNS requests to both servers at the same time. Whoever answers first wins the prize. You completely lose control over who handles your traffic. If DNS-1 is busy doing a backup, your traffic randomly yelps for help from DNS-2.

The iPhone Freeze ("Timeout Torture"): Apple devices are stubborn. Guess who is calling me........ my wife 😐Ad!!!.

An iPhone or Mac will cling to DNS-1 like a security blanket. If DNS-1 drops dead because Proxmox is rebooting, the iPhone pretends DNS-2 doesn't exist. It sends a request, gets ghosted, and waits 2 to 5 seconds for a timeout. Only after that icy silence does it switch to DNS-2. To the user, it feels like the Wi-Fi died or the website crashed.

The IoT Crash: Cheap smart-home gadgets or older Smart TVs don’t even understand the concept of a secondary DNS server. If DNS-1 goes offline, they just give up on life completely until you manually yank the power cord.

The Savior: One IP to Rule Them All (Anycast via Keepalived)

By implementing a neat networking trick called Keepalived (VRRP), you force your network to behave. You hand out exactly one DNS IP address via DHCP: 192.168.11.53.

For your devices, choice and existential dread are gone. Behind the scenes, the two Technitium LXCs constantly monitor each other's heartbeats. Does the primary server (.51) stop breathing? The standby server (.50) highjacks the 192.168.11.53 IP address on its own network card in less than a second.

The failover happens at the network layer, before your iPhone or Smart TV even realizes it was about to have a panic attack.

Total Optimization: Proxmox, QNAP, and Asus in Harmony😁

To make sure this Anycast DNS cluster plays nice with all four VLANs, our three main characters need to sing in perfect harmony. Here is the blueprint to make that happen.

Step 1: The QNAP Switch as the Digital Highway

The QNAP QSW-M804-4C switch is the physical heart beating under the hood. Since we are cramming multiple VLANs into a limited number of cables, we use VLAN Trunking.

Trunk Ports: The ports on the QNAP switch connected to the Asus router and Proxmox hosts are set as Trunk (Tagged) for all VLANs: 1, 21, 31, and 41.

This slaps a digital label (a tag) onto every network packet, so the switch knows exactly where it came from and where it is allowed to go.

Step 2: Setting up Proxmox SDN (Software-Defined Networking)

Inside Proxmox, we use SDN to dynamically pass VLANs to virtual machines and containers without needing a separate physical cable for every single network.

Create a VLAN Zone: In the Proxmox Datacenter settings, create a new VLAN Zone under SDN > Zones and link it to your main bridge (e.g., vmbr0).

Make Bridges VLAN-Aware: Check that handy "VLAN-aware" box on your network bridge. This allows it to read and process the tagged packets coming from the QNAP switch.

LXC Assignment: The Technitium LXCs live comfortably in the Management Zone (VLAN 1). Now, when a device in the Media VLAN (31) asks for a DNS lookup, the packet travels tagged over the QNAP switch, through the Proxmox SDN bridge, and straight into the container.

uuuhh..next

Step 3: The Asus RT-BE88U DNS Director (The Mastermind)

The absolute masterpiece happens inside the Asus router under the DNS Director menu. This is where we force network traffic down our secure pipe without accidentally blowing up the network.

The Danger of the Infinite DNS Loop

If you blindly force every device in the network to redirect to your local DNS server, you create a digital black hole in VLAN 1. Technitium lives in VLAN 1 and needs to talk to internet root servers to do its job. If the router intercepts DNS packets from VLAN 1, it will grab Technitium’s internet requests and shove them right back into Technitium. Your network traps itself in an infinite loop and instantly flatlines.

The Bulletproof Configuration

The Asus DNS Director solves this with surgical precision by mixing exceptions with group rules:

The Anycast Target (User Defined 1): In the global router settings, set User Defined DNS 1 to your Anycast IP: 192.168.11.53. This is the North Star for all traffic.

VLAN Peer Pressure: Under Guest Network Pro profiles, the Trusted (21), Media (31), and Monitoring (41) networks are strictly locked to User Defined 1. Any smart-home device trying to sneak out via Google's 8.8.8.8 is forcefully dragged back to the local Anycast IP.

The Smart Escape (Client List): To dodge the infamous DNS loop, the physical Proxmox hosts (via their MAC addresses) are added to the Client List with the status No Redirection.(see picure attached to this post).

This gives the Technitium servers a hall pass to bypass the router's rules and freely talk to the actual internet.

VLAN 1 Whitelisting: Because Global Redirection is also pointing to User Defined 1, TVs and Sonos systems in VLAN 1 are safely pulled into the DNS matrix too. Since these specific devices are pre-whitelisted inside Technitium, apps like Netflix and Viaplay work flawlessly—blazing fast, with no ad-blockers breaking the streams.

The Verdict: Bulletproof Infrastructure

By moving away from a traditional, fragile DNS setup, the network has evolved into a high-grade infrastructure enterprise admins would approve of.

When a computer requests a website now, it goes through the rock-solid Anycast IP. No more timeouts, no more freezing devices, and zero loops. The QNAP switch splits the traffic, Proxmox SDN delivers it to the containers, and the Asus router guards the borders like a hawk.

It is fast, it is secure, and most importantly—it survives a reboot.

0 comments

The Great DNS Delusion: How One IP Saved the Network