Docker [error] dnsproxy: exchange failed upstream, ERROR response received i/o timeout

[quyleanh]

For some one who face the issue like me with recent update from both Adguard Home and Docker as following log:

2025/02/24 08:08:13.808941 ERROR response received addr=8.8.4.4:53 proto=udp status="exchanging with 8.8.4.4:53 over udp: read udp 172.22.0.100:36434->8.8.4.4:53: i/o timeout"
2025/02/24 08:08:13.808945 ERROR response received addr=8.8.8.8:53 proto=udp status="exchanging with 8.8.8.8:53 over udp: read udp 172.22.0.100:42308->8.8.8.8:53: i/o timeout"
2025/02/24 08:21:54.107877 ERROR response received addr=9.9.9.11:53 proto=udp status="exchanging with 9.9.9.11:53 over udp: read udp 172.22.0.100:43020->9.9.9.11:53: i/o timeout"
2025/02/24 08:08:13.809328 [error] dnsproxy: exchange failed upstream=https://dns.google:443/dns-query question=";login.microsoftonline.com.\tIN\t A" duration=10.003235613s err="failed to init http client: initializing http transport: bootstrapping https://dns.google:443/dns-query: dialing \"dns.google:443\": resolving hostname: exchanging with 9.9.9.11:53 over udp: read udp 172.22.0.100:32915->9.9.9.11:53: read: no route to host\nexchanging with 9.9.9.11:53 over udp: read udp 172.22.0.100:39346->9.9.9.11:53: read: no route to host\nexchanging with 8.8.4.4:53 over udp: read udp 172.22.0.100:41354->8.8.4.4:53: read: no route to host\nexchanging with 8.8.4.4:53 over udp: read udp 172.22.0.100:36434->8.8.4.4:53: i/o timeout\nexchanging with 8.8.8.8:53 over udp: read udp 172.22.0.100:47789->8.8.8.8:53: read: no route to host\nexchanging with 8.8.8.8:53 over udp: read udp 172.22.0.100:42308->8.8.8.8:53: i/o timeout"

Whenever you check the upstream address, it will not response and throw an error. DNS resolver cannot perform even when you can access to admin page. 

I did some research and found out that the docker Adguard Home network to interface network is blocked. You can try to add firewall rule like following.

sudo iptables -I FORWARD 5 -i br-1077aa0f1ff7 -o enp0s3 -j ACCEPT

1077aa0f1ff7 is bridge network id. Can obtain with docker network ls command, then check the Adguard Home network id.
enp0s3 is interface to outside network. Can obtain with ip route show command. Check default via value.

I think there is problem with docker update. I'm using ARM64 server from Oracle now. I don't know if Adguard Home can do something to prevent this issue. Hope someone from team can take a look at this problem.

For now I manually create a docker network bridge, then add to docker-compose.yml file to make sure I don't need to add iptables rule everytime I update Adguard Home docker image. Hope this help.