It’s not me though. I configured the firewall myself, and there’s nothing configured to block DNS packets. I even swapped the firewall out for an old one, packets still aren’t showing up at the actual DNS server. Running packet sniffing on the firewall shows that no packets are arriving to the FW from Cloudflare and some other sources. I talked with my ISP, they claim they don’t filter any packets at the network level. They said any packet filtering is with the on premise Wifi gateway they provide with the service, which I’m not using.
Is there any way to debug/verify ISP level packet filtering of UDP packets? I feel that’s the most likely scenario given source-dependent behavior.
Separately, I understand the timeout error, but I get an occasional EDE:18 Prohibited error. What could be causing that? If packets are being dropped, what would cause a “Prohibited” determination? Or is this simply Cloudflare internally trying to prevent queries to a seemingly broken DNS server?