About AdGuard Home running on OpenWrt system with nftables firewall

[zxc_TW]

I wonder if AdGuard Home (AGH) is not compatible with nftables? Because AGH's DNS Rewrite often does not work for me

[frollic]

@zxc_TW

AdGuard Home (AGH) is not compatible with nftables

Didn't know AGH did any firewall rewrites at all, what makes you think it does/should do?

[zxc_TW]

I use AGH's DNS Rewrite to block iDevice system updates.

[frollic]

That has nothing to do with the firewall, that's DNS, use 0.0.0.0 instead of 127.0.0.1, it's quicker.

You probably need to implement https://openwrt.org/docs/guide-user/firewall/fw3_configurations/intercept_dns too.

[zxc_TW]

This is the setting when my openWRT is still using iptables. When using iptables, DNS Rewrite can also be successfully rewritten.

[frollic]

@zxc_TW

This is the setting

Which this?

@zxc_TW

DNS Rewrite can also be successfully rewritten.

Which DNS rewrite ?

[zxc_TW]

What I mean is, the DNS Rewrite rule screenshot above is still using iptables before.

By the way, at that time, the openWRT firewall added the following custom rule.

@brokenpipe

iptables -t nat -A PREROUTING -i br-lan -p udp --dport 53 -j DNAT --to 192.168.1.1:5353
iptables -t nat -A PREROUTING -i br-lan -p tcp --dport 53 -j DNAT --to 192.168.1.1:5353

[frollic]

Then use the config provided in the link.
The rule above will not be enough anyway, if you haven't reconfigured the clients.

[zxc_TW]

That is iptables. My current openWRT is replaced by nftables, so there is no custom rule to fill in

[frollic]

Really, i don't see one single iptables command in there..

[zxc_TW]

So, I don't know what to do

[frollic]

Start by rereading your own thread, take in the information provided, and make sure you actually understand it.

Consider renaming it too, your issue has nothing to do with AGH.

Or, if you're really lazy just search for nftables udp 53, but again, it won't solve your problem.

[lleachii]

@zxc_TW

is still using iptables before.

By the way, at that time, the openWRT firewall added the following custom rule.

I think your misconception is because you misunderstand the quote you posted.

@frollic

Or, if you're really lazy just search for nftables udp 53, but again, it won't solve your problem.

It might,OP posted from this step:

2.3 /etc/firewall.user
Prevent DNS leaks and force all connected devices to use the new DNS port:

How to reroute all outgoing packets to port 53 locally?

It's the well-known problem: Android devices use hardcoded Google DNS 8.8.8.8, so local names cannot be resolved except the local name of the router itself. Other devices from lan can resolve names perfectly. Proposal for solution from a post from 2018: Therefore @eduperez suggest to use iptables -t nat -A PREROUTING -i br-lan -p udp --dport 53 -j DNAT --to 192.168.1.1 iptables -t nat -A PREROUTING -i br-lan -p tcp --dport 53 -j DNAT --to 192.168.1.1 However this doesn't work for me. First…

[frollic]

@lleachii

It might,OP posted from this step

The conclusion would then be, if he'd kept reading the original thread, the solution would have appeared ?

But, AFAIK Apple devices don't use clear text DNSes any more, making the rule obsolete.

[zxc_TW]

If I set "Intercept-DNS" according to openWRT Wiki, my device will not work

[frollic]

which one of them ?

the dns failing for your clients, doesn't have to be a bad thing.
it could mean your dns block is working, but your AGH running on the
openwrt device, might be having issues.

[zxc_TW]

I can't access WAN.

If "Intercept-DNS" is disabled, I can access WAN normally.

[frollic]

you didn't read my last reply, did you ?