Configuring firewall to drop some DNS queries

Installing and Using OpenWrt
1

I've got an OpenWRT router with 22.03 installed. I managed to configure a few firewall rules already using LuCI and also by manipulating /etc/config/firewall myself. Now what I'm trying currently is to drop certain DNS requests. I can drop all DNS requests like this:

config rule               
        option name 'Drop DNS'
        option src 'lan'
        option proto 'udp'
        option dest_port '53'
        option target 'DROP'
        option enabled '1'

But my requirement is to drop only some based on the domains queried. I found a guide on how to do it with IP tables: https://noc.org/help/blocking-dns-requests-via-iptables/ and it seems rather straightforward: just block based on hex-string content. However, I have not been able to find anything in the firewall configuration docs (https://openwrt.org/docs/guide-user/firewall/firewall_configuration) on how that would be possible. I have the feeling I might need to install another package, but I'm a bit overwhelmed by the number of packages I find when looking for "netfilter" in the LuCI package manager. Any ideas?

Thanks!

2

use adblock, or dnsmasqs address= in the conf instead ?

5 Likes
3

dns filtering

3 Likes
4

Thanks for that idea. I tried it and it is similar to other rules I already configured in the dhcp config file. Unfortunately, when I add that blacklist rule, the DNS server returns a NXDOMAIN for queries. I guess usually that should be enough. What I'm doing however is some research on how some client systems behave or misbehave depending on the DNS configuration of the router and while I already got the case covered where NXDOMAIN is returned for some domains, the question that I'm trying to answer at the moment is how the behave if some of their DNS queries are silently dropped.

5

Thanks frollic. I tried this too, but didn't manage to get it to do what I needed.

Anyway, since I had a tutorial available for iptables while iptables is not available on my router, I figured it might be simpler to just switch to a system that has it. So I configured my other laptop as a router and was able to figure out what I needed to using iptables.

Thanks for your answers still, very much appreciated.

6

That's easy, make the client query some non existant address.

7

That wouldn't cause a silent drop though, would it?

@sebkur you can probably configure what kind of reply a blacklisted domain should generate.

8

Seems quite silent to me.

root@barracuda:[~]#dig openwrt.org @10.0.2.4
;; communications error to 10.0.2.4#53: timed out
;; communications error to 10.0.2.4#53: timed out
;; communications error to 10.0.2.4#53: timed out

; <<>> DiG 9.18.7 <<>> openwrt.org @10.0.2.4
;; global options: +cmd
;; no servers could be reached
1 Like
9

That's easy indeed. However in my research setup, I cannot chose the address the client uses. Background: I'm looking at Android devices that use connectivitycheck.gstatic.om and google.com to determine whether a Wifi connection is considered online/offline and am tampering with different situations to see how the Android device reacts.

10

misunderstood, thought you meant the DNS name would be non existent, not the DNS server.

2 Likes
11

Android devices use hardcoded GoogleDNS apart from the advertised nameservers.

12

there's also DoT on OS level, and DoH in the browser(s).

2 Likes
13

The one I am using here doesn't seem to. At least it also uses the IP address of my router as nameserver. I can the lots of requests on the router's log. Also when blocking google.com on the router, the Android device thinks it's offline as in the Wifi has the little X-marker and the Wifi settings mention "No internet access" (although of course it has Internet access, it just cannot reach Google :))

14

Yes, so you must fix that, correct?

You were told why - in fact, you explained it.

Is this your only use case, because the Android issue is known and unrelated to OpenWrt.

See:

https://socifi-doc.atlassian.net/wiki/spaces/SC/pages/94371841/DNS+Fix+to+keep+Android+Splash+Page+and+the+Captive+Portal+Notification+active

In other words, are there other domains that you wish to block that aren't working, or perhaps I misunderstand what you're tying to solve, or the title doesnt quite describe?

15

You might want to look at dnsmasq’s native connmark-allowlist option to filter certain clients for certain domains.

https://dnsmasq.org/docs/dnsmasq-man.html

2 Likes