Custom rule and adguard home

[camus]

it used to be, before there was an opkg package for AGH that it was possible to manually install AGH and then do this:

iptables -t nat -A PREROUTING -i br-lan -p udp --dport 53 -j DNAT --to 10.x.x.x:5353
iptables -t nat -A PREROUTING -i br-lan -p tcp --dport 53 -j DNAT --to 10.x.x.x:5353

but with the latest openwrt, even with a build on iptables, the option to add that through Luci Network > Firewall > Custom rule is no longer there.

Where can one add the above lines in the current version of openwrt and the default AGH opkg version in Softwares, please?

thanks a lot.

[dave14305]

You can follow the wiki but add an “Internal port” of 5353 in the rule.

DNS hijacking

[camus]

@dave14305

You can follow the wiki but add an “Internal port” of 5353 in the rule.

@dave14305 thanks a lot. i will give it and try and report.

[camus]

@dave14305

You can follow the wiki but add an “Internal port” of 5353 in the rule.

@dave14305 thanks a lot! And for those wandering and wondering about AGH not auto starting, which is another issue, a solution is below, NOT the commands in the wiki. The solution is taken from the link below:

https://forum.openwrt.org/t/adguardhome-ipk-autostart-not-working-after-reboot/119274/18

service adguardhome disable
nano /etc/init.d/adguardhome
Change "Start" from 21 to 99 and "Stop" from 89 to 120
service adguardhome enable
reboot

[camus]

@camus

@dave14305

You can follow the wiki but add an “Internal port” of 5353 in the rule.

@dave14305 thanks a lot!

I spoke too soon. DNS hijacking from the wiki is not working. Still looking for help. Here's a screenshot of my settings:

[dave14305]

Is Adguardhome listening on port 5353?

netstat -nltup | grep 53
nft list ruleset | grep Intercept

[camus]

@dave14305

Is Adguardhome listening on port 5353?

It would not allow me to proceed with "53" at configuration, and so I did 5353. Is this my error? How do I now correct it, please?

[dave14305]

I don’t use AGH. I just want to understand the current setup on your router.

[camus]

@dave14305

netstat -nltup | grep 53

^Croot@OpenWrt:~# netstat -nltup | grep 53
tcp        0      0 127.0.0.1:53            0.0.0.0:*               LISTEN      2577/dnsmasq
tcp        0      0 192.168.1.1:53          0.0.0.0:*               LISTEN      2577/dnsmasq
tcp        0      0 192.168.0.54:53         0.0.0.0:*               LISTEN      2577/dnsmasq
tcp        0      0 192.168.1.1:5353        0.0.0.0:*               LISTEN      3092/AdGuardHome
tcp        0      0 ::1:53                  :::*                    LISTEN      2577/dnsmasq
tcp        0      0 fe80::a2f3:c1ff:fea5:f79c:53 :::*                    LISTEN      2577/dnsmasq
tcp        0      0 fdec:688a:7325::1:53    :::*                    LISTEN      2577/dnsmasq
tcp        0      0 fe80::a2f3:c1ff:fea5:f79c:53 :::*                    LISTEN      2577/dnsmasq
tcp        0      0 2a02:8109:b640:43f:a2f3:c1ff:fea5:f79d:53 :::*                    LISTEN      2577/dnsmasq
tcp        0      0 fe80::a2f3:c1ff:fea5:f79d:53 :::*                    LISTEN      2577/dnsmasq
udp        0      0 192.168.1.1:5353        0.0.0.0:*                           3092/AdGuardHome
udp        0      0 127.0.0.1:53            0.0.0.0:*                           2577/dnsmasq
udp        0      0 192.168.1.1:53          0.0.0.0:*                           2577/dnsmasq
udp        0      0 192.168.0.54:53         0.0.0.0:*                           2577/dnsmasq
udp        0      0 ::1:53                  :::*                                2577/dnsmasq
udp        0      0 fe80::a2f3:c1ff:fea5:f79c:53 :::*                                2577/dnsmasq
udp        0      0 fdec:688a:7325::1:53    :::*                                2577/dnsmasq
udp        0      0 fe80::a2f3:c1ff:fea5:f79c:53 :::*                                2577/dnsmasq
udp        0      0 2a02:8109:b640:43f:a2f3:c1ff:fea5:f79d:53 :::*                                2577/dnsmasq
udp        0      0 fe80::a2f3:c1ff:fea5:f79d:53 :::*                                2577/dnsmasq

[camus]

@dave14305

nft list ruleset | grep Intercept

this does not output anything at all

[dave14305]

Is there any warning/error output if you run fw4 reload

Which OpenWrt version are you running?

[camus]

yes:
"-ash: fw4: not found"
OpenWrt 22.03.2 r19803-9a599fee93
But I'm not running:
-firewall4
-kmod-nft-offload
-nftables
instead:
firewall
iptables-legacy
ip6tables-legacy
kmod-ipt-offload

[dave14305]

How about:

iptables-save -c | grep Intercept

Just want to see if the rule is present and catching anything at all.

[camus]

@dave14305

Just want to see if the rule is present and catching anything at all.

that seems to be the case.

[0:0] -A zone_lan_prerouting -p tcp -m tcp --dport 53 -m comment --comment "!fw3: Intercept-DNS" -j REDIRECT --to-ports 5353
[35:2448] -A zone_lan_prerouting -p udp -m udp --dport 53 -m comment --comment "!fw3: Intercept-DNS" -j REDIRECT --to-ports 5353

[camus]

@dave14305

iptables-save -c | grep Intercept

but as you can see the results are different from the example I gave at the start of this thread. Is it a zoning issue now?

[camus]

@camus

I spoke too soon. DNS hijacking from the wiki is not working. Still looking for help. Here's a screenshot of my settings:

this was my error; a stupid one. i had my wifi connection on my laptop taking over the lan. the wifi was not connected to the router with AGH, so obviously, I was able to go to websites AGH should block. stupid, silly mistake!