Different content filtering DNS servers for LAN and guest wifi

Hi,
I have been trying to create a guest network that uses a different DNS server than my lan with strict filtering. The guest network itself has been working properly. However whenever I enter the content filtering DNS server into the guest interface, the content filtering also applies to the LAN. I only want the content filtering on the guest.

I created the guest network based off these two guides:
https://openwrt.org/docs/guide-user/network/wifi/guestwifi/guest-wlan
https://openwrt.org/docs/guide-user/network/wifi/guestwifi/guestwifi_dumbap

Any help is appreciated

"kernel": "5.15.150",
        "hostname": "OpenWrt",
        "system": "Qualcomm Atheros QCA956X ver 1 rev 0",
        "model": "TP-Link Archer A7 v5",
        "board_name": "tplink,archer-a7-v5",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "23.05.3",
                "revision": "r23809-234f1a2efa",
                "target": "ath79/generic",
                "description": "OpenWrt 23.05.3 r23809-234f1a2efa"
        }
}
root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fdee:4569:a879::/48'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0.1'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'
        list dns '94.140.14.14'
        list dns '94.140.15.15'

config device
        option name 'eth0.2'
        option macaddr x

config interface 'wan'
        option device 'eth0.2'
        option proto 'dhcp'
        option peerdns '0'

config interface 'wan6'
        option device 'eth0.2'
        option proto 'dhcpv6'
        option reqaddress 'try'
        option reqprefix 'auto'
        option peerdns '0'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '1'

config switch_vlan
        option device 'switch0'
        option vlan '1'
        option ports '2 3 4 5 0t'

config switch_vlan
        option device 'switch0'
        option vlan '2'
        option ports '1 0t'

config device 'guest_dev'
        option type 'bridge'
        option name 'br-guest'

config interface 'guest'
        option proto 'static'
        option device 'br-guest'
        list ipaddr '192.168.3.1/24'

root@OpenWrt:~# cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option localservice '1'
        option ednspacket_max '1232'
        option confdir '/tmp/dnsmasq.d'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/hosts/odhcpd'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'

config host
        option name 'Cameras'
        option duid x
        option mac x
        option ip '192.168.1.113'

config host
        option ip '192.168.1.95'
        option name 'Back-7-Mud.95'
        list mac x

config host
        option ip '192.168.1.159'
        option name 'Front-6-Garge.159'
        list mac x

config host
        option ip '192.168.1.166'
        option name 'Front-5-BD.166'
        list mac x

config host
        option name 'testpc'
        option ip '192.168.1.150'
        option mac x

config host
        option name 'testpc'
        option duid x
        option mac x

config host
        option name 'BRN94DDF81CCA9F'
        option ip '192.168.1.220'
        option mac x

config dhcp 'guest'
        option interface 'guest'
        option start '100'
        option limit '150'
        option leasetime '1h'

root@OpenWrt:~# cat /etc/config/firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'MCServer'
        option src 'wan'
        option src_dport '25565'
        option dest_port '25565'
        option dest_ip '192.168.1.150'
        option enabled '0'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'MCserver'
        option src 'wan'
        option src_dport '19132'
        option dest_port '19132'
        option dest_ip '192.168.1.150'
        option enabled '0'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'zombie'
        option src 'wan'
        option src_dport '16262'
        option dest_ip '192.168.1.150'
        option dest_port '16262'
        list proto 'tcp'
        list proto 'udp'
        option enabled '0'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'zombie'
        option src 'wan'
        option src_dport '16261'
        option dest_ip '192.168.1.150'
        option dest_port '16261'
        list proto 'tcp'
        list proto 'udp'
        option enabled '0'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'CS'
        option src 'wan'
        option src_dport '27015'
        option dest_port '27015'
        option dest_ip '192.168.1.146'
        option enabled '0'

config rule
        option name 'Cameras-Wan'
        option src 'lan'
        option dest 'wan'
        option target 'REJECT'
        list proto 'all'
        list src_ip '192.168.1.95'
        list src_ip '192.168.1.159'
        list src_ip '192.168.1.166'

config zone 'guest'
        option name 'guest'
        option network 'guest'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'

config forwarding 'guest_wan'
        option src 'guest'
        option dest 'wan'

config rule 'guest_dns'
        option name 'Allow-DNS-Guest'
        option src 'guest'
        option dest_port '53'
        option proto 'tcp udp'
        option target 'ACCEPT'

config rule 'guest_dhcp'
        option name 'Allow-DHCP-Guest'
        option src 'guest'
        option dest_port '67'
        option proto 'udp'
        option family 'ipv4'
        option target 'ACCEPT'

If it's an external DNS server, why not intercept and redirect all queries initiated from the guest zone?

config redirect
	    option name 'DNS-Guest'
        option target 'DNAT'
        option src 'guest'
        option src_dport '53'
        option dest_ip '94.140.14.14'
1 Like

In addition to the excellent suggestion of @pavelgl you can also opt for sending a different DNS server to the clients of the guest interface with dhcp option 6 see:

2 Likes

This worked for me, Thanks for your help.

1 Like

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.