DNS Filtering for specific user

Installing and Using OpenWrt Network and Wireless Configuration

rupadana October 7, 2019, 5:47am 1

i've been build server for DNS Filtering and i want to forward my openwrt to my DNS server
i'm using the iptables for forwarding the port of DNS

iptables -t nat -A PREROUTING -p udp -s 192.168.1.129 --dport 53 -j DNAT --to-destination xxx.xxx.xx.xx:xxx

and i got DNS_PROBE_FINISHED_NO_INTERNET

lleachii October 7, 2019, 2:47pm 2

Why are you using the firewall to assign a DNS server?

Just assign the server via DHCP, or on the client statically.

config host
	option ip '192.168.1.129'
	option mac 'xx:xx:xx:xx:xx:xx'
	option name 'pc_dns_filtered'
	option dns '1'
	option tag 'filtered_dns'

config tag 'filtered_dns'
	list dhcp_option '6,8.8.8.8,8.4.4.4'

Custom dns wont work

trendy October 7, 2019, 8:27pm 3

Also have a look at this: https://openwrt.org/docs/guide-user/firewall/fw3_configurations/forced_dns_redirection

rupadana October 8, 2019, 12:50am 4

can i definied port on list dhcp_option?

trendy October 8, 2019, 9:11am 5

Not there, but you can define in dnsmasq.

rupadana December 12, 2019, 1:41am 6

i already trying this but still not working

rupadana December 12, 2019, 1:41am 7

when i define in dnsmasq, can i define for spesific user?

trendy December 12, 2019, 9:01am 8

Yes, @lleachii explained it here.

rupadana December 13, 2019, 8:05am 9

with a spesific port of DNS Server?

trendy December 13, 2019, 10:16am 10

As far as I know you cannot push the port of the NS via DHCP.

eduperez December 13, 2019, 2:04pm 11

My two cents: why don't you keep the OpenWrt router as a DNS, and configure the filtering DNS as an upstream DNS? Seems far easier than this.

Thovthe April 9, 2026, 1:58am 12

Can that be done in such a way that the upstream DNS is on the router itself? This would make setting up per VLAN DNS rules much easier.

reinerotto April 9, 2026, 5:03am 13

Of course. I.e. for parental control, I run a customized powerdns-resolver as upstream DNS for dnsmasq, on same router.

Thovthe April 9, 2026, 5:24am 14

How? I really can't seem to figure out how to get another DNS server speaking on another IP from the same box, or however it is you chain that so you can have different DNS filtering rules for different VLANs.

reinerotto April 9, 2026, 5:34am 15

I do not use different VLANs, but I do MAC-based filtering on the (upstream) powerdns. Thus, all DNS-requests pass dnsmasq, which provides the MAC of client, and powerdns does the serious processing. KISS

egc April 9, 2026, 7:19am 16

There are several ways for "Split DNS"
Popular are DHCP option 6 and DNS hijacking
For some more background see: