# DNS Filtering for specific user **URL:** \ **Category:** Network and Wireless Configuration\ **Created:** [October 7, 2019, 5:47am UTC](https://forum.openwrt.org/t/dns-filtering-for-specific-user/45998 "2019-10-07T05:47:33Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![rupadana](https://forum.openwrt.org/user_avatar/forum.openwrt.org/rupadana/32/13485_2.png) [@rupadana](https://forum.openwrt.org/u/rupadana)\ **Post date:** [October 7, 2019, 5:47am UTC](https://forum.openwrt.org/t/dns-filtering-for-specific-user/45998/1 "2019-10-07T05:47:33Z")
i've been build server for DNS Filtering and i want to forward my openwrt to my DNS server i'm using the iptables for forwarding the port of DNS ``` iptables -t nat -A PREROUTING -p udp -s 192.168.1.129 --dport 53 -j DNAT --to-destination xxx.xxx.xx.xx:xxx ``` and i got DNS\_PROBE\_FINISHED\_NO\_INTERNET ![10](https://forum.openwrt.org/uploads/default/original/2X/1/1f5a45d55e48b6d4abe0ea734757de898a851b7c.jpeg) ---
**Author:** ![lleachii](https://forum.openwrt.org/letter_avatar/lleachii/32/5_5575768a8748004e209b776fc1b2916d.png) [@lleachii](https://forum.openwrt.org/u/lleachii)\ **Post date:** [October 7, 2019, 2:47pm UTC](https://forum.openwrt.org/t/dns-filtering-for-specific-user/45998/2 "2019-10-07T14:47:06Z")
Why are you using the firewall to assign a DNS server? Just assign the server via DHCP, or on the client statically. ``` config host option ip '192.168.1.129' option mac 'xx:xx:xx:xx:xx:xx' option name 'pc_dns_filtered' option dns '1' option tag 'filtered_dns' config tag 'filtered_dns' list dhcp_option '6,8.8.8.8,8.4.4.4' ``` ---
**Author:** ![trendy](https://forum.openwrt.org/user_avatar/forum.openwrt.org/trendy/32/8800_2.png) [@trendy](https://forum.openwrt.org/u/trendy)\ **Post date:** [October 7, 2019, 8:27pm UTC](https://forum.openwrt.org/t/dns-filtering-for-specific-user/45998/3 "2019-10-07T20:27:29Z")
Also have a look at this: [https://openwrt.org/docs/guide-user/firewall/fw3\_configurations/forced\_dns\_redirection](https://openwrt.org/docs/guide-user/firewall/fw3_configurations/forced_dns_redirection) ---
**Author:** ![rupadana](https://forum.openwrt.org/user_avatar/forum.openwrt.org/rupadana/32/13485_2.png) [@rupadana](https://forum.openwrt.org/u/rupadana)\ **Post date:** [October 8, 2019, 12:50am UTC](https://forum.openwrt.org/t/dns-filtering-for-specific-user/45998/4 "2019-10-08T00:50:28Z")
> [@lleachii](#): > > list dhcp\_option '6,8.8.8.8,8.4.4.4' can i definied port on list dhcp\_option? ---
**Author:** ![trendy](https://forum.openwrt.org/user_avatar/forum.openwrt.org/trendy/32/8800_2.png) [@trendy](https://forum.openwrt.org/u/trendy)\ **Post date:** [October 8, 2019, 9:11am UTC](https://forum.openwrt.org/t/dns-filtering-for-specific-user/45998/5 "2019-10-08T09:11:17Z")
Not there, but you can define in dnsmasq. ---
**Author:** ![rupadana](https://forum.openwrt.org/user_avatar/forum.openwrt.org/rupadana/32/13485_2.png) [@rupadana](https://forum.openwrt.org/u/rupadana)\ **Post date:** [December 12, 2019, 1:41am UTC](https://forum.openwrt.org/t/dns-filtering-for-specific-user/45998/6 "2019-12-12T01:41:01Z")
> [@trendy](#): > > Also have a look at this: [https://openwrt.org/docs/guide-user/firewall/fw3\_configurations/forced\_dns\_redirection](https://openwrt.org/docs/guide-user/firewall/fw3_configurations/forced_dns_redirection) i already trying this but still not working ---
**Author:** ![rupadana](https://forum.openwrt.org/user_avatar/forum.openwrt.org/rupadana/32/13485_2.png) [@rupadana](https://forum.openwrt.org/u/rupadana)\ **Post date:** [December 12, 2019, 1:41am UTC](https://forum.openwrt.org/t/dns-filtering-for-specific-user/45998/7 "2019-12-12T01:41:50Z")
> [@trendy](#): > > Not there, but you can define in dnsmasq. when i define in dnsmasq, can i define for spesific user? ---
**Author:** ![trendy](https://forum.openwrt.org/user_avatar/forum.openwrt.org/trendy/32/8800_2.png) [@trendy](https://forum.openwrt.org/u/trendy)\ **Post date:** [December 12, 2019, 9:01am UTC](https://forum.openwrt.org/t/dns-filtering-for-specific-user/45998/8 "2019-12-12T09:01:23Z")
Yes, @lleachii explained it [here](https://forum.openwrt.org/t/dns-filtering-for-specific-user/45998/2). ---
**Author:** ![rupadana](https://forum.openwrt.org/user_avatar/forum.openwrt.org/rupadana/32/13485_2.png) [@rupadana](https://forum.openwrt.org/u/rupadana)\ **Post date:** [December 13, 2019, 8:05am UTC](https://forum.openwrt.org/t/dns-filtering-for-specific-user/45998/9 "2019-12-13T08:05:26Z")
with a spesific port of DNS Server? ---
**Author:** ![trendy](https://forum.openwrt.org/user_avatar/forum.openwrt.org/trendy/32/8800_2.png) [@trendy](https://forum.openwrt.org/u/trendy)\ **Post date:** [December 13, 2019, 10:16am UTC](https://forum.openwrt.org/t/dns-filtering-for-specific-user/45998/10 "2019-12-13T10:16:45Z")
As far as I know you cannot push the port of the NS via DHCP. ---
**Author:** ![eduperez](https://forum.openwrt.org/user_avatar/forum.openwrt.org/eduperez/32/2066_2.png) [@eduperez](https://forum.openwrt.org/u/eduperez)\ **Post date:** [December 13, 2019, 2:04pm UTC](https://forum.openwrt.org/t/dns-filtering-for-specific-user/45998/11 "2019-12-13T14:04:03Z")
My two cents: why don't you keep the OpenWrt router as a DNS, and configure the filtering DNS as an upstream DNS? Seems far easier than this. ---
**Author:** ![Thovthe](https://forum.openwrt.org/letter_avatar/thovthe/32/5_5575768a8748004e209b776fc1b2916d.png) [@Thovthe](https://forum.openwrt.org/u/Thovthe)\ **Post date:** [April 9, 2026, 1:58am UTC](https://forum.openwrt.org/t/dns-filtering-for-specific-user/45998/12 "2026-04-09T01:58:45Z")
Can that be done in such a way that the upstream DNS is on the router itself? This would make setting up per VLAN DNS rules much easier. ---
**Author:** ![reinerotto](https://forum.openwrt.org/letter_avatar/reinerotto/32/5_5575768a8748004e209b776fc1b2916d.png) [@reinerotto](https://forum.openwrt.org/u/reinerotto)\ **Post date:** [April 9, 2026, 5:03am UTC](https://forum.openwrt.org/t/dns-filtering-for-specific-user/45998/13 "2026-04-09T05:03:18Z")
Of course. I.e. for parental control, I run a customized powerdns-resolver as upstream DNS for dnsmasq, on same router. ---
**Author:** ![Thovthe](https://forum.openwrt.org/letter_avatar/thovthe/32/5_5575768a8748004e209b776fc1b2916d.png) [@Thovthe](https://forum.openwrt.org/u/Thovthe)\ **Post date:** [April 9, 2026, 5:24am UTC](https://forum.openwrt.org/t/dns-filtering-for-specific-user/45998/14 "2026-04-09T05:24:09Z")
How? I really can't seem to figure out how to get another DNS server speaking on another IP from the same box, or however it is you chain that so you can have different DNS filtering rules for different VLANs. ---
**Author:** ![reinerotto](https://forum.openwrt.org/letter_avatar/reinerotto/32/5_5575768a8748004e209b776fc1b2916d.png) [@reinerotto](https://forum.openwrt.org/u/reinerotto)\ **Post date:** [April 9, 2026, 5:34am UTC](https://forum.openwrt.org/t/dns-filtering-for-specific-user/45998/15 "2026-04-09T05:34:06Z")
I do not use different VLANs, but I do MAC-based filtering on the (upstream) powerdns. Thus, all DNS-requests pass dnsmasq, which provides the MAC of client, and powerdns does the serious processing. KISS ๐Ÿ™‚ ---
**Author:** ![egc](https://forum.openwrt.org/letter_avatar/egc/32/5_5575768a8748004e209b776fc1b2916d.png) [@egc](https://forum.openwrt.org/u/egc)\ **Post date:** [April 9, 2026, 7:19am UTC](https://forum.openwrt.org/t/dns-filtering-for-specific-user/45998/16 "2026-04-09T07:19:19Z")
There are several ways for "Split DNS" Popular are `DHCP option 6` and `DNS hijacking` For some more background see: > **[OpenWRT-egc-add-on/stop-dns-leak at main ยท egc112/OpenWRT-egc-add-on](https://github.com/egc112/OpenWRT-egc-add-on/tree/main/stop-dns-leak#split-dns)** > > Contribute to egc112/OpenWRT-egc-add-on development by creating an account on GitHub.