DNS for certain Device sent to 1.1.1.3

Beniamin · March 28, 2026, 5:36am

Hi, I’m trying to create a fw rule that can intercept a dns request from device ABC and forward it to 1.1.1.3. but I’m having no luck. Is there a simple guide I can follow or an apk I can install to assist with this?

Intercept-DNS	Forwarded IPv4 and IPv6 From lan, IP 192.168.1.179, port 53, MAC A6:63:C4:E3:AC:C8 To lan, IP 1.1.1.3, port 53	Accept forward		EditCloneDelete

pavelgl · March 28, 2026, 8:10am

Create the rule as shown on this screenshot.

In the Advanced Settings tab:

Don't mix source MACs and IPs. It will only work if the IP is mapped to the MAC (same device).
Make sure the Source port field is empty.
Uncheck the box for NAT Loopback.

Beniamin · March 28, 2026, 4:42pm

Thanks Pavel I will give it a try and report back.

Beniamin · March 28, 2026, 5:03pm

ok, no luck. I removed any FW rule that I created. Went to Port forwarding, created a rule as such, but when I go to chrome on the Pixel Device, it seems that Safe/Search/Porn still work. Maybe I need to enable logging.

Here are my screenshots.

dave14305 · March 28, 2026, 5:11pm

Is the Pixel using encrypted DNS? Try adding a rule to block TCP port 853 from LAN, as a test.

Beniamin · March 28, 2026, 5:25pm

Good idea!!! Let me try. Thank you.

Beniamin · March 28, 2026, 9:06pm

No luck @dave14305

block_853	Forwarded IPv4 and IPv6, protocol TCP From lan To wan, port 853	Reject forward

dave14305 · March 28, 2026, 9:58pm

Browse to https://dnscheck.tools from the pixel. What does it report for dns servers?

darkhole · March 28, 2026, 9:59pm

have you turned off randomized MAC on the pixel for your wlan connection?

Beniamin · March 29, 2026, 12:51am

I created the same dns hijack for my mac.

Your IP addresses (permission needed):

Charter Communications

xx.x.187ptr: syn-xxx-xxx-xxx-187.res.spectrum.com SOMEHWERE, California, US

Your DNS resolvers:

Charter Communications

66.75.177.3ptr: lsaica-dns-cac-300.ns.charter.comLos Angeles, California, US
66.75.177.4ptr: lsaica-dns-cac-301.ns.charter.comLos Angeles, California, US
66.75.177.5ptr: lsaica-dns-cac-302.ns.charter.comLos Angeles, California, US
66.75.177.6ptr: lsaica-dns-cac-303.ns.charter.comLos Angeles, California, US
66.75.177.7ptr: lsaica-dns-cac-304.ns.charter.comLos Angeles, California, US
66.75.177.8ptr: lsaica-dns-cac-305.ns.charter.comLos Angeles, California, US
66.75.177.9ptr: lsaica-dns-cac-306.ns.charter.comLos Angeles, California, US
66.75.177.10ptr: lsaica-dns-cac-307.ns.charter.comLos Angeles, California, US
66.75.177.11ptr: lsaica-dns-cac-308.ns.charter.comLos Angeles, California, US
66.75.177.12ptr: lsaica-dns-cac-309.ns.charter.comLos Angeles, California, US
66.75.177.13ptr: lsaica-dns-cac-310.ns.charter.comLos Angeles, California, US
66.75.177.14ptr: lsaica-dns-cac-311.ns.charter.comLos Angeles, California, US
66.75.177.15ptr: lsaica-dns-cac-312.ns.charter.comLos Angeles, California, US

Oh no! Your DNS responses are not authenticated with DNSSEC:

	ECDSA P-256	ECDSA P-384	Ed25519
Valid signature	PASS	PASS	PASS
Invalid signature	FAIL	FAIL	FAIL
Expired signature	FAIL	FAIL	FAIL
Missing signature	FAIL	FAIL	FAIL

Beniamin · March 29, 2026, 12:52am

Yes, i tried random and real mac on the pixel, but same thing.

dave14305 · March 29, 2026, 12:54am

Ok, something else is going on then.

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button (red circle; this works best in the 'Markdown' composer view in the blue oval):

Remember to redact passwords, VPN keys, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/dhcp
cat /etc/config/firewall

Beniamin · March 29, 2026, 1:05am

root@OpenWrt:~/codex-moci# ubus call system board
{
        "kernel": "6.12.77",
        "hostname": "OpenWrt",
        "system": "ARMv8 Processor rev 4",
        "model": "GL.iNet GL-MV1000",
        "board_name": "glinet,gl-mv1000",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "SNAPSHOT",
                "firmware_url": "https://downloads.openwrt.org/",
                "revision": "r33558-52063ff831",
                "target": "mvebu/cortexa53",
                "description": "OpenWrt SNAPSHOT r33558-52063ff831",
                "builddate": "1774469623"
        }
}
root@OpenWrt:~/codex-moci#

root@OpenWrt:~/codex-moci# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        list ipaddr '127.0.0.1/8'

config globals 'globals'
        option dhcp_default_duid '0004594d44615e574e9aa40b4d2a0c0973ea'
        option ula_prefix 'fd37:eabd:a333::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan0'
        list ports 'lan1'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        list ipaddr '192.168.1.1/24'
        option ip6assign '60'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config interface 'wg'
        option proto 'wireguard'
        option private_key '11111111111='
        list addresses '10.10.10.15/24'
        list dns '1.1.1.1'
        option multipath 'off'

config wireguard_wg
        option description 'Imported peer configuration'
        option public_key '11111111='
        option preshared_key 'eV7='
        list allowed_ips '10.10.10.0/24'
        option persistent_keepalive '25'
        option endpoint_host 'benisai.com'
        option endpoint_port '11111'

root@OpenWrt:~/codex-moci#

root@OpenWrt:~/codex-moci# cat /etc/config/dhcp

config dnsmasq
        option domainneeded '1'
        option boguspriv '1'
        option filterwin2k '0'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option nonegcache '0'
        option cachesize '1000'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
        option nonwildcard '1'
        option localservice '1'
        option ednspacket_max '1232'
        option filter_aaaa '0'
        option filter_a '0'

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '12h'
        option dhcpv4 'server'
        option dhcpv6 'server'
        option ra 'server'
        option ra_slaac '1'
        list ra_flags 'managed-config'
        list ra_flags 'other-config'

config dhcp 'wan'
        option interface 'wan'
        option ignore '1'

config odhcpd 'odhcpd'
        option maindhcp '0'
        option leasefile '/tmp/odhcpd.leases'
        option leasetrigger '/usr/sbin/odhcpd-update'
        option loglevel '4'
        option piodir '/tmp/odhcpd-piodir'
        option hostsdir '/tmp/hosts'

config host
        option name 'MacbookAir'
        option mac 'a8:8f:d9:54:3a:2e'

config host
        option name 'GL-AR300'
        option mac 'e4:95:6e:41:1c:59'

config host
        option name 'Router'
        option mac '94:83:c4:0a:40:93'

config host
        option name 'WAN'
        option mac '94:83:c4:0a:40:92'

config host
        option name 'Firewalla'
        option mac '20:6d:31:31:56:d4'

config host
        option name 'Fire10HD'
        option mac 'a2:4f:c5:a3:05:c2'

config domain
        option name 'fireoscaptiveportal.com'
        option ip '127.0.0.1'

root@OpenWrt:~/codex-moci#

root@OpenWrt:~/codex-moci# cat /etc/config/firewall

config defaults
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'DROP'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config zone
        option name 'WG_VPS'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option masq '1'
        option mtu_fix '1'
        list network 'wg'

config forwarding
        option src 'lan'
        option dest 'WG_VPS'

config redirect
        option dest 'lan'
        option target 'DNAT'
        option name 'port80'
        option src 'WG_VPS'
        option src_dport '80'
        option dest_port '80'
        option dest_ip '192.168.1.1'

config rule
        option name 'moci_block_dot_853'
        option src 'lan'
        option dest 'wan'
        option proto 'tcp'
        option dest_port '853'
        option target 'REJECT'
        option enabled '1'

config redirect
        option name 'moci_dns_hijack_MacbookAir'
        option src 'lan'
        option src_mac 'a8:8f:d9:54:3a:2e'
        option proto 'tcp udp'
        option src_dport '53'
        option dest_ip '1.1.1.3'
        option dest_port '53'
        option target 'DNAT'
        option family 'ipv4'
        option reflection '0'
        option enabled '1'

config redirect
        option name 'moci_dns_hijack_Pixel-9a'
        option src 'lan'
        option src_mac 'a6:63:c4:e3:ac:c8'
        option proto 'tcp udp'
        option src_dport '53'
        option dest_ip '1.1.1.3'
        option dest_port '53'
        option target 'DNAT'
        option family 'ipv4'
        option reflection '0'
        option enabled '1'

dave14305 · March 29, 2026, 1:20am

Thanks. Can you run:

nft list chain inet fw4 dstnat_lan

Beniamin · March 31, 2026, 12:33am

root@OpenWrt:~# nft list chain inet fw4 dstnat_lan
table inet fw4 {
        chain dstnat_lan {
                ip saddr 192.168.1.0/24 ip daddr 10.10.10.15 tcp dport 80 dnat ip to 192.168.1.1:80 comment "!fw4: port80 (reflection)"
                ip saddr 192.168.1.0/24 ip daddr 10.10.10.15 udp dport 80 dnat ip to 192.168.1.1:80 comment "!fw4: port80 (reflection)"
                meta nfproto ipv4 tcp dport 53 ether saddr a8:8f:d9:54:3a:2e counter packets 0 bytes 0 dnat ip to 1.1.1.3:53 comment "!fw4: moci_dns_hijack_MacbookAir"
                meta nfproto ipv4 udp dport 53 ether saddr a8:8f:d9:54:3a:2e counter packets 37 bytes 2541 dnat ip to 1.1.1.3:53 comment "!fw4: moci_dns_hijack_MacbookAir"
                meta nfproto ipv4 tcp dport 53 ether saddr a6:63:c4:e3:ac:c8 counter packets 0 bytes 0 dnat ip to 1.1.1.3:53 comment "!fw4: moci_dns_hijack_Pixel-9a"
                meta nfproto ipv4 udp dport 53 ether saddr a6:63:c4:e3:ac:c8 counter packets 0 bytes 0 dnat ip to 1.1.1.3:53 comment "!fw4: moci_dns_hijack_Pixel-9a"
        }
}
root@OpenWrt:~#

dave14305 · March 31, 2026, 12:38am

Only the MacBook Air rule has any hits (37 packets). The Pixel rule isn’t working. Either the MAC address is wrong, or the Pixel isn’t connected to lan directly, or it’s using encrypted DNS or a VPN.

Beniamin · March 31, 2026, 3:40am

I switched to the macbook so I can copy paste the dns info from the test site. but its the same setup per the rules.

Beniamin · April 8, 2026, 6:59pm

Anything else I can poke or look at? Do my configs look ok? What am I missing here