DNS hijacking with 2 servers, if dest not router redirect to adguard, possible?

Installing and Using OpenWrt
1

Hi all,
Is it possible to set up the firewall in a way to redirect all DNS requests, that don't specifically have the router(dnscrypt-proxy2) as destination, to my AdGuard home server?


I want to give out the AdGuard server as first DNS server per DHCP option, and the router itself as second, so that if AdGuard bugs out / crashes there's still a working DNS server.

I also plan on setting up AdGuard to use the router(dnscrypt-proxy2) as upstream resolver and set up both to use dnsmasq( port 54) to reverse lookup local domains.

This setup is working fine so far, except that I have no idea how to set up the firewall to hijack and redirect everything that isn't going to one of the two servers and redirect everything else to one chosen server.


Also, how common are devices that load balance instead of only using the second DNS server option if the first can't be reached, and therefore escape the add block?

Why all the hassle? I like the idea of two functional DNS servers and having one that's completely unfiltered that can be hard-coded to test things, I also don't fully trust the device hosting AdGuard to have the desired uptime stability, yet.

2

It is possible to setup the firewall as you describe, you merely ACCEPT if the packet goes to the router, or redirect to AdGuard in any other case.
However keep in mind that dns clients may be using both primary and secondary resolvers, not necessarily to try primary and only if it fails to try secondary. So basically they will get the reply from the fastest resolver.