DNS interception > best practices

Installing and Using OpenWrt Network and Wireless Configuration
1

Hi,
I have installed OpenWrt on x86 server.
The setup includes

  • multiple interfaces (with VLAN): iot, dmz, lan
  • AdGuard Home
  • Unbound

Now I want to configure DNS interception / hijacking.
There are guides in OpenWrt documentation here and here.
However the instructions are not 100% consistent.
Currently I have this relevant firewall setting (for zone iot):

[...]
config rule
	option name 'IoT: Block-DNS-other-networks'
	list proto 'tcp'
	list proto 'udp'
	option src 'iot'
	option dest '*'
	option dest_port '53'
	option target 'REJECT'
[...]
config redirect
	option target 'DNAT'
	option name 'IoT: Intercept-DNS'
	option src 'iot'
	option src_dport '53'
[...]

Is there any other firewall rule required to intercept and redirect DNS queries?

I searched in internet and found another guide with different instructios:

  1. Create a port forward rule that intercepts all traffic destined for the Internet on port 53 and redirect it to the PiHole
  2. Create a NAT rule that rewrites the source of the DNS response (the PiHole) to match the intended source (the hardcoded DNS)

Can you please advise?

THX

2

You could also add a rule blocking port 853 for devices using hardcoded DNS over TLS. The idea being that they'll fall back to plain dns and get intercepted by AGH.

Here's my rules:

config redirect 'dns_int'
        option name 'Intercept-DNS'
        option family 'ipv4'
        option proto 'tcp udp'
        option src 'lan'
        option src_dport '53'
        option target 'DNAT'
        option dest_ip 'YOUR_DNS_SERVER_IP'
        list src_mac '!xx:xx:xx:xx:xx:xx' # change to your DNS mac address
	list src_mac '!xx:xx:xx:xx:xx:xx' # change to your agh mac
	list src_mac '!xx:xx:xx:xx:xx:xx' # change to your unbound mac
	list src_mac '!xx:xx:xx:xx:xx:xx' # change to your router mac


config rule 'dot_fwd'
        option name 'Deny-DoT'
        option src 'lan'
        option dest 'wan'
        option dest_port '853'
        option proto 'tcp udp'
        option target 'REJECT'
        list src_ip '!YOUR_DNS_IP'
	list src_ip '!AGH_IP'
	list src_ip '!UNBOUND_IP'
	list src_ip '!ROUTER_IP'

I use ! to hijack everything but the devices listed in the rules

1 Like
3

You can also redirect DoT to AdGuard, in case you don't trust devices on your local network, instead of them falling back to plain DNS.

4

Do I need to adjust configuration in AdGuard Home in order to work with redirected DoT requests?

5

You need to enable encryption and set up valid certificates in the Encryption settings.

6

Iā€™m only on my second cup of coffee this morning, but how do you redirect DoT without failing TLS validation by the client?

2 Likes