OpenWrt 23.05.5... My lan subnet is 10.19.76.0/24 (and the not-so-usual use of a bonded interface between the router and my switch):
/etc/config/network:
config device
option name 'br-lan'
option type 'bridge'
option bridge_empty '1'
list ports 'bond-LACP'
list ports 'eth0'
option ipv6 '0'
option stp '1'
option priority '32767'
config interface 'lan'
option proto 'static'
list ipaddr '10.19.76.1/24'
option broadcast '10.19.76.255'
option delegate '0'
option device 'br-lan.1'
list dns '10.19.76.13'
config interface 'LACP'
option proto 'bonding'
option netmask '255.255.255.0'
list slaves 'eth1'
list slaves 'eth2'
option all_slaves_active '0'
option bonding_policy '802.3ad'
option min_links '0'
option ad_select 'stable'
option link_monitoring 'mii'
option miimon '1000'
option downdelay '2000'
option updelay '5000'
option use_carrier '1'
option ad_actor_sys_prio '8192'
option lacp_rate 'fast'
option delegate '0'
option xmit_hash_policy 'layer3+4'
option ipaddr '10.19.75.2'
I have pihole+unbound running on a server at VIP 10.19.76.13 (floats in a HA setup, with 10.19.76.12 and 10.19.76.14 the "real" IPs of the hosts).
I have a firewall rule to redirect DNS requests to the pihole VIP, excluding their range of IPs (as well as the zone config):
/etc/config/firewall:
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
list network 'wg_lan'
list network 'LACP'
config redirect
option target 'DNAT'
option src 'lan'
option src_dport '53'
option dest 'lan'
option dest_ip '10.19.76.13'
option dest_port '53'
option name 'Nemo-Gateway: Redirect DNS to PiHole'
option src_ip '!10.19.76.12/30'
config nat
option name 'Prevents hardcoded DNS Clients from giving unexpected source error after DNS r> list proto 'tcp'
list proto 'udp'
option src 'lan'
option dest_ip '10.19.76.13'
option dest_port '53'
option target 'MASQUERADE'
option enabled '0'
and dnsmasq set to listen on port 0 for dns (so, disabled), and dhcp hands out the dns server option in it's leases:
/etc/config/dhcp:
config dnsmasq
option domainneeded '1'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option authoritative '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option localservice '1'
option ednspacket_max '1232'
option confdir '/tmp/dnsmasq.d'
option port '0'
list addnhosts '/etc/ethers'
config dhcp 'lan'
option interface 'lan'
option dhcpv4 'server'
option force '1'
option netmask '255.255.255.0'
option start '200'
option limit '55'
option leasetime '6h'
list dhcp_option '6,10.19.76.13'
With this, I would expect dns requests in pihole to show up as coming from the IP of the client. So running nslookup daringfireball.net from my computer at 10.19.76.80 (respecting the dhcp-advertised dns server):
~# nslookup daringfireball.net
Server: 10.19.76.13
Address: 10.19.76.13#53
Non-authoritative answer:
Name: daringfireball.net
Address: 104.26.5.133
Name: daringfireball.net
Address: 172.67.74.128
Name: daringfireball.net
Address: 104.26.4.133
pihole.log shows:
Oct 23 14:11:55: query[A] daringfireball.net from 10.19.76.80
Oct 23 14:11:55: forwarded daringfireball.net to 127.0.0.1#5335
Oct 23 14:11:55: reply daringfireball.net is 104.26.5.133
Oct 23 14:11:55: reply daringfireball.net is 172.67.74.128
Oct 23 14:11:55: reply daringfireball.net is 104.26.4.133
But with the disabled firewall NAT rule to masquerade the redirected requests made to a different dns server, I would expect the same pihole logs, and the client to throw an unexpected source error, but that's not the case:
~# nslookup daringfireball.net 8.8.8.8
Server: 8.8.8.8
Address: 8.8.8.8#53
Non-authoritative answer:
Name: daringfireball.net
Address: 104.26.5.133
Name: daringfireball.net
Address: 172.67.74.128
Name: daringfireball.net
Address: 104.26.4.133
pihole.log shows the request originating from the router this time (10.19.76.1):
Oct 23 14:15:13: query[A] daringfireball.net from 10.19.76.1
Oct 23 14:15:13: cached daringfireball.net is 104.26.5.133
Oct 23 14:15:13: cached daringfireball.net is 172.67.74.128
Oct 23 14:15:13: cached daringfireball.net is 104.26.4.133
Likewise, for a non-existant domain that has a record made in pihole, I would expect nslookup to return a NXDOMAIN if I specify the dns server to query, but it does not:
~# nslookup piholetest.example.com 8.8.8.8
Server: 8.8.8.8
Address: 8.8.8.8#53
Name: piholetest.example.com
Address: 123.123.123.123
and pihole shows:
Oct 23 14:18:00: query[A] piholetest.example.com from 10.19.76.1
Oct 23 14:18:00: /etc/pihole/custom.list piholetest.example.com is 123.123.123.123
I'm trying to figure out why masquerading is happening. I'm expecting the packet flow to go from client (10.19.76.80) to gateway router (10.19.76.1) asking for 8.8.8.8:53, router forwards (but doesn't NAT) the packet to the local dns server (10.19.76.13), local dns server responds to the client with the requested info, client complains that it didn't get that response from the server it originally queried (8.8.8.8).