DOH per interface/client

[lleachii]

@Kcajminer2312

I have one for each interface IP

Just FYI, you can add more IPs to an interface, if this helps.

I think you're saying you need a unique proxy instance for all your "unidentified devices". You're using the OpenWrt as a DoH proxy for "unidentified devices" to use DoH and appear by hostname in your NEXTDNS online panel.

While I'm not sure if it's necessary (or sensible), you can assign multiple IPs to e.g. LAN, and then bind as you wish. The unidentified clients can then be directed to that DNS proxy per the configuration you assigned to that IP and DoH connection.

Albeit, this would work if I understood your current use case correctly (and assuming you've properly configured the OpenWrt as a dumb AP, which your discussion leads me to believe otherwise).

---

Edit:

This also requires an advanced DHCP server that could e.g. assign the various DNS [proxy] server IPs to the correct clients. OpenWrt is capable of doing that, not sure about this "upstream" router.

BTW, if it is upstream, a router should not have the same addressing on 2 different interfaces, unless specially configured (hence maybe why your relay discussion is confusing).

[Kcajminer2312]

@lleachii

properly configured the OpenWrt as a dumb AP, which your discussion leads me to believe otherwise).

Thats the first thing I do now

@lleachii

Just FYI, you can add more IPs to an interface, if this helps.

I don’t think it will, as the proxys are getting combined for some reason

@lleachii

This also requires an advanced DHCP server that could e.g. assign the various DNS [proxy] server IPs to the correct clients. OpenWrt is capable of doing that

that sounds like what I need, the upstream router could just be ignored or even disabled

@lleachii

BTW, if it is upstream, a router should not have the same addressing on 2 different interfaces

do you mean the 192.168.1.1 and 192.168.1.254?

if so there different devices, 192.168.1.1 is the upstream main router, and 192.168.1.254 is the openwrt router

Can you either tell me more about the “advanced DHCP server that could e.g. assign the various DNS [proxy] server IPs to the correct clients.“ or send me a link to information

thank you

[lleachii]

@Kcajminer2312

Can you either tell me more about the “advanced DHCP server that could e.g. assign the various DNS [proxy] server IPs to the correct clients.“ or send me a link to information

thank you

Client classifying and individual options - [OpenWrt Wiki] DHCP and DNS examples

You would create tags for the MAC of each device, assigning the IP which corresponds to the correct instance. There's also examples in the forum you can search for. A common use case is for parents to assign different kid-friendly DNS servers to specific devices. In your case, you describe each IP being a different DNS proxy.

@Kcajminer2312

as the proxys are getting combined for some reason

You are the person making the configurations. Also, I've never heard of someone doing this.

@Kcajminer2312

I don’t think it will

It's definitely possible, I'm just not sure if it will accomplish what you desire.

@Kcajminer2312

do you mean the 192.168.1.1 and 192.168.1.254?

if so there different devices, 192.168.1.1 is the upstream main router, and 192.168.1.254 is the openwrt router

That's already understood. I think you misunderstood my concern. Those IPs are the same subnet, but you were discussing "relaying". This implies you may have a misconfiguration.

@Kcajminer2312

Thats the first thing I do now

But you assure us that the device is properly configured.

[Ohfalderal]

DNSMASQ can assign a hostname to a MAC address using the --dhcp-host directive.
N.B. (1) - DNSMASQ must assign DHCP addresses for the interface (although the thread infers DHCP is active elsewhere)
N.B. (2) - DNS query logging should first be enabled (--log-queries) to harvest the MAC addresses of the IoT devices (to assign each a hostname from DNSMASQ

N.B. (*) - add DNSMASQ directives in /etc/dnsmasq.conf

The https-dns-proxy default option, force_dns adds a firewall rule that redirects DNS queries to the interface on which DNSMASQ is configured to listen for DNS requests. This HDP capability reroutes DNS requests from devices that have an internally defined DNS address.

[Kcajminer2312]

how would I specify a proxy address in this case

dnsmasq would know the hostname, but that would not get forwarded to the external NextDNS server without DOH

can dnsmasq be setup where it could use “https://dns.nextdns.io/c5829d/LAN-RE305https://dns.nextdns.io/c#####/{Device-Hostname}“, that also goes to this as well

@lleachii

ou would create tags for the MAC of each device, assigning the IP which corresponds to the correct instance. There's also examples in the forum you can search for. A common use case is for parents to assign different kid-friendly DNS servers to specific devices. In your case, you describe each IP being a different DNS proxy.

as I only see IP address options, unless I am missing something

[Kcajminer2312]

@lleachii

You are the person making the configurations. Also, I've never heard of someone doing this.

Its the force_dns option I think, but I can’t find where to disable it, is it in /etc/config/network or somewhere else

@lleachii

@Kcajminer2312

Thats the first thing I do now

But you assure us that the device is properly configured.

The “Dumb AP“ instructions have changed, but I Change the IP address, DNS and disable DHCP, then add an AP SSID to the lan interface

[egc]

You can use multiple DNSMasq instances e.g. one per interface or use tagging to set different clients to different DNSMasq instances.
Each DNSMasq instances can use a different DOH resolver via https-dns-proxy

[Ohfalderal]

No.
DNSMASQ offers the --server directive (which HDP dynamically adds its instance listeners, typically 127.0.0.1:505n, to the DNSMASQ configuration) which accepts only IP addresses (not URIs).

That HDP is a configuration and instance launch of the https-dns-proxy executable, once its initialisation script (/etc/init.d/https-dns-proxy) has been processed by procd, influencing the URI of the DNS request, the configured DoH server, is not possible.

[Ohfalderal]

This is true but considering the additional resources required, probably not advisable. Added to that, HDP is currently not, IMNSHO, granular enough regarding configuration(s). It has the capability to target discrete DNSMASQ instances but has limitations within its global directives.

[Ohfalderal]

force_dns is a https-dns-proxy directive.

[reinerotto]

You can use firewall rules, based on clients MAC, to divert DNS to different instances of dnsmasq+https-dns-proxies.

[lleachii]

The OP insists that they have a properly configured Dumb AP. The OpenWrt firewall may not work.

[Kcajminer2312]

@Ohfalderal

force_dns is a https-dns-proxy directive.

list force_dns_src_interface 'lan'

that would stop everything going though lan, correct?

then the interface way would probably work

buts that going to be a lot of interfaces, I would have to group by type which would mostly get to my goal

it seems independent per client will be a lot of work

@reinerotto

You can use firewall rules, based on clients MAC, to divert DNS to different instances of dnsmasq+https-dns-proxies.

so for all clients that would be about 16 dnsmasq instances

[Kcajminer2312]

# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option ula_prefix 'fda1:5d42:b57::/48'
        option packet_steering '1'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'eth0'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.253'
        option netmask '255.255.0.0'
        option ip6assign '60'
        option gateway '192.168.1.1'
        list dns '192.168.1.1'

config switch
        option name 'switch0'
        option reset '1'
        option enable_vlan '0'

# cat /etc/config/firewall

config defaults
        option syn_flood '1'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        list network 'lan'

config zone
        option name 'wan'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wan'
        list network 'wan6'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-IPSec-ESP'
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option name 'Allow-ISAKMP'
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

[lleachii]

@Kcajminer2312

buts that going to be a lot of interfaces

Or you can assign multiple IP, but again you need a DHCP server that can do tagging (or a firewall that can redirect).

@Kcajminer2312

# cat /etc/config/firewall

Not sure why you posted the firewall. As I noted:

@lleachii

OP insists that they have a properly configured Dumb AP. The OpenWrt firewall may not work.

If you have a Dumb AP, your OpenWrt firewall isn't involved. This is why I took a part of the discussion to inquire if your device was configured as a Dumb AP.

[Kcajminer2312]

@lleachii

Or you can assign multiple IP, but again you need a DHCP server that can do tagging (or a firewall that can redirect).

If I did tagging, I wouldn’t need more than one interface IP would I

but I either need to tag to the DOH url, or tag to a dnsmasq instance that then goes to HDP

@lleachii

@lleachii

OP insists that they have a properly configured Dumb AP. The OpenWrt firewall may not work.

If you have a Dumb AP, your OpenWrt firewall isn't involved. This is why I took a part of the discussion to inquire if your device was configured as a Dumb AP.

Have I been doing it wrong all this time?

I though the lan firewall was still used

so I have dump AP with firewall still enabled, but I probably don’t need the firewall and it probably makes things worse

[lleachii]

@Kcajminer2312

but I either need to tag to the DOH url

Not sure how you came to that conclusion, but I've seen you mention it a few times. You already mentioned that these "unidentified devices" don't do DoH, hence needing a proxy. So I'm not sure what "tag the DoH URL" means.

@Kcajminer2312

or tag to a dnsmasq instance that then goes to HDP

Yes.

@Kcajminer2312

Have I been doing it wrong all this time?

I though the lan firewall was still used

so I have dump AP with firewall still enabled, but I probably don’t need the firewall and it probably makes things worse

The Dumb AP documentation must have really changed significantly. If you're not routing traffic across interfaces (i.e., LAN to WAN), the firewall isn't generally involved.

[Kcajminer2312]

@lleachii

"unidentified devices" don't do DoH, hence needing a proxy. So I'm not sure what "tag the DoH URL" means.

Thats the whole point of this, If I did the DHCP tagging, the DNS would have to go to 45.XXX.XXX.XXX thats my personal IP for NextDNS, with the DOH https://dns.nextdns.io/c#####/John's%20Firefox

if you just use an IP, you only get the router IP at the NextDNS side, which is determined unidentified

@lleachii

@Kcajminer2312

or tag to a dnsmasq instance that then goes to HDP

Yes.

Now I think about that, what would the listen address be

I would still need an interface for each device wouldn’t I, and a dnsmasq instance for each device

@lleachii

The Dumb AP documentation must have really changed significantly. If you're not routing traffic across interfaces (i.e., LAN to WAN), the firewall isn't generally involved.

I am sure back when I was setting up a repeater it was used, I has wwan in the wan firewall and lan in the lan firewall relay bridged, but here we have no wan

so if you could explain how I connect/bridge each dnsmasq instance to HDP

but then wouldn’t I need to lock the client to that dnsmasq instance, the dnsmasq listen address?

tag the DHCP to that address?

I think I am going to need an example config

[lleachii]

@Kcajminer2312

Thats the whole point of this, If I did the DHCP tagging, the DNS would have to go to 45.XXX.XXX.XXX thats my personal IP for NextDNS

45.x.x.x is a public IP. You lost me again.

@Kcajminer2312

if you just use an IP, you only get the router IP at the NextDNS side, which is determined unidentified

Using a different URL for each proxy instance so NEXTDNS seees each instance as a separate device - I thought that was the whole point.

@Kcajminer2312

Now I think about that, what would the listen address be

To remind again:

@lleachii

you can assign multiple IP

@Kcajminer2312

so if you could explain how I connect/bridge each dnsmasq instance to HDP

but then wouldn’t I need to lock the client to that dnsmasq instance, the dnsmasq listen address?

tag the DHCP to that address?

That's what we've been discussing.

@Kcajminer2312

I think I am going to need an example config

You already asked above and I provided information.

[Kcajminer2312]

@lleachii

45.x.x.x is a public IP. You lost me again.

thats where the DNS need to go to, along with the DOH url

@lleachii

Using a different URL for each proxy instance so NEXTDNS seees each instance as a separate device - I thought that was the whole point.

Yes your correct, I clearly didn’t explain that very good, well its sort of exactly what I said but DOH is needed without it you just get the main router WAN IP

@lleachii

To remind again:

@lleachii

you can assign multiple IP

I don’t really see how that is useful, as then everything is going to the same place

@lleachii

You already asked above and I provided information.

that was for the tagging

I meant the dnsmasq config, each client would need a different DNS server for each instances of dnsmasq wouldn’t it or a different port at least