Forwarding all DNS to Adguard except one VLAN

Hi, I'm wondering to use iptables to forward all my DNS traffic to my AdguardHome docker EXCEPT one VLAN gateway.

e.g.
192.168.1.0/24 ( VLAN 1 ) forward to 192.168.1.123:53 ( Adguardhome IP )
192.168.2.0/24 ( VLAN 2 ) - to keep using 9.9.9.9, no forwarding rule
192.168.3.0/24 ( VLAN 3 ) forward to 192.168.1.123:53 ( Adguardhome IP )

So, I put the following on the firewall custom rules at first in order to forward all interfaces to my Adguardhome.

iptables -t nat -A POSTROUTING -j MASQUERADE
iptables -t nat -I PREROUTING -i br+ ! -s 192.168.1.123 -p tcp --dport 53 -j DNAT --to 192.168.1.123:53
iptables -t nat -I PREROUTING -i br+ ! -s 192.168.1.123 -p udp --dport 53 -j DNAT --to 192.168.1.123:53

May I know what should I add for the sake of keeping VLAN 2 to use 9.9.9.9 as DNS without leaking?

Thanks for your help!!!

1 Like

Thanks Ileachill. Is that possible to modify the scripts directly in my previous post to exclude my VLAN 2 traffic?

Yes, it is.

Edit - acutally thinking about it. It would just be easier to pass 9.9.9.9 dns directly to your vlan 2 group and pass your filtered DNS to the other two. Just change the DHCP settings for each group.

edit2 - also if you werent aware there is a way to run AGH on your router directly either by using the AGH edge client or the opkg openwrt version. [How-To-Updated 2021] Installing AdGuardHome on OpenWrt [Manual and opkg method]

IIRC you can do it via AGH itself

you can specify rules for clients or client groups. https://github.com/AdguardTeam/AdGuardHome/wiki/Hosts-Blocklists#client has more info.

1 Like

mercygroundabyss, thanks for your advice and I will try. By the way, I know the AGH is able being installed directly on my router but the size of /tmp/ will become bigger. I am afraid to pay lots of efforts for maintenance.

As long as you have space it should be ok. I'm guessing you using the opkg version that keeps its data in /tmp? That means you will flush on reboot.

On a full install to the /opt folder you really require about 100mb of space.
35mb for the AGH binary and again for when it backups and upgrades. (that's in the agh-backup folder)
My Filters take 20mb for me. (Again you can raise or lower this depending on what lists you use)

However you will need to tweak your logging.

I am keeping

  • 90 days of statistics (2mb file at present)
  • 7 days of query logs (last 7 days was 53mb)

You can turn these off or down as required. I've included my listings of the folders to give an overview.

root@OpenWrt:/opt/AdGuardHome# ll -h
drwxrwxrwx    4 root     root        3.4K May 13 20:50 ./
drwxr-xr-x    7 root     root        4.0K May 12 22:15 ../
-rwxr-xr-x    1 root     root       34.0M May 13 20:50 AdGuardHome*
-rw-rw-rw-    1 root     root         331 May 13 20:50 AdGuardHome.sig
-rw-r--r--    1 root     root        6.5K May 13 20:50 AdGuardHome.yaml
-rw-r--r--    1 root     root       41.2K May 13 20:50 CHANGELOG.md
-rw-r--r--    1 root     root       34.3K May 13 20:50 LICENSE.txt
-rw-r--r--    1 root     root       22.7K May 13 20:50 README.md
drwxr-xr-x    2 root     root        3.4K May 13 20:50 agh-backup/
drwxr-xr-x    3 root     root        3.4K May 19 23:21 data/
root@OpenWrt:/opt/AdGuardHome/data# ll -h
drwxr-xr-x    3 root     root        3.4K May 19 23:21 ./
drwxrwxrwx    4 root     root        3.4K May 13 20:50 ../
drwxr-xr-x    2 root     root        3.4K May 20 18:51 filters/
-rw-r--r--    1 root     root       10.9M May 21 18:02 querylog.json
-rw-r--r--    1 root     root       52.9M May 19 21:32 querylog.json.1
-rw-r--r--    1 root     root       32.0K May 18 21:09 sessions.db
-rw-r--r--    1 root     root        2.0M May 21 18:00 stats.db
root@OpenWrt:/opt/AdGuardHome/data/filters# ll -h
drwxr-xr-x    2 root     root        3.4K May 20 18:51 ./
drwxr-xr-x    3 root     root        3.4K May 19 23:21 ../
-rw-r--r--    1 root     root      865.8K May 20 18:50 1.txt
-rw-r--r--    1 root     root       10.4K May 20 18:50 1625359387.txt
-rw-r--r--    1 root     root        7.9K May 20 18:50 1625359388.txt
-rw-r--r--    1 root     root        3.5M May 20 18:50 1625359390.txt
-rw-r--r--    1 root     root        5.9K May 20 18:50 1625359391.txt
-rw-r--r--    1 root     root        3.6K May 20 18:51 1625359392.txt
-rw-r--r--    1 root     root      266.1K May 20 18:50 1625359393.txt
-rw-r--r--    1 root     root       13.3M May 20 18:50 1633201708.txt
-rw-r--r--    1 root     root        1.3M May 20 18:50 1635888815.txt
-rw-r--r--    1 root     root       18.1K May 20 18:50 1639602953.txt
-rw-r--r--    1 root     root      359.9K May 20 18:50 1639602955.txt
-rw-r--r--    1 root     root       83.8K May 20 18:51 1639602956.txt

Thanks for your sharing. I'm now trying according to your advice.

1 Like