Help w/ nft rule to add DNS redirect for inverted matching

[maleko48]

I currently have a blanket redirect rule setup for my home network running on OpenWrt, and am trying to stay within OpenWrt rather than integrating an additional firewall such as OpnSense or pfSense.

My current generic Port Forwards for DNS --> router:

My current firewall rules:

followed by, "rogue-dns-block" rules:

As per the Netgate docs for pfSense (using for general reference):

A quick poke about online I was using these sites for some hopeful references:

https://wiki.nftables.org/wiki-nftables/index.php/Quick_reference-nftables_in_10_minutes#Ip

https://www.netfilter.org/projects/nftables/manpage.html

https://openwrt.org/docs/guide-user/firewall/misc/nftables

So far I have tried the adding the following (repeated for each VLAN) to /etc/firewall.user with no luck when restarting the firewall service:

nft add rule inet fw4 prerouting iifname "BR-VLAN.10" ip daddr != 10.10.50.5 udp dport 53 dnat to 10.10.50.5:53

nft add rule inet fw4 prerouting iifname "BR-VLAN.10" ip protocol tcp tcp dport 53 ip daddr != 10.10.50.5 dnat to 10.10.50.5
nft add rule inet fw4 prerouting iifname "BR-VLAN.10" ip protocol udp udp dport 53 ip daddr != 10.10.50.5 dnat to 10.10.50.5

My question is:

How big of a deal is it redirecting all traffic versus only traffic not already heading toward my AGH for DNS resolution?

Seems to me like the Netgate docs are for optimal performance and latency, but that my current setup should also function adequately?

Obviously I want to avoid any DNS loops, but I am looking to capture and redirect and was trying to build the equivalent NFT rule to achieve what the Netgate docs specify, but have not yet been successful in OpenWrt accepting such a rule due to errors...

[pavelgl]

@maleko48

So far I have tried the adding the following (repeated for each VLAN) to /etc/firewall.user

After the switch to fw4, /etc/firewall.user is no longer used.
For custom rules, see

https://openwrt.org/docs/guide-user/firewall/firewall_configuration#includes_2203_and_later_with_fw4

@maleko48

nft add rule inet fw4 prerouting iifname "BR-VLAN.10" ip daddr != 10.10.50.5 udp dport 53 dnat to 10.10.50.5:53

You must use the (predefined) dstnat chain, which type is nat, not filter.

What you want to achieve can be done with an additional setting in the DNAT rule(s), but that's not so intuitive. Go to the advanced settings of the rule and use the External IP address field.

Also, the "Adguard reply" rules are useless, in your case even wrong.
The DNS replies are returned from source port 53, not sent to destination port 53.

[lleachii]

Dmz firewall: why redirect don't work?

Solution found, strange but works config redirect option name 'Http1' option target DNAT option src wan option dest lan option proto tcp option src_dport 443 option dest_ip 192.168.179.3 option dest_port 443 option enabled 1 config redirect option name 'Https1' option target DNAT option src wan …

[maleko48]

@pavelgl

After the switch to fw4, /etc/firewall.user is no longer used.
For custom rules, see

https://openwrt.org/docs/guide-user/firewall/firewall_configuration#includes_2203_and_later_with_fw4

thanks for informing me on this

@pavelgl

@maleko48

nft add rule inet fw4 prerouting iifname "BR-VLAN.10" ip daddr != 10.10.50.5 udp dport 53 dnat to 10.10.50.5:53

You must use the (predefined) dstnat chain, which type is nat, not filter.

What you want to achieve can be done with an additional setting in the DNAT rule(s), but that's not so intuitive. Go to the advanced settings of the rule and use the External IP address field.

Thank you for this one! I did not think it was possible in OWrt.
I set mine up as follows:

@pavelgl

Also, the "Adguard reply" rules are useless, in your case even wrong.
The DNS replies are returned from source port 53, not sent to destination port 53.

Some degree of a network rule audit post is hopefully in my future if that's something this community is willing to do. I have this now:

I forgot where it was I was told I needed those rules. Definitely a lot of trial and error going on with many recoonfigurations and frequent changes right now while I figure all this stuff out.

Thanks again!