How do I bypass dns intercept for one host

[greybeard]

I'm using adblock with dns intercept on a snapshot with fw4. I want to allow a single host (ipv4 only) to bypass the dns intercept and access dns servers on the internet.
I am having trouble working out what type of firewall rule to use. Can anyone give me any pointers to work out how to achieve this?
I am comfortable using cli or luci to configure this.

[lleachii]

Configure host-specific DNS server over DHCP (option 6)

The example shows how to set certain hosts to use other DNS servers via DHCP Option No. 6.

Hope this helps.

[mercygroundabyss]

DNS hijacking

You would need two rules. One to do the interception and another rule that is higher priority to Ignore the interception if from X client mac/ip.

Properly setup it would not matter if people manually set DNS to external services as the router will reroute them. (You need additional rules to block encrypted DNS like DOH however)

[greybeard]

Unfortunately not. I want to bypass the dns intercept on my openwrt gateway for a single host on the lan, not configure dhcp to pass out a different dns server ip. Even if I did that the intercept would just capture the dns request.

[greybeard]

Got it in one, but the bit I'm having trouble with is the actual ignore intercept rule. So far the intercept rule works [edit], it's what the ignore intercept rule I haven't sorted yet.

[lleachii]

@greybeard

Unfortunately not. I want to bypass the dns intercept on my openwrt gateway for a single host on the lan, not configure dhcp to pass out a different dns server ip.

Correct, set it for the single host in question by its MAC.

Perhaps I missed something.

[mercygroundabyss]

Exception for a device in a firewall rule

I have this rule to block DNS servers on the local network, but there is a device that acts as a DNS server and I want it not to be affected. Until now I used another rule to allow forwarding to wan from that device, but it seems more convenient and tidy to have everything in the same firewall rule. root@enrutador:~# cat /etc/config/firewall config rule option src 'lan' option dest 'wan' option target 'ACCEPT' option name 'Allow DNS servers for AdGuardHome' …

This thread should assist in creating your exception rule.

(edit) https://openwrt.org/docs/guide-user/firewall/firewall_configuration#rules

config rule
	option	name		'Reject LAN to WAN for custom IP'
	option	src		'lan'
	option	src_ip		'192.168.1.2'
	option	src_mac		'00:11:22:33:44:55'
	option	src_port	'80'
	option	dest		'wan'
	option	dest_ip		'194.25.2.129'
	option	dest_port	'120'
	option	proto		'tcp'
	option	target		'REJECT'

This rule blocks lan to wan but you can adapt it for dns and set the target to accept. Then ensure that rule is ABOVE the DNS Interception rule so it takes priority.

Small point here however. These are IPtables rules aka firewall3. If you are using the newer builds of OpenWrt then it uses NFT tables aka firewall4. Different method of writing rules is required.

[greybeard]

thanks guys
I added the exception bypass by adding a source ip with negation onto the existing intercept rule ie

config redirect 'adblock_lan53'
        option name 'Adblock DNS (lan, 53)'
        option src 'lan'
        option proto 'tcp udp'
        option src_dport '53'
        option dest_port '53'
        option target 'DNAT'
        **option src_ip '!192.168.1.1'**