Restrict all dns queries to local server only

[Cylac]

I currently have all my DNS queries being restricted to only allow my router to send DNS responses. This way clients can't bypass my dns server by specifying their own DNS address.

config redirect 'dns_int'
        option name 'Intercept-DNS'
        option src 'lan'
        option src_dport '53'
        option family 'ipv4'
        option proto 'tcp udp'
        option target 'DNAT'

iptables-save -t nat | sed -e "/\s[DS]NAT\s/d;/\sMASQUERADE$/d" | ip6tables-restore -T nat

This works perfectly right now! My question is, is there a way I can let 1 particular client still have the ability to query external dns servers?

primary router/primary dns: 192.168.0.1
secondary ap/seconday dns: 192.168.0.2

I have a second router that's setup as a backup ap/dns server.

thanks

[trendy]

You can, but not from Luci.

Block and Redirect DNS to PiHole

You are right! I tried the masquerade rules (initially I thought you were saying about the wan postrouting masquerade) and now replies back to clients seem to come from the legitimate nameserver. Regarding IPv6 why are you trying to masquerade on the wan? Any host contacting some other host on the internet should use the GUA, not the LUA. I also fixed the reply from unexpected source for ipv6 just with this: ip6tables -t nat -A POSTROUTING -d fd00:bbbb::2 -p udp -m udp --dport 53 -m comment --…

Check the rules I have to allow Pihole to query internet.