VMG3925-B10B - catch dns requests and forward to local DNS

Options
Kiesel
Kiesel Posts: 5  Freshman Member
edited June 2020 in Smart Home Product
Hi,

I am running a VMG3925-B10B (firmware V5.13(AAVF.14)C0) and I am trying to force all devices in my lan to use my DNS. From what I gathered I need to:

- reroute all traffic to port 53 to my local DNS server
- allow my local dns server to connect authoritative dns servers on port 53 (so exclude it from any blocking).

Can I do this with this router/firmware-combination? I tried to set up a static nat route ("Network Settings"->Routing) but this seems to only forward to WAN.

Any help is appreciated, thank you!


#SP_May_2020

«1

All Replies

  • Hummel
    Hummel Posts: 212  Master Member
    First Anniversary Friend Collector First Comment
    Options
    Not sure what you real want. From your description, you want all LAN traffic goes to your local DNS server? Then can your local DNS server handle all traffic as a gateway? It sounds a bit strange for me. If you can show your planned topology and idea clearly, it will be easy to understand what you try to do.
  • Emerald Dragon
    Emerald Dragon Posts: 118  Ally Member
    First Anniversary
    edited May 2020
    Options
    Sounds like @Kiesel trying to build Traffic Control for Local LAN and use port 53 as the gateway. Routing everything through the local DNS Server to direct traffic.
  • Emerald Dragon
    Emerald Dragon Posts: 118  Ally Member
    First Anniversary
    Options
    @Kiesel - The best way is to build yourself a DNS Server and have everyone log on to it. Like Windows Network. It will automatically force every computers to use the server DNS by default.
  • Kiesel
    Kiesel Posts: 5  Freshman Member
    Options
    I have a pihole (ad and tracking blocker) running on 192.168.178.11. It acts as a dns server and discards requests to domains on the "banned"-list.

    I set 192.168.178.11 as DNS in my zyxel and that works fine for devices that query the zyxel for DNS names. 

    The issue: some devices, like my chromecasts, have a hardcoded DNS server (8.8.8.8/8.8.4.4) and circumvent my DNS server. 

    What I am trying to do is basically running these iptable-rules:

    <b>iptables -t nat -A PREROUTING -i br0 -p udp ! --</b><b>source</b> <b>192.168.178.11 ! --destination&nbsp;</b><b>192.168.178.11&nbsp;</b><b>--dport 53 -j DNAT --to&nbsp;</b>192.168.178.11
     
    <b>iptables -t nat -A PREROUTING -i br0 -p tcp ! --</b><b>source</b> <b>192.168.178.11</b><b>! --destination&nbsp;</b><b>192.168.178.11&nbsp;</b><b>--dport 53 -j DNAT --to&nbsp;</b>192.168.178.11

    Thank you for your help.
  • Emerald Dragon
    Emerald Dragon Posts: 118  Ally Member
    First Anniversary
    Options
    @Kiesel - You sounds like one of my friend/ex-coworker, he build his home network that way. You are going to need more than a VMG3925-B10B to do that.  DNS won't helps you do what you need in that aspect you are trying to do. My first thought was right, you were trying to do "Intrusion Detection Protection" of some type. But I wasn't quite sure after I read your first post.

    You will needs a dedicated Linux Server in the DMZ that will catch all the package before it enter your network, and use it to blocked the packages. I can serves as protecting your network and filters unwanted contents. But you'll have to knows what you are doing. From the looks of what you just posted, seems like you do. Good luck.
  • Kiesel
    Kiesel Posts: 5  Freshman Member
    Options
    @Emerald Dragon
    Is that IDP? I want the packages to be filtered/rerouted before they leave my network. 


    The traffic is supposed to flow like this:

    Chromecast--->My Router-->router redirects to my own DNS-->my own DNS-server queries DNS-server outside my LAN--->My Router--->Chromecast.

    The magic is supposed to happen in "router redirects to my own DNS".
  • Emerald Dragon
    Emerald Dragon Posts: 118  Ally Member
    First Anniversary
    Options
    Yes, more or less IDP.

    All traffic [in/out](Chromecast included) ---> Router --> IDP [sit in the DMZ] (IDP filtered traffic and blocked unwanted) --> Router --> All Traffic [in/out] (Chromecast included)

    Similar concept to what you are trying to do. How are you setting up your DNS Server? Are you just setting it up as a Traffic Redirection?
  • Emerald Dragon
    Emerald Dragon Posts: 118  Ally Member
    First Anniversary
    Options
    BTW! Do you even know what DNS Server purpose is? Just want to makes sure you understand what DNS Server is "Domain Name Service" Server. It resolves IP Address to a conventional name. Just want to be clear. Since you are using the terms a lot.
  • Kiesel
    Kiesel Posts: 5  Freshman Member
    Options
    @Emerald Dragon
    I am pretty sure a DNS resolves host names to ip-addresses, so the other way around?

    Anyway, do you maybe know a way for me to redirect all traffic on port 53 from inside my network to a host inside my network?
  • Kiesel
    Kiesel Posts: 5  Freshman Member
    Options
    My provider gave me the supervisor pw to the box so now I can use iptables :)

Categories

Consumer Product Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）