# Sending All DNS Traffic on LAN via PiHole

**URL:** <https://discourse.pi-hole.net/t/sending-all-dns-traffic-on-lan-via-pihole/23795>\
**Category:** Help\
**Created:** [September 20, 2019, 2:18pm UTC](https://discourse.pi-hole.net/t/sending-all-dns-traffic-on-lan-via-pihole/23795 "2019-09-20T14:18:13Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![mikeyw64](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/m/c4cdca/32.png) [@mikeyw64](https://discourse.pi-hole.net/u/mikeyw64)\
**Post date:** [September 20, 2019, 2:18pm UTC](https://discourse.pi-hole.net/t/sending-all-dns-traffic-on-lan-via-pihole/23795/1 "2019-09-20T14:18:13Z")

</div>

Ok so having got my [guest wifi](https://discourse.pi-hole.net/t/pihole-plus-guest-wifi-on-different-ip-range) setup and all working time for the next little 'problem'

I've added a USB to ethernet adaptor as eth1 & configured it for a static IP of 192.168.1.254 with the intention being of issuing DHCP clients with an IP in the range 192.168.1.100-200 (as it does currently) , DNS of 192.168.1.2 (again as per current setup) but with a default gateway of 192.168.1.254

I already have masquerading setup to allow traffic from wlan0 & eth0 and if I configure my laptop statically for testing with

IP 192.168.1.10  
DNS 192.168.1.2  
DGW: 192.168.1.254

Everything works as expected.

So far so good as that means when I flip the DHCP config everything will still get out to the internet via my main router on 192.168.1.1 (which is set as the DGW for eth0/192.168.1.2)

SO my next challenge is intercepting all outbound DNS traffic and forcing it via the PiHole much the same as [this post](https://discourse.pi-hole.net/t/use-iptables-on-router-to-force-dns-to-pi-hole/8465)

I've added the Pre routing rules and from the laptop an nslookup without any IP specified works as expected via PiHole.

Nslookup using 192.168.1.1 also works as expected as that bounces it back to the PiHole anyways.

The problem comes when i try running nslookup against say 8.8.8.8

```auto
C:\Users\mike>nslookup news.bbc.co.uk 8.8.8.8
DNS request timed out.
    timeout was 2 seconds.
Server: UnKnown
Address: 8.8.8.8

DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
*** Request to UnKnown timed-out

```

my expectation was that it would route transparently vi the Pihole

```auto
pi@Heimdall:~ $ sudo iptables -t nat -L --line-numbers
Chain PREROUTING (policy ACCEPT)
num target prot opt source destination
1 DNAT tcp -- !Heimdall anywhere tcp dpt:domain to:192.168.1.2:53
2 DNAT udp -- !Heimdall anywhere udp dpt:domain to:192.168.1.2:53

Chain INPUT (policy ACCEPT)
num target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
num target prot opt source destination
1 MASQUERADE all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
num target prot opt source destination

```

NB1 have also tried it without adding :53 at the end of the destination but that made no difference

NB2 command used to load iptables was

```auto
iptables -t nat -A PREROUTING -i eth1 ! -s 192.168.1.2 -p tcp --dport 53 -j DNAT --to 192.168.1.2:53
iptables -t nat -A PREROUTING -i eth1 ! -s 192.168.1.2 -p udp --dport 53 -j DNAT --to 192.168.1.2:53

```

---

<div class="post-metadata">

**Author:** ![mikeyw64](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/m/c4cdca/32.png) [@mikeyw64](https://discourse.pi-hole.net/u/mikeyw64)\
**Post date:** [September 20, 2019, 2:42pm UTC](https://discourse.pi-hole.net/t/sending-all-dns-traffic-on-lan-via-pihole/23795/2 "2019-09-20T14:42:43Z")

</div>

Just tried explictly routing traffic from .10 only and not specifying the interface but still getting the same nslookup error

```auto
pi@Heimdall:~ $ sudo iptables -t nat -A PREROUTING -s 192.168.1.10 -p tcp --dport 53 -j DNAT --to-destination 192.168.1.2:53
pi@Heimdall:~ $ sudo iptables -t nat -A PREROUTING -s 192.168.1.10 -p udp --dport 53 -j DNAT --to-destination 192.168.1.2:53
pi@Heimdall:~ $ sudo iptables -t nat -L --line-numbers
Chain PREROUTING (policy ACCEPT)
num target prot opt source destination
1 DNAT tcp -- 192.168.1.10 anywhere tcp dpt:domain to:192.168.1.2:53
2 DNAT udp -- 192.168.1.10 anywhere udp dpt:domain to:192.168.1.2:53

Chain INPUT (policy ACCEPT)
num target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
num target prot opt source destination
1 MASQUERADE all -- anywhere anywhere

```

---

<div class="post-metadata">

**Author:** ![mikeyw64](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/m/c4cdca/32.png) [@mikeyw64](https://discourse.pi-hole.net/u/mikeyw64)\
**Post date:** [September 20, 2019, 2:47pm UTC](https://discourse.pi-hole.net/t/sending-all-dns-traffic-on-lan-via-pihole/23795/3 "2019-09-20T14:47:41Z")

</div>

ALso not working

```auto
pi@Heimdall:~ $ sudo iptables -t nat -A PREROUTING -s 192.168.1.10 -d 8.8.8.8 -p tcp --dport 53 -j DNAT --to-destination 192.168.1.2:53
pi@Heimdall:~ $ sudo iptables -t nat -A PREROUTING -s 192.168.1.10 -d 8.8.8.8 -p udp --dport 53 -j DNAT --to-destination 192.168.1.2:53
pi@Heimdall:~ $ sudo iptables -t nat -L --line-numbers
Chain PREROUTING (policy ACCEPT)
num target prot opt source destination
1 DNAT tcp -- 192.168.1.10 dns.google tcp dpt:domain to:192.168.1.2:53
2 DNAT udp -- 192.168.1.10 dns.google udp dpt:domain to:192.168.1.2:53

Chain INPUT (policy ACCEPT)
num target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
num target prot opt source destination
1 MASQUERADE all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
num target prot opt source destination

```

---

<div class="post-metadata">

**Author:** ![Bucking\_Horn](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/bucking_horn/32/18719_2.png) [@Bucking\_Horn](https://discourse.pi-hole.net/u/Bucking_Horn)\
**Post date:** [September 21, 2019, 8:39am UTC](https://discourse.pi-hole.net/t/sending-all-dns-traffic-on-lan-via-pihole/23795/4 "2019-09-21T08:39:29Z")

</div>

> [@mikeyw64](#):
>
> I’ve added a USB to ethernet adaptor as eth1 & configured it for a static IP of 192.168.1.254 with the intention being of issuing DHCP clients with an IP (...)

Before probing deeper into possible solutions:  
You'd probably get working results quicker if you simplify your setup.  
An additional ethernet interface wouldn't be strictly required - setting your Pi as both gateway and DNS with your existing eth0 will suffice (just like DSL modem/router combos).

May I recommend cutting out eth1 from your setup (reduces complexity and saves some power, too)?  
Once we find a solution for your DNS diverting problem, you can always add it later on, should you find you really need it.

---

<div class="post-metadata">

**Author:** ![mikeyw64](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/m/c4cdca/32.png) [@mikeyw64](https://discourse.pi-hole.net/u/mikeyw64)\
**Post date:** [September 21, 2019, 1:37pm UTC](https://discourse.pi-hole.net/t/sending-all-dns-traffic-on-lan-via-pihole/23795/5 "2019-09-21T13:37:52Z")

</div>

Other than my laptop which I configure statically as I'm testing configs nothing else is currently going via eth1/192.168.1.254.

Everything else is set up (& working properly) as

DHCP Server : 192.168.1.2 (pihole/eth0)  
Dynamic IPs : 192.168.1.100-200  
DNS : 192.168.1.2 (pihole)  
DGW : 192.168.1.1 (ISP provided router)

(oh and the guest network which is effectively a client of the main network but has no bearing on the traffic interception I'm trying to achieve)

My specific issue (which I accept isn't necessarily a pihole specific thing) is intercepting network traffic destined for the internet on a specific port and redirecting it to the same port an internal IP.

Ie if someone hard codes 8.8.8.8 or 1.1.1.1 or whatever into a client I want to redirect it to the pihole

If I had a decent router I could run wrt on or even had more granular control I would capture outbound DNS traffic there and then send it back into PiHole.

But I don't ☹

---

<div class="post-metadata">

**Author:** ![mikeyw64](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/m/c4cdca/32.png) [@mikeyw64](https://discourse.pi-hole.net/u/mikeyw64)\
**Post date:** [September 22, 2019, 7:49pm UTC](https://discourse.pi-hole.net/t/sending-all-dns-traffic-on-lan-via-pihole/23795/6 "2019-09-22T19:49:16Z")

</div>

ok that's v.interesting

If I add a rule to redirect all non https traffic back to 192.168.1.2 that works exactly as expected (ie I get the default blocked page) so that says to my mind that the "rule" or "logic" or whatever you want to call it is correct.

So why do I get that nslookup error/timeout when specifying anything other than pihole with the same rule (other than port number) applied?

/me scratches head

```auto
pi@Heimdall:~ $ sudo iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to-destination 192.168.1.2:80

pi@Heimdall:~ $ sudo iptables -t nat -L --line-numbers
Chain PREROUTING (policy ACCEPT)
num target prot opt source destination
1 DNAT tcp -- anywhere anywhere tcp dpt:http to:192.168.1.2:80
2 DNAT tcp -- anywhere anywhere tcp dpt:domain to:192.168.1.2:53
3 DNAT udp -- anywhere anywhere udp dpt:domain to:192.168.1.2:53

Chain INPUT (policy ACCEPT)
num target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
num target prot opt source destination
1 MASQUERADE all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
num target prot opt source destination

```

 ![bbc_blocked](https://discourse.pi-hole.net/uploads/default/original/2X/4/44807d92e178a7e71d2bbe84d464492eb68e0cf1.png)

---

<div class="post-metadata">

**Author:** ![mikeyw64](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/m/c4cdca/32.png) [@mikeyw64](https://discourse.pi-hole.net/u/mikeyw64)\
**Post date:** [September 22, 2019, 9:59pm UTC](https://discourse.pi-hole.net/t/sending-all-dns-traffic-on-lan-via-pihole/23795/7 "2019-09-22T21:59:35Z")

</div>

Success!!!!!

Found the "solution" at [this page.](https://forum.openwrt.org/t/redirect-all-outbound-dns-traffic-to-internal-ip/18783/6)

Forward the DNS traffic to my ISP provided router and it then bounces it back to PiHole

```auto
pi@Heimdall:~ $ sudo iptables -t nat -A PREROUTING -i eth1 ! -s 192.168.1.2 -p tcp --dport 53 -j DNAT --to 192.168.1.1:53
pi@Heimdall:~ $ sudo iptables -t nat -A PREROUTING -i eth1 ! -s 192.168.1.2 -p udp --dport 53 -j DNAT --to 192.168.1.1:53
pi@Heimdall:~ $ sudo iptables -t nat -L --line-numbers
Chain PREROUTING (policy ACCEPT)
num target prot opt source destination
1 DNAT tcp -- !Heimdall anywhere tcp dpt:domain to:192.168.1.1:53
2 DNAT udp -- !Heimdall anywhere udp dpt:domain to:192.168.1.1:53

Chain INPUT (policy ACCEPT)
num target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
num target prot opt source destination
1 MASQUERADE all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
num target prot opt source destination

```

Top half below is the test results from my laptop configured statically as:  
Static IP : 192.168.1.10  
DNS : 192.168.1.2  
DGW : 192.168.1.1

In the lower half the DGW was changed to 192.168.1.254 which is eth1 on the Pi, as you can see DNS requests to 8.8.8.8 now give the same response as going directly to the PiHole

 ![dns](https://discourse.pi-hole.net/uploads/default/original/2X/9/9e01781135045325413d0acbf99be5444375da27.png)

---

<div class="post-metadata">

**Author:** ![Bucking\_Horn](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/bucking_horn/32/18719_2.png) [@Bucking\_Horn](https://discourse.pi-hole.net/u/Bucking_Horn)\
**Post date:** [September 22, 2019, 10:40pm UTC](https://discourse.pi-hole.net/t/sending-all-dns-traffic-on-lan-via-pihole/23795/8 "2019-09-22T22:40:47Z")

</div>

> [@mikeyw64](#):
>
> My specific issue (which I accept isn’t necessarily a pihole specific thing) is intercepting network traffic destined for the internet on a specific port and redirecting it to the same port an internal IP.

Ok, understoood.  
Your existing setup just blocks unsolicited DNS queries to external DNS, but you want to redirect it to be processed through your Pi-hole instead.

Let me rephrase my cautious recommendation to go without `eth1` into something more action-oriented 😉  
**Assuming that you have gigabit eth0 and otherwise kept your setup from** [Pihole plus Guest Wifi on different IP range](https://discourse.pi-hole.net/t/pihole-plus-guest-wifi-on-different-ip-range/23529), try the following `eth1`-free configuration:

- unplug your second ethernet dongle (`eth1`)
- undo any `eth1` related configurations, including any `iptables` NAT entries
- make sure that your `eth0` interface is still configured to use your localhost DNS and your router by checking these lines in `/etc/dhcpcd.conf`

```auto
   static ip_address=192.168.1.2/24
   static routers=192.168.1.1
   static domain_name_servers=127.0.0.1

```

- configure Pi-holes **Settings|DHCP** to hand out itself (`192.168.1.2`) as router (don't forget to save)
- configure `iptables` to redirect incoming `eth0` UDP/TCP traffic with a DNS target port to be handled by your machine's DNS:

```auto
   iptables -t nat -A PREROUTING -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53
   iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 53 -j REDIRECT --to-port 53

```

- (optional should you consider extending this to your 10.0.0.x guest wlan, also add the following)

```auto
   iptables -t nat -A PREROUTING -i wlan0 -p udp --dport 53 -j REDIRECT
   iptables -t nat -A PREROUTING -i wlan0 -p tcp --dport 53 -j REDIRECT

```

Bottom line difference to your solution:  
You don't need a second ethernet dongle - save some power 😉

---

<div class="post-metadata">

**Author:** ![mikeyw64](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/m/c4cdca/32.png) [@mikeyw64](https://discourse.pi-hole.net/u/mikeyw64)\
**Post date:** [September 22, 2019, 10:43pm UTC](https://discourse.pi-hole.net/t/sending-all-dns-traffic-on-lan-via-pihole/23795/9 "2019-09-22T22:43:43Z")

</div>

Everything working using the 2 ethernet interfaces 👍

Reduces risk of collisions on a single interface

EDIT: NB deliberately excluding the Guest Wifi from being forced through Pihole.

EDIT: Piccy added

 ![admin](https://discourse.pi-hole.net/uploads/default/original/2X/e/ea20273a8f44c748714428bc20d1bd3f088ca9c3.png)

---

<div class="post-metadata">

**Author:** ![system](https://discourse.pi-hole.net/uploads/default/original/3X/7/c/7c8792f649eeb921c5d2b4c41564ffa873d9a2b8.png) [@system](https://discourse.pi-hole.net/u/system)\
**Post date:** [October 13, 2019, 10:43pm UTC](https://discourse.pi-hole.net/t/sending-all-dns-traffic-on-lan-via-pihole/23795/10 "2019-10-13T22:43:47Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.