Use iptables on router to force DNS to pi-hole

Help
1

Expected Behaviour:

I would like my router(192.168.1.1) to trap every DNS request in my network(192.168.1.0/24) and forward it to pi-hole(192.168.1.2)... The only device on my network that should request an external DNS is pi-hole! :slight_smile:

Actual Behaviour:

I'm actually not sure about my iptables rules... I'm not sure because i don't want to trap the pi-hole request, i want to trap "everything except pi-hole" dns request... My problem with this is the pi-hole request has to get out. I fear that i could create a loop with those rules where everything is sent to 192.168.2.1... Is the request from 192.168.1.2 will be sent to 192.168.1.2 ?

iptables -t nat -A PREROUTING -s 192.168.1.0/24 -p tcp --dport 53 -j DNAT --to 192.168.1.2
iptables -t nat -A PREROUTING -s 192.168.1.0/24 -p udp --dport 53 -j DNAT --to 192.168.1.2

more details on my network

DHCP is set to force 192.168.2.1 as dns server... But devices are free :slight_smile: So they can set the dns manually. I want to avoid that freedom, it's my network! :stuck_out_tongue:

Thanks for your help :slight_smile:

Edit: Details :slight_smile:

2

I think I found how... Exclamation mark is our friend.

iptables -t nat -A PREROUTING ! -s 192.168.1.2 -p tcp --dport 53 -j DNAT --to 192.168.1.2
iptables -t nat -A PREROUTING ! -s 192.168.1.2 -p udp --dport 53 -j DNAT --to 192.168.1.2

Also, is it possible that I should have posted this to General instead of Help since it's a little bit more than a pi-hole help request ?

edit: Exclamation mark goes before the -s :slight_smile:

3

I have this setup but with a twist : All traffic to Google DNS IP's 8.8.4.4 and 8.8.8.8 is redirected to the IP of the Pi-Hole by my router :wink:

So as long as I see all my other devices requesting DNS from the Pi-Hole this will be the only rule for now...

4

Well, i have two teenagers at home that share the guest wifi password... I don't know what are these devices, i don't control them, but still, i want to control what i can :slight_smile:
I saw at least one of them using another DNS then the one that is given by my DHCP server.

With the iptables rules mentionned, I can force the dns to be mine and control some stuff...

In my case, pi-hole isn't only to reduce ads, but also, a good way to trap things that shouldn't happen on my network from guests in my home :wink:

If "https-everywhere" wasn't a good thing that needs to happen, Squid would be installed on my Pi-hole server to also logs web request.

The teenagers in my home and their friends still doesn't know vpn... for now :slight_smile:

5

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.