DNS Director - Issues when using Private DNS on mobile devices

[AdrianH]

Hi All,

Running Merlin 388.4 on a RT-AX88U router.

I am using the private AdGuard DNS service for my DNS filtering. Its a single DNS server, but I can configure devices on the server. Each device is given a unique addresses to use to query the DNS server so that the server will know which device is making the request.

So apart from my router, my two mobile Android devices have Private DNS enabled and I set the device address as specified in AdGuard DNS (like below). NB: Android only use DoT at this point, as well as the router.

Example of a device addresses to use for a device:

My router is configured to use the public AdGuard Unfiltered DNS Servers by default. I have also enabled the DNS Privacy Protocol to my AdGuard DNS Address for the Asus RT-AX88U address. (as below)

I also enabled DNS Director enabled as below. I did this because some device were doing DNS calls directly to other public DNS service bypassing the DNS specified by the router.

You'll notice my two mobile devices have been added with "No Redirection", hold that thought though.

The issue is this:

When my mobile devices are connected to a mobile network, the DNS queries are being sent to AdGuard DNS correctly as DoT request. I can see this in the logs.

When my mobile device are connect to the router's WiFi, they both show an error that the can't connect to the AdGuard DoT address specified for the device. The only way to make it work is to add the "No redirection" for the two devices in DNS Director.

Its not an issue really, just tying to understand why. I believe that the mobile device are trying to resolve the DoT address configured, and this is what is failing. I can do an NSLOOKUP from my PC on the same WiFi to the DoT addresses, I get the correct response back.

Any guru's on DNS on why I need to add "No redirection" for those 2 devices?

Thanks

 

[cptnoblivious]

This seems to be a rather complex setup.

But, to summarize:
1. You're telling the router "do not let any DoT queries through" using DNS director
2. You're telling the client "do not use the advertised DNS server, us a private DNS instead" in direct conflict with the DNS Director setting
3. Now, the result is you have to exclude the clients in #2 from the DNS blocking in #1

This is the expected result.

 

[AdrianH]

This seems to be a rather complex setup.

But, to summarize:
1. You're telling the router "do not let any DoT queries through" using DNS director
2. You're telling the client "do not use the advertised DNS server, us a private DNS instead" in direct conflict with the DNS Director setting
3. Now, the result is you have to exclude the clients in #2 from the DNS blocking in #1

This is the expected result.

I thought DNS Director only handles normal DNS on port 53, and not DoT and DoH? Is my understanding incorrect?

 

[Tech9]

It blocks DoT, but can't do anything about DoH.

 

[AdrianH]

It blocks DoT, but can't do anything about DoH.

Ah, then it makes perfect sense what is happening.

Thanks everyone

 

[dave14305]

Ah, then it makes perfect sense what is happening.

Thanks everyone

DNS Director does not (or is not supposed to) block DoT when the Mode is set to: Custom1-3, Router, Quad9, or Cleanbrowsing. Keep digging into it.

asuswrt-merlin.ng/release/src/router/rc/dnsfilter.c at 312ed2c0d8642abef3fd8621d94095f2cba7702a · RMerl/asuswrt-merlin.ng

Third party firmware for Asus routers (newer codebase) - RMerl/asuswrt-merlin.ng

github.com

Check your rules:

iptables-save -c | grep DNSFILTER
ip6tables-save -c | grep DNSFILTER

EDIT: ok, I see where I read too quickly. If the devices aren’t using the router IP for their DNS, they would be blocked even over DoT. So the No redirection requirement makes sense.

 

[AdrianH]

DNS Director does not (or is not supposed to) block DoT when the Mode is set to: Custom1-3, Router, Quad9, or Cleanbrowsing. Keep digging into it.

asuswrt-merlin.ng/release/src/router/rc/dnsfilter.c at 312ed2c0d8642abef3fd8621d94095f2cba7702a · RMerl/asuswrt-merlin.ng

Third party firmware for Asus routers (newer codebase) - RMerl/asuswrt-merlin.ng

github.com

Check your rules:

iptables-save -c | grep DNSFILTER
ip6tables-save -c | grep DNSFILTER

EDIT: ok, I see where I read too quickly. If the devices aren’t using the router IP for their DNS, they would be blocked even over DoT. So the No redirection requirement makes sense.

Good find

Thanks for much for figuring out what is happening. At least we now all know it's working as it should.

 

[Unetwork]

I have exactly the same symptom with my android phone.

I put a dns adguard in the phone's custom configuration to be able to use it in 4G with mobile data.
When I switch my phone to WIFI, the connection no longer works.

I have to set DNS Director to "no redirection" for the wifi connection to work on my phone. In the end, is DNS Director still useful in my case, at least for my computers on the local network ? Or is it useless ?

 

[cptnoblivious]

<snip>

I have to set DNS Director to "no redirection" for the wifi connection to work on my phone. In the end, is DNS Director still useful in my case, at least for my computers on the local network ? Or is it useless ?

<snip>

What's your use case? Why are you using it / trying to use it in the first case? Only that will tell you if it's useful.

 

[Unetwork]

What's your use case? Why are you using it / trying to use it in the first case? Only that will tell you if it's useful.

I use it to prevent my children from changing their PC's DNS on the local network.
So I leave it in this configuration, with the global DNS on "Router" and the smartphone on "no direction" so that wifi and 4G work with a custom dns on the smartphone ?

 

[cptnoblivious]

I use it to prevent my children from changing their PC's DNS on the local network.
So I leave it in this configuration, with the global DNS on "Router" and the smartphone on "no direction" so that wifi and 4G work with a custom dns on the smartphone ?

Well, then since you're only using the bypass for your phone, it seems that it'll do what you want.

 

[Unetwork]

Okay, thanks, I'll leave this configuration.

@AdrianH I think you've done the same as me ?

 

[AdrianH]

Okay, thanks, I'll leave this configuration.

@AdrianH I think you've done the same as me ?

Yes, same setup as you. At least we now know it is working as it should, and we have configured it correctly.

 

[Unetwork]

Perfect, yes now everything is ok.
Thank you for opening this topic.

 

[Tech9]

I use it to prevent my children from changing their PC's DNS

You have to make sure the browsers they use don't switch automatically to DoH after some update. It will bypass your filtering.

 

[Unetwork]

You have to make sure the browsers they use don't switch automatically to DoH after some update. It will bypass your filtering.

Thanks for these tips. I didn't know that using DOT and DNS Director on the router, a DOH browser could bypass filtering.
I would be careful.