Solved DNS Filtering not working on Merlin LTS fork

[cminus]

For some reason, it does not appear that DNS filtering is working on my RT-AC66U Running 374.43_45EAj9527 (Merlin LTS Fork from @john9527 ). I've made sure that DNS over HTTPS is disabled in the browser and I've also just run a simple nslookup and I am getting returned the true IP of sites that should be blocked as a result of the filter. In my case, I am testing "Cloudflare Adult" and I am still able to browse to sites with adult content. If I manually put in the DNS server 1.1.1.3, it blocks as expected. However, when I just use the DNS filtering, the adult sites are allowed. Is there a good way to troubleshoot this? Thank you!

 

[john9527]

For some reason, it does not appear that DNS filtering is working on my RT-AC66U Running 374.43_45EAj9527 (Merlin LTS Fork

Can you give me an example test site so I can try and recreate?

 

[ColinTaylor]

Are you using any VPN clients?

Maybe post screen shots of your DNSFilter settings, LAN DHCP settings and WAN DNS settings.

 

[john9527]

@RMerlin
Can you move this over to your forum.....Thanks

 

[SomeWhereOverTheRainBow]

For some reason, it does not appear that DNS filtering is working on my RT-AC66U Running 374.43_45EAj9527 (Merlin LTS Fork from @john9527 ). I've made sure that DNS over HTTPS is disabled in the browser and I've also just run a simple nslookup and I am getting returned the true IP of sites that should be blocked as a result of the filter. In my case, I am testing "Cloudflare Adult" and I am still able to browse to sites with adult content. If I manually put in the DNS server 1.1.1.3, it blocks as expected. However, when I just use the DNS filtering, the adult sites are allowed. Is there a good way to troubleshoot this? Thank you!

Are you experiencing issues on Apple devices or Android. Is it only happening with certain devices that are assigned specific filters to their mac address or is this global filtering? The reason why I ask is because users have been reporting issues with newer android and Apple devices that have received an update that turns on a mac-address randomization feature. The only way around this is to disable it within the wifi settings on the device. With mac address randomization enabled, the device that has a specific filtering rule listed does not go through the filter because the router does not recongnize the mac address assignment since the devices is "hiding" it through mac address randomization. The router only sees the new random mac address. This does not happen if the filter is the "global" setting and not just a client specific filter since all traffic is sent through the filter. I suppose your device may be set to a specific filter rule and is able to randomize the mac address of the device thus by passing the routers filter rule for the device.

 

[cminus]

Thanks everyone. Here is what I am trying. If I setup my test pc mac address (which is static) in the DNS filter and set it to use "Cloudflare Adult", and then I attempt to do an nslookup for www[.]pornhub[.]com, the dns lookup is successful and I actually am also able to get to the adult site. I would expect the DNS filter to intercept this request and return the actual reply from the 1.1.1.3 cloudflare dns server but this does not appear to be the case. If I manually set my DNS server to 1.1.1.3 and lookup www[.]pornhub[.]com then I get a response of 0.0.0.0. I would expect the same behavior with the filter setting but no luck. any ideas? thanks!

 

[dave14305]

Can you give me an example test site so I can try and recreate?

Are you missing some commas after the new array elements?

https://github.com/john9527/asuswrt-merlin/blob/374.43_2-update/release/src/router/rc/services.c#L7132

 

[SomeWhereOverTheRainBow]

Thanks everyone. Here is what I am trying. If I setup my test pc mac address (which is static) in the DNS filter and set it to use "Cloudflare Adult", and then I attempt to do an nslookup for www[.]pornhub[.]com, the dns lookup is successful and I actually am also able to get to the adult site. I would expect the DNS filter to intercept this request and return the actual reply from the 1.1.1.3 cloudflare dns server but this does not appear to be the case. If I manually set my DNS server to 1.1.1.3 and lookup www[.]pornhub[.]com then I get a response of 0.0.0.0. I would expect the same behavior with the filter setting but no luck. any ideas? thanks!

So you only have one connection to the internet Via this computer correct? you are not mixing wired and wireless correct? And this computer is not tunneling through a vpn correct?

 

[cminus]

Thanks @dave14305 I bet it is the missing commas based on that source snippet. Looks like an easy fix if that's true. Thanks!

 

[dave14305]

Thanks @dave14305 I bet it is the missing commas based on that source snippet. Looks like an easy fix if that's true. Thanks!

Could be meaningless, but it looks "not like the others" and it starts at Cloudflare Family. Let's see.

 

[SomeWhereOverTheRainBow]

Are you missing some commas after the new array elements?

https://github.com/john9527/asuswrt-merlin/blob/374.43_2-update/release/src/router/rc/services.c#L7132

That could be the cause.

 

[SomeWhereOverTheRainBow]

I wonder if the Main merlin firmware is also impacted

 

[cminus]

So do you think that would break all of the dns filters? Based on my testing, I don't think any of them are working

 

[SomeWhereOverTheRainBow]

So do you think that would break all of the dns filters? Based on my testing, I don't think any of them are working

can you test a custom filter using 1.1.1.3 to see if your issue goes away?

 

[cminus]

Yeah, i tried that. Same problem. Makes me think the whole array is broken?

 

[dave14305]

Login via ssh and run iptables -t nat -S DNSFILTER

 

[SomeWhereOverTheRainBow]

Yeah, i tried that. Same problem. Makes me think the whole array is broken?

Could be possible. Are you experiencing this issue only on that one computer or can you test other computers?

 

[cminus]

I have tested multiple machines with the same result.

 

[cminus]

Login via ssh and run iptables -t nat -S DNSFILTER

I get an unknown option -S but if I do run the following it does not look like there is a chain called DNSFILTER. Could be the problem?
iptables -L DNSFILTER
iptables: No chain/target/match by that name

 

[dave14305]

I get an unknown option -S but if I do run the following it does not look like there is a chain called DNSFILTER. Could be the problem?
iptables -L DNSFILTER
iptables: No chain/target/match by that name

You need to specify -t nat