Redirecting all DNS Requests to pfSense

[Fingers]

I want to eliminate any clients using their own pre-installed DNS servers.

I have followed this tutorial :
https://docs.netgate.com/pfsense/en/latest/dns/redirecting-all-dns-requests-to-pfsense.html

Results:

Port Forward

LAN Rule:

Localhost Selected:

Manually added Google DNS added to windows NIC, but still connects:

Am I missing something obvious?

 

[coxhaus]

This is a little more elegant than the way I do it. I create an ACL to block all port 53 udp/tcp then I create a ACL to allow only the DNS I use which is QUAD9 9.9.9.9. My way it breaks all DNS but QUAD9. The pfsense way is it redirects all DNS to the pfsense DNS.

 

[Fingers]

This is a little more elegant than the way I do it. I create an ACL to block all port 53 udp/tcp then I create a ACL to allow only the DNS I use which is QUAD9 9.9.9.9. My way it breaks all DNS but QUAD9. The pfsense way is it redirects all DNS to the pfsense DNS.

Thanks, I did try that too as a test, and weirdly that didnt work either. The windows machine still used Google DNS. I'm at a loss to see why, I have also reset states and that makes no difference.

 

[coxhaus]

I guess to test it you will need to add an ACL to block all DNS except the DNS pfsense is using. Then start trouble shooting from there.

Theatrically any DNS you add to a Windows PC will be redirected to pfsense's DNS.

PS
I guess you know when you do ACLs you do the permits first and then the deny all last. I would use the WAN interface as it will be safer.