Should I set the LAN/DNS Filter mode to Router if using NextDNS

[Dan567]

I am using NextDNS installed in Merlin to handle the DNS. I read in another thread that the LAN/DNS Filter mode should be set to Router. Should I do that if using NextDNS?

I noticed that the settings for Custom DNS 1,2,3 are set to 8.8.8.8. Should I leave them set to that? I am not sure when they are used for since I am using NextDNS.
Thanks

 

[eibgrad]

By default, the clients will be directed to the router for DNS. All the DNS filter (as Router) does is force any attempt by those clients to use any other DNS server, back to the router.

The custom DNS servers are used by DNSMasq to configure the public DNS servers it will use on behalf of those clients. But if you're using NextDNS, it actually doesn't matter anymore. The NextDNS installer will redirect all DNS traffic (via DNSMasq) to its own local proxy, and to its own DNS servers using DoH. IOW, all other public DNS servers become irrelevant.

 

[MvW]

I have "Enable DNS-based filtering" disabled, and use only the NextDNS CLI.

IOW, all other public DNS servers become irrelevant.

Almost completely agree with you, but although not mentioned by the topic starter, the WAN DNS server field(s) should remain populated in WAN Settings, with DNS-servers of choice (which can even be NextDNS) as far as I'm aware. The router always needs these, if only it were to get NTP synced, because NextDNS can't resolve anything before time has synced. As soon has that has happened, NextDNS takes over.

DNS-over-TLS - disable possibility for regular DNS requests from asus router

Hi, Long time reader of these forums and grateful for all the advice. Running RT-AC86U smoothly. Configured DNS-over-TLS with all DNS traffic from LAN intercepted and answered by Router. This works flawlessly. (Got answer back for a "dig nas.lan @1.1.1.1 that only exists on my lan and couldn't...

www.snbforums.com

 

[eibgrad]

I have "Enable DNS Filter" disabled, and use only the NextDNS CLI.



Almost completely agree with you, but although not mentioned by the topic starter, the WAN DNS server field(s) should remain populated in WAN Settings, with DNS-servers of choice (which can even be NextDNS) as far as I'm aware. The router always needs these, if only it were to get NTP synced, because NextDNS can't resolve anything before time has synced. As soon has that has happened, NextDNS takes over.

DNS-over-TLS - disable possibility for regular DNS requests from asus router

Hi, Long time reader of these forums and grateful for all the advice. Running RT-AC86U smoothly. Configured DNS-over-TLS with all DNS traffic from LAN intercepted and answered by Router. This works flawlessly. (Got answer back for a "dig nas.lan @1.1.1.1 that only exists on my lan and couldn't...

www.snbforums.com

Good point. I wasn't really considering any *bootstrapping* issues wrt NextDNS, but just the clients and custom DNS settings on the LAN side.

 

[miniterror]

Force everyrhing to the router, clients are getting there own DNS servers hardcoded.
Think of android devices having 8.8.8.8 hardcoded.
Setting it to router mode will catch those queries too and force the devices to use your NextDNS.
Also if you choose to setup Diversion the devices with hardcoded DNS will not have addblocking if you dont set it too router mode.