VPN Director - stock asus firmware.

[podkaracz1996]

Hi,

I bought Asus rt-be86u last week and I want to force all devices on my network to use the dns server provided in the wan tab by the router. Is there a way to force it on stock firmware as opposed to feature called vpn director on merlin firmware?



Regards,

 

[bennor]

If you are talking about running VPN client on the router and forcing your LAN clients to use the router's DNS servers under stock Asus 3006.102.x firmware. Then see the stock firmware's VPN Fusion section.

[Wireless Router] How to set up VPN Fusion(VPN Client) as Internet default connection? | Official Support | ASUS USA

Depending on what kind of VPN client one sets up they may have an option to configure the DNS server (option).

PS: One may also have to configure the router's LAN > DHCP Server > DNS and WINS Server Setting's two DNS fields to match the router's WAN DNS fields.

 

[podkaracz1996]

Sorry maybe i misunderstood what vpn director does.


What i meant is there a way to force all clients that are connected to router to use only dns servers provided in wan section exclusively? So for example if i set custom dns server in windows lan section i will be disconnected?

 

[bennor]

Are you using VPN? If so are you configuring a VPN Server on the router? Or are you configuring the router to be a VPN client (aka VPN Fusion on Asus stock firmware) where it connects to a remote VPN server?

 

[podkaracz1996]

No I am not using VPN i just want to make sure all clients on my network are using dns server provided by the router exclusively.

 

[bennor]

You have two options. Leave the LAN > DHCP Server > DNS and WINS Server Setting's two DNS fields blank and the LAN clients will use the router as it's DNS server (WAN > WAN DNS Setting > DNS Server). Or one can manually configure the DNS servers LAN clients should use by entering those DNS servers into the LAN > DHCP Server > DNS and WINS Server Setting > DNS Server 1 and DNS Server 2 fields.

Or one can manually configure the DNS servers on the LAN clients themselves.

 

[podkaracz1996]

How to force it onto the clients? For example I want the router to accept only the dns servers provided in wan section so when i change it manually to something else on my windows machine i will be disconnected unless i will start using the correct dns servers again?

 

[dave14305]

You’re talking about DNS Director, not VPN Director.

I find that Asus has DNS Director in later firmware versions, but no mention of it in the GUI. You might enable it manually over SSH:

nvram set dnsfilter_enable_x=1
nvram set dnsfilter_mode=11
nvram commit
service restart_dnsfilter

Verify with:

iptables -t nat -S | grep DNSFILTER

 

[bennor]

If you want your LAN clients to use something other than the router's WAN DNS addresses, input those different DNS addresses into the LAN > DHCP Server > DNS and WINS Server Setting > DNS Server 1 and DNS Server 2 fields. Then power cycle the LAN clients so they obtain updated IP/DNS information from the router. Example DHCP Server DNS fields:

 

[bennor]

You’re talking about DNS Director, not VPN Director.

It appears they were asking about stock firmware in their OP post. Stock doesn't have DNS Director.

 

[podkaracz1996]

You’re talking about DNS Director, not VPN Director.

I find that Asus has DNS Director in later firmware versions, but no mention of it in the GUI. You might enable it manually over SSH:

nvram set dnsfilter_enable_x=1
nvram set dnsfilter_mode=11
nvram commit
service restart_dnsfilter

Verify with:

iptables -t nat -S | grep DNSFILTER

Thanks I will try it out this is exactly what i wanted.

 

[bennor]

Thanks I will try it out this is exactly what i wanted.

Just an FYI. DNS Director is exclusive to Asus-Merlin firmware. It is not found on the stock 3006.102.x firmware GUI.

 

[podkaracz1996]

Just an FYI. DNS Director is exclusive to Asus-Merlin firmware. It is not found on the stock 3006.102.x firmware GUI.

Hmm is there a way to reproduce the functionality on stock asus firmware? Like what set of commands could achieve the same results?

 

[dave14305]

Hmm is there a way to reproduce the functionality on stock asus firmware? Like what set of commands could achieve the same results?

Yes, follow the commands in my earlier post.

 

[dave14305]

It appears they were asking about stock firmware in their OP post. Stock doesn't have DNS Director.

Don’t believe everything you don’t see.

 

[bbunge]

You’re talking about DNS Director, not VPN Director.

I find that Asus has DNS Director in later firmware versions, but no mention of it in the GUI. You might enable it manually over SSH:

nvram set dnsfilter_enable_x=1
nvram set dnsfilter_mode=11
nvram commit
service restart_dnsfilter

Verify with:

iptables -t nat -S | grep DNSFILTER

Looks like it works! Thanks...

-N DNSFILTER
-A PREROUTING -i br+ -p udp -m udp --dport 53 -j DNSFILTER
-A PREROUTING -i br+ -p tcp -m tcp --dport 53 -j DNSFILTER
-A PREROUTING -i wgs1 -p udp -m udp --dport 53 -j DNSFILTER
-A PREROUTING -i wgs1 -p tcp -m tcp --dport 53 -j DNSFILTER
-A DNSFILTER -i br0 -j RETURN
-A DNSFILTER -i br52 -j RETURN
-A DNSFILTER -j DNAT --to-destination 192.168.50.1

Results from iptables -t nat -S | grep DNSFILTER on AX86U Pro Asus firmware 3.0.0.6.102_34336-gc04af06_403-gd851b

 

[dave14305]

-A DNSFILTER -i br0 -j RETURN

That’s interesting. It’s allowing LAN traffic through. Maybe they’ve changed the behavior with all the new SDN/Guest/IoT/Pro stuff.

 

[bbunge]

Just an FYI. DNS Director is exclusive to Asus-Merlin firmware. It is not found on the stock 3006.102.x firmware GUI.

Mmmm...no. It was in Asus firmware for a while but was removed. Something to do with the naming/copyright infringement? Guess they just removed it from the gui but left the functionality.

 

[bbunge]

That’s interesting. It’s allowing LAN traffic through. Maybe they’ve changed the behavior with all the new SDN/Guest/IoT/Pro stuff.

OK, in your advanced network mind is there a fix?

 

[bbunge]

@dave14305 There were a couple more commands in this post

Stubby-Installer-Asuswrt-Merlin

This page. That's spooky looking to me, like you're welcoming external requests to your router's DNS server. It's out of my league though, since I don't do any port forwarding and I'm back to running John's Fork. But in case you want to solve this once and for all, you can delete your nat-start...

www.snbforums.com