Where to enable custom DNS?

[decker]

I have an RT-AC86U. If I want to use a custom DNS where am I supposed to enter it? In LAN > DHCP server I see a setting for DNS and WINS Server Setting. In WAN > Internet Connection there's a setting under WAN DNS Setting to assign a DNS IP. From the description it sounds like I should enter it under the WAN setting. So what's the LAN setting for?

 

[ColinTaylor]

You would normally use the WAN DNS settings and leave the LAN DNS fields empty.

 

[decker]

You would normally use the WAN DNS settings and leave the LAN DNS fields empty.

thx

 

[drinkingbird]

thx

To add, if you want to force clients to use it, also go to the DNS Filter / DNS Director and set it to "router". That way they can't enter their own DNS. They can however enable DOH in their browser and bypass it that way.

Also the reason for the two different places:

Putting it on WAN means the router looks up to those IPs, and the clients look up to the router (router is a proxy DNS server). The router also uses those entries for its own purposes, like resolving NTP servers, etc.
Putting it on DHCP means the clients look up to those IPs directly and bypasses the router. Having the router cache DNS (the option above) is usually preferred.

 

[decker]

To add, if you want to force clients to use it, also go to the DNS Filter / DNS Director and set it to "router". That way they can't enter their own DNS. They can however enable DOH in their browser and bypass it that way.

Also the reason for the two different places:

Putting it on WAN means the router looks up to those IPs, and the clients look up to the router (router is a proxy DNS server). The router also uses those entries for its own purposes, like resolving NTP servers, etc.
Putting it on DHCP means the clients look up to those IPs directly and bypasses the router. Having the router cache DNS (the option above) is usually preferred.

You mean if I enable DNS Director it will ignore any custom DNS I configured in my device's network adapter?

 

[EmeraldDeer]

• WAN settings are which DNS servers the router will use.
  • Required.
  • I use Quad9 ECS.
• LAN settings are the DNS servers supplied to LAN clients by DHCP server.
  • Optional.
  • I do not use this.
• DNS Director will redirect DNS queries from LAN clients at the firewall level to the router, regardless of client DNS settings.
  • Optional.
  • I use this with no exceptions.
• DNS Director, however, can only redirect conventional DNS queries.
  • Not DNS over HTTPS (some browsers have this on by default)
  • Not DNS over TLS.

 

[decker]

• WAN settings are which DNS servers the router will use.
  • Required.
  • I use Quad9 ECS.
• LAN settings are the DNS servers supplied to LAN clients by DHCP server.
  • Optional.
  • I do not use this.
• DNS Director will redirect DNS queries from LAN clients at the firewall level to the router, regardless of client DNS settings.
  • Optional.
  • I use this with no exceptions.
• DNS Director, however, can only redirect conventional DNS queries.
  • Not DNS over HTTPS (some browsers have this on by default)
  • Not DNS over TLS.

Do WAN and LAN both do the same thing? I didn't know about DNS Director. I always thought the client DNS had priority over the router. That's good to know. None of my housemates know how to change DNS so it's probably not necessary. Why do you use it without exceptions?

 

[drinkingbird]

You mean if I enable DNS Director it will ignore any custom DNS I configured in my device's network adapter?

Correct, it will intercept client DNS queries (invisibly) and send them to the DNS you've configured, regardless of what is configured on the network adapter. Client thinks the response is coming from the server they specified, but it is not.

 

[drinkingbird]

Do WAN and LAN both do the same thing? I didn't know about DNS Director. I always thought the client DNS had priority over the router. That's good to know. None of my housemates know how to change DNS so it's probably not necessary. Why do you use it without exceptions?

No WAN and LAN do different things. WAN tells the router what to use, and by default (if you don't specify on the LAN) the clients receive the router's IP as their DNS IP. If you specify IPs on the LAN, DHCP hands those IPs directly to the client, they no longer use the router, they go direct to the specified DNS server.

WAN configured but LAN not - Client receives router's IP as DNS server
Client -> Router -> Router's WAN DNS

LAN configured (to something other than router IP)
Client -> Direct to that DNS server you specified, skipping the router.

In either case, the WAN DNS is used by the router also for its own purposes (NTP, checking for firmware updates, etc).

 

[decker]

No WAN and LAN do different things. WAN tells the router what to use, and by default (if you don't specify on the LAN) the clients receive the router's IP as their DNS IP. If you specify IPs on the LAN, DHCP hands those IPs directly to the client, they no longer use the router, they go direct to the specified DNS server.

WAN configured but LAN not - Client receives router's IP as DNS server
Client -> Router -> Router's WAN DNS

LAN configured (to something other than router IP)
Client -> Direct to that DNS server you specified, skipping the router.

In either case, the WAN DNS is used by the router also for its own purposes (NTP, checking for firmware updates, etc).

thx for explaining!

 

[decker]

Correct, it will intercept client DNS queries (invisibly) and send them to the DNS you've configured, regardless of what is configured on the network adapter. Client thinks the response is coming from the server they specified, but it is not.

cool thx

 

[EmeraldDeer]

Do WAN and LAN both do the same thing? I didn't know about DNS Director. I always thought the client DNS had priority over the router. That's good to know. None of my housemates know how to change DNS so it's probably not necessary. Why do you use it without exceptions?

Use of DNS Director without exceptions

• Caching of lookups - all home devices share router dnsmasq cache, speeding up repetitive lookups. I also had a special case. Windows 10 would do a lot of lookups which do not have entries. The lack of entry results in looking up again. This pounded my DNS provider with zero value load. Instead, these lookups now just hit the router and avoid my DNS provider throttling lookups.
• Security - All devices benefit from Diversion blacklists
• Access control - If someone tries to access porn or gambling, the lookup is blocked at the router, ISP and DNS provider never sees the DNS lookup attempt

 

[decker]

Use of DNS Director without exceptions

• Caching of lookups - all home devices share router dnsmasq cache, speeding up repetitive lookups. I also had a special case. Windows 10 would do a lot of lookups which do not have entries. The lack of entry results in looking up again. This pounded my DNS provider with zero value load. Instead, these lookups now just hit the router and avoid my DNS provider throttling lookups.
• Security - All devices benefit from Diversion blacklists
• Access control - If someone tries to access porn or gambling, the lookup is blocked at the router, ISP and DNS provider never sees the DNS lookup attempt

awesome thx