Posted: Thu Feb 01, 2018 10:06 Post subject: Different DNS for different IP ranges
Hi, a question for the experts here!
I have two "networks" on my router, one is an open connection to internet through a wired and wireless connection.
The other is a VPN that uses a virtual wireless connection and they have policy based routing with 192.168.2.80/29
So everything connected to that wireless SSID gets those IP and goes trough VPN.
Everyhting ok and all working.
But, everything is using the DNS of the Setup-Basic Setup-Network Address Server Settings (DHCP)-Static DNS 1, 2 and 3
And I want to all the 192.168.2.80/29 range (the ones in VPN) use two other different DNS servers to prevent DNS Leak and all that stuff.
So, the question is how to setup some "rule" for all those clients connected to the VPN (or ath1.1 or br1 or tun1 or 192.168.2.80/29) to bypass the general DNS servers and use other differents two DNS???
Joined: 18 Mar 2014 Posts: 12877 Location: Netherlands
Posted: Thu Feb 01, 2018 12:48 Post subject:
A quick an dirty method:
If you have a recent version you just enable "Forced DNS Redirection" on the Virtual interface after that a box opens where you can fill in the DNS server.
Thank you guys!
I agree with you eibgrad that if I want a full protected system to DNS leaks is much more complex. Right now I feel ok with using the DNS provided by VPN (NordVPN) so I put the DNS server in "Forced DNS Redirection" of br1 and it's working ok I guess.
Clients connected to non-vpn SSID are using OpenDNS, and clients connected to VPN SSID are accesing with VPN of course and using the VPN provided DNS.
As tested in ipleak.net and dnsleaktest.com my VPN IP is the same as the DNS IP so I believe it's working ok.
Thanks!
What this does is monitors connection tracking for DNS queries (dport=53). It updates itself every 5 secs (which you can change, the default is 2 secs).
Take special note of the first src and first dst fields. The src field tells you which device has made the request. The dst field tells you (indirectly) which network interface is being used for that connection (if you check ifconfig, you'll find that IP bound to some network interface, in our case, usually vlan2 for the WAN, and tun1 for the VPN).
The second half of any connection tracking record is what the system expects to be returned on the reply packet, so you can usually ignore it, including the second instance of the src and dst fields.
That is the *only* reliable means to determine where your DNS queries are being routed.
Hi @eibgrad... been reading lots of your posts and getting informed and (sort of versed in DDWRT)... so thanks for that... I have a question for you... You see I do not use PBR because it causes some issues with some connections so I use iptables. Specifically I use these commands on startup:
Basically what I do is I have the DNS servers in the setup page as the VPN DNS servers, and i assign static IPs (outside the DHCP range) for the devices i want to route through the VPN. All else are assigned the DHCP range (which is what you see in the scripts) All these alongside the startup script work as expected.
So I ran your command to check for DNS leaks.
I get these results:
udp 17 40 src=100.64.16.11 dst: VPN-DNS
that address is for the router but it's nowhere in my private IP. I know its the router because when i input it in a browser it takes me to the browser homepage. My question is where is this address coming from??? Is it right? is it a sing that something's wrong???
Joined: 08 May 2018 Posts: 14208 Location: Texas, USA
Posted: Tue Sep 10, 2019 17:29 Post subject:
There's always that thing of how to lock down your browser from preventing webrtc leaks, too. Google it. I locked down Edge, FF, Safari, Opera, and Chrome as an added measure.
@eibgrad, I will have to look at FreshTomato and more recent Advanced Tomato commits to see if anything has been done, my FT router is mostly out-of-the-box configured, I hadn't done too many custom configs to it, but I am also running a more recent build than the last public beta http://anon.groov.pl/index.php?version=2019.3.203+K26+USB
