DNS problems with Policy Based Routing

Post new topic   Reply to topic    DD-WRT Forum Index -> Advanced Networking
Author Message
Riscol
DD-WRT Novice


Joined: 18 Nov 2017
Posts: 16

PostPosted: Sun Nov 15, 2020 15:57    Post subject: Reply with quote
Sorry for reviving this thread.

I have another problem I don't know why I have it.

In short: I have set up policy based VPN routing (see above). SO I want all defined devices go through the VPN and all others not. However, now all devices use the VPN's DNS server and not anymore the natives. I.e. I have a local IP but a DNS server from another country for non vpn-routed devices. This results in constant problems (e.g. with netflix) but also VPN DNS not responding to DNS requests.

What could be a fix? Thank you

Dnsmasq
Dnsmasq Enable
Encrypt DNS Disable
Cache DNSSEC data Disable
Validate DNS Replies (DNSSEC) Disable
Check unsigned DNS replies Disable
Local DNS Disable
No DNS Rebind Enable
Query DNS in Strict Order Enable
Add Requestor MAC to DNS Query Disable
RFC4039 Rapid Commit support Disable
Sponsor
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 12865
Location: Netherlands

PostPosted: Sun Nov 15, 2020 16:04    Post subject: Reply with quote
This is a separate problem so I will split this thread.

See: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=321686

The guide about DNS problems with PBR.

In short your VPN provider is pushing a DNS server that will be used by the router (for all your clients)

There are several ways to mitigate this as described in the guide (pull-filter ignore "dhcp-option DNS" in addtional OpenVPN config or no-resolv, server= in Additional DNSMasq options)

_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
Riscol
DD-WRT Novice


Joined: 18 Nov 2017
Posts: 16

PostPosted: Sun Nov 15, 2020 16:48    Post subject: Reply with quote
Thanks egc, I will try if this works Smile

Funny though, I already had added to Additional Config of VPN:

route x.x.x.x 255.255.255.255 vpn_gateway
route x.x.x.x 255.255.255.255 vpn_gateway

So I thought this should already ensure the x.x.x.x are only used by vpn routed devices. I have lot to learn it seems...
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 12865
Location: Netherlands

PostPosted: Sun Nov 15, 2020 17:04    Post subject: Reply with quote
That is what the forum is for.

I also learn things every day Smile

The routing of pushed DNS servers is done automatically in the new build 44809.
But the DNS servers are used for all clients.

You can setup DNSMasq to hand out different DNS servers for different clients or not use the pushed DNS servers, all explained in the guide

_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
eibgrad
DD-WRT Guru


Joined: 18 Sep 2010
Posts: 9157

PostPosted: Sun Nov 15, 2020 18:18    Post subject: Reply with quote
There's another way as well.

The problem is that by default, the router's DHCP server (DNSMasq) configures its DHCP clients w/ the router as their DNS server (also DNSMasq, acting as a local, caching, DNS proxy). But DNSMasq has no means to discriminate among different clients when it comes to DNS. It serves all clients equally. And when the OpenVPN client gets connected to the OpenVPN server, it reconfigures the router's DNS server (which are currently using the ISP's DNS servers) w/ the DNS servers push'd by the OpenVPN provider. Hence everyone, regardless whether they are using the WAN or VPN, will have their DNS queries routed over the VPN.

If you want your WAN and VPN clients to have their DNS queries routed over the WAN and VPN respectively, then you need to reconfigure your clients so they are NOT dependent on DNSMasq in the first place. Instead, you configure them w/ *public* DNS servers.

Code:
dhcp-option=tag:br0,option:dns-server,8.8.8.8,8.8.4.4


IOW, you *bypass* DNSMasq completely when it comes to DNS. And now, depending on how you've configured those clients wrt PBR, their DNS queries will be sent over the correct network interface, just like every other request from those same clients. Of course, the downside is that you lose the benefits of DNSMasq's DNS server (local name resolution, caching, etc.). But that might not be as important to some ppl as making sure those clients use the correct network interface for DNS.
Riscol
DD-WRT Novice


Joined: 18 Nov 2017
Posts: 16

PostPosted: Sun Nov 15, 2020 19:35    Post subject: Reply with quote
Thank you eibgrad - for now I'd prefer not use non DNSmasq option flat out.

Funny thing, egc:

If I add to DNSmasq additional config:

no-resolve
server=208.67.222.222
server=208.67.220.220

> then i can connect to my router, but no internet - and I loose capability to login as admin. Had to reset multiple times.

Funny thing, too:

If I add to VPN config:

pull-filter ignore "dhcp-option DNS"

> My wifi does not work anymore, as IP leases are not handed out to devices (I cannot connect to LAN via wifi/ ethernet)

I have no idea why this happens though.
eibgrad
DD-WRT Guru


Joined: 18 Sep 2010
Posts: 9157

PostPosted: Sun Nov 15, 2020 19:55    Post subject: Reply with quote
Note, it's no-resolv, NOT no-resolve.
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 12865
Location: Netherlands

PostPosted: Sun Nov 15, 2020 20:06    Post subject: Reply with quote
If you really added no-resolve to the additional DNSMasq options than that could be stopping DNSMasq as it is no-resolv (without the e)

Why adding pull-filter ignore "dhcp-option DNS" would stop the handing out of IP addresses is difficult to comprehend it stops the adding of DNS servers.

You do have DNS servers set under Static DNS 1 and Static DNS 2?

When using PBR you also should not have a kill switch installed.

My advice first setup without VPN to get normal internet access also consider resetting to defaults and start fresh with a manual setup you must be doing something really weird

_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
l3g023
DD-WRT Novice


Joined: 27 Sep 2020
Posts: 13

PostPosted: Mon Nov 16, 2020 3:23    Post subject: Reply with quote
Hi all,

I'm having similar problems, not beeing able to access Netflix nor Amazon video.

egc, you have helped me setting up PBR & Kill-switch firewall (see thread https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1218700#1218700). Thanks for that - it has worked like a charm.

Quote:
Funny thing, egc:

If I add to DNSmasq additional config:

no-resolve
server=208.67.222.222
server=208.67.220.220

> then i can connect to my router, but no internet - and I loose capability to login as admin. Had to reset multiple times.

Funny thing, too:

If I add to VPN config:

pull-filter ignore "dhcp-option DNS"

> My wifi does not work anymore, as IP leases are not handed out to devices (I cannot connect to LAN via wifi/ ethernet)

I have no idea why this happens though.



I must admit that what OP is saying it's true. From what I've experienced, if wrong information is used in DNSMasq Additional Options it won't let you access the internet and/or the router's homepage.

However I've found a way around it using SSH. Obviously 2 routers are required for this to work. Connect to your non DD-WRT (ISP in my case) router and then use SSH using DD-WRT's WAN IP to establish a connection. I use PuTTY for this. Then simply open the browser and type localhost:80. You're in.

Now back to the problem with the Streaming services. I have got enabled "Ignore WAN DNS" in "Setup>Basic Setup" tab under "WAN Setup".

    Local DNS: 85.203.37.1
    Static DNS 1: 85.203.37.1
    Static DNS 2: 1.0.0.0
    Static DNS 3: 2.0.0.0


I am also using the following "DNSMasq Additional Options" for Addblock (https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1119281#1119245) and to block Apple Updates =)

    conf-file=/jffs/dnsmasq/mpdomains #ADDBLOCK BY YAMARAJ
    addn-hosts=/jffs/dnsmasq/mphosts #ADDBLOCK BY YAMARAJ
    address=/mesu.apple.com/0.0.0.0 #BLOCK APPLE UPDATES
    address=/appldnld.apple.com/0.0.0.0 #BLOCK APPLE UPDATES
    address=/swscan.apple.com/0.0.0.0 #BLOCK APPLE UPDATES
    address=/xp.apple.com/0.0.0.0 #BLOCK APPLE UPDATES
    address=/gdmf.apple.com/0.0.0.0 #BLOCK APPLE UPDATES



Now the question is. Is there a way to tell the router to ignore "Ignore WAN DNS" for a specific website which in my case is Netflix & Amazon? In other words force specific websites to use WAN DNS instead?

I also think that Netflix is probably a bit easier to get around whilst using VPN - the only way I found so far is to untick "Ignore WAN DNS" and "Use DNSMasq for DNS" and finally remove Static DNS IP's.

Amazon on the other hand always detects if I'm using a VPN connection.

Any help would be much appreciated guys, please take it easy on me as I'm a newbie still.

P.S. Yes I have looked at the PBR guide but I must admit that I'm a bit confused.. Embarassed

-l3g0
eibgrad
DD-WRT Guru


Joined: 18 Sep 2010
Posts: 9157

PostPosted: Mon Nov 16, 2020 4:14    Post subject: Reply with quote
l3g023 wrote:
Now the question is. Is there a way to tell the router to ignore "Ignore WAN DNS" for a specific website which in my case is Netflix & Amazon? In other words force specific websites to use WAN DNS instead?


Choose a public DNS server (e.g., 8.8.8.8 ) and bind that to the WAN by adding the following to the OpenVPN client Additional Config field.

Code:
route 8.8.8.8 255.255.255.255 net_gateway


Now add the following to Additional DNSMasq Options:

Code:
server=/amazon.com/netflix.com/8.8.8.8
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 12865
Location: Netherlands

PostPosted: Mon Nov 16, 2020 6:24    Post subject: Reply with quote
The problem is that Netflix and Amazon and the likes have multiple DNS/server and domains and it is difficult to catch them all so this alone will probably not save you.
_________________
Routers:Netgear R7000, R6400v1, R6400v2, EA6900 (XvortexCFE), E2000, E1200v1, WRT54GS v1.
Install guide R6400v2, R6700v3,XR300:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800/XR500: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
l3g023
DD-WRT Novice


Joined: 27 Sep 2020
Posts: 13

PostPosted: Mon Nov 16, 2020 12:21    Post subject: Reply with quote
Quote:
Choose a public DNS server (e.g., 8.8.8.8 ) and bind that to the WAN by adding the following to the OpenVPN client Additional Config field.

Code:
route 8.8.8.8 255.255.255.255 net_gateway


Now add the following to Additional DNSMasq Options:

Code:
server=/amazon.com/netflix.com/8.8.8.8


Thanks eibgrad, I think I get it now.

I see you can add multiple domain names (amazon.com/netflix.com/). Can I do the same thing with the last line with the IP? For example:

Code:
server=/amazon.com/netflix.com/8.8.8.8/8.8.4.4


Quote:
The problem is that Netflix and Amazon and the likes have multiple DNS/server and domains and it is difficult to catch them all so this alone will probably not save you.


You're right, what I have noticed now is that I can access Netflix.com and Amazon.com (before wouldn't connect at all) but no pictures/tumbnails load at all. Uppon adding the the below additionally to what eibgrad suggested I get some thumbnails loading but not all. Seems like I need to find a way to catch all of the IP addresses at ones. Isn't it possible to use domain names/hostname to do this - same as you would do with your printer for example - instead to tell your computer to look for xxx.xxx.xxx.xxx simple look for printername (in case a static IP address hasn't been leased for it).

OpenVPN Additional Config
Code:
route 8.8.4.4 255.255.255.255 net_gateway
route 80.4.177.62 255.255.255.255 net_gateway


Additional DNSMasq Options
Code:
server=/amazon.com/netflix.com/8.8.4.4
server=/amazon.com/netflix.com/80.4.177.62


As always thanks for everyone's help - I learn a lot and take down a lot of notes Very Happy

-l3g0
Riscol
DD-WRT Novice


Joined: 18 Nov 2017
Posts: 16

PostPosted: Tue Dec 29, 2020 15:36    Post subject: Reply with quote
Just wanted to let you know that I think it works now - I removed the "e" from no-resolve *wall* Rolling Eyes

If this does not work, I'll deactive DNSmasq.

Thanks again for your solution oriented support.

Happy Holidays and happy new year 2021 Smile
SurprisedItWorks
DD-WRT Guru


Joined: 04 Aug 2018
Posts: 1447
Location: Appalachian mountains, USA

PostPosted: Tue Dec 29, 2020 15:58    Post subject: Reply with quote
Riscol wrote:
Thanks egc, I will try if this works Smile

Funny though, I already had added to Additional Config of VPN:

route x.x.x.x 255.255.255.255 vpn_gateway
route x.x.x.x 255.255.255.255 vpn_gateway

So I thought this should already ensure the x.x.x.x are only used by vpn routed devices. I have lot to learn it seems...

As an aside in this enlightening thread, let me go back to this and note that just as you suspected, it doesn't mean that at all. It means that x.x.x.x will always, for all clients, whether otherwise using the vpn or not, be reached via the vpn.

_________________
2x Netgear XR500 and 3x Linksys WRT1900ACSv2 on 53544: VLANs, VAPs, NAS, station mode, OpenVPN client (AirVPN), wireguard server (AirVPN port forward) and clients (AzireVPN, AirVPN, private), 3 DNSCrypt providers via VPN.
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum