[martymonster]

I have been setting up DNSFilter (was using OpenDNS) and have set the DNS servers into the router.
I have also set up rules for blacklists and whitelists on DNSFilter.
All of that is working.
Now I am trying to set up DNS forwarding as per the 2 settings which DNSFilter provide.
This is to prevent anyone on the network from changing their DNS settings to use another DNS provider.
I have added this to the Firewall rules from a CMD window

iptables -t nat -A OUTPUT -p udp --dport 53 -j DNAT --to 103.247.36.36:53
iptables -t nat -A OUTPUT -p tcp --dport 53 -j DNAT --to 103.247.36.36:53


Then when doing an
iptables -t nat -L ---- the following is displayed
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
DNAT udp -- anywhere anywhere udp dpt:dns to:103.247.36.36:53
DNAT tcp -- anywhere anywhere tcp dpt:dns to:103.247.36.36:53



As a test to see if it works, I have changed one device to use DNS 8.8.8.8 and then have tried to access a blocked site.
Instead of getting the blocked page, I can still access the site.
Can someone tell me if the 2 firewall rules are correct for dd-wrt or if they requires something to be changed?

[Alozaros]

for blocking other DNS's use force DNS option form basic setup page down at the bottom, make sure you use DNSmasq...

add those lines in advanced DNSmasq rules

no-resolv
server=103.247.36.36

or what ever server you want...
do keep in mind for those devices that have baked 8.8.8.8
the only thing you can do is add those lines in commands (safe firewall script)

iptables -t nat -I PREROUTING -i br0 -s 192.168.1.103 -p udp --dport 53 -j DNAT --to 103.247.36.36
iptables -t nat -I PREROUTING -i br0 -s 192.168.1.103 -p tcp --dport 53 -j DNAT --to 103.247.36.36

192.168.1.103 suppose to be the IP of your device, change it to what ever you've given to those..
do keep in mind some of those may even have baked 8.8.8.8 that uses TLS encryption or HTTPS and those are hard
to mitigate...as they go encrypted... than those lines will not work

[egc]

For some more reading about blocking/redirecting DNS see:
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327261

In the IPSET guide is a paragraph about

[SurprisedItWorks]

@alozaros is right that "force DNS" and the "no-resolv" (no "e") and "server=..." lines are all you need. You can use more than one "server=..." line if you want to use multiple servers. If you want them to be tried in order, there's a GUI button for it, but the one you want to try first should have its "server=..." last, as DNSMasq reverses things.

You don't even need the iptables commands, as the "force" checkbox in the GUI causes dd-wrt to insert the rules for you.