DNS redirection on WAN only? Help!

RouterOS Wireless Networking
1

Hi everybody,

I am using RB951G and a network topology as in the following:

WAN (ether1 port) (ip:192.168.0.34, DNS: 192.168.0.20) >>> LAN (Bridge which includes Wireless, AP1@ether2, AP2@ether3) (Network:10.11.12.0/24, DNS:10.11.12.1)

The firewall rules are:

 0    ;;; > WAN
      chain=input action=accept connection-state=established,related in-interface=WAN log=no log-prefix="" 

 1    ;;; > LAN
      chain=input action=accept in-interface=LAN log=no log-prefix="" 

 2    ;;; LAN > WAN
      chain=forward action=accept in-interface=LAN out-interface=WAN log=no log-prefix="" 

 3    ;;; WAN > LAN
      chain=forward action=accept connection-state=established,related in-interface=WAN out-interface=LAN log=no log-prefix="" 

 4    ;;; LAN <-> LAN
      chain=forward action=accept in-interface=LAN out-interface=LAN log=no log-prefix="" 

 5    ;;; Input
      chain=input action=drop log=yes log-prefix="DROP" 

 6    ;;; Forward
      chain=forward action=drop log=yes log-prefix="DROP"

The NAT rules are:

 0    ;;; defconf: masquerade
      chain=srcnat action=masquerade out-interface=WAN

I have DNS cache enabled on the RB951G, and set DNS server at the DHCP as 10.11.12.1 which is the same as my RB951G ip address. What I am trying to do is to have DNS cached at RB951G and avoid ISP DNS interception at port 53, instead I want to use another DNS server with different port (such as OpenDNS at port 443 [208.67.222.222:443]).

Based on this, I tried to add the following rules in NAT:

ip firewall nat add chain=dstnat action=dst-nat to-addresses=208.67.222.222 to-ports=443 protocol=tcp dst-port=53
ip firewall nat add chain=dstnat action=dst-nat to-addresses=208.67.222.222 to-ports=443 protocol=udp dst-port=53

The rules are OK in matter of overriding ISP DNS interception, but that also is overriding my DNS cache at RB951G. I need help in setting the correct rules to make the DNS server at RB951G to send DNS queries to 208.67.222.222:443 and cache the responses and then send the answers to the Bridge (which includes Wireless, AP1@ether2, AP2@ether3). Basically using 208.67.222.222:443 insted of my ISP DNS (192.168.0.20:53 or any 53 port queries at WAN).


Thanks for the help!

2

Looks like I’m not going to get help! Thanks anyway, everybody.

3

What you want can’t be currently done with RouterOS. If you want to use it as DNS cache for clients, then clients must be sending their queries to router and not to external resolvers (that’s obvious). So it would have to be the router sending queries to remote resolvers on different port. But RouterOS DNS config doesn’t support different ports. And dstnat, which could be another solution, is not supported for traffic originating from router.