I am trying to setup an RB2011 at a school to force all DNS requests to go to the open DNS family shield name server to block adult content. I’ve tried doing this with a NAT redirect and with a dst-nat rule and neither are working. I can still get to any website I want to even after flushing DNS caches on the router and the host device. Could anyone take a look at the below setup and see if there’s anything that could be causing this? The byte counter is going up on my dst-nat rule for udp port 53 traffic.
Not a DNS expert but do suggest that the full config or more parts thereof be shown as many parts of a config are inter related…
The answer may lie in running a separate DNS serverr (raspberry Pi like) as its not clear to me if the Router DNS services and rules are up to the job?
There have been many threads on this sort of topic so my memory is jumbled…
The problem lies in ensuring that a PC with its own settings may attempt to get around your attempts to shoe them to Open DNS.
Hey Anav, I’ve been going through different threads and following along with a number of different settings some of your suggestions on other posts too. Unfortunately none are working for me. Here’s some more settings that might be helpful:
y/16/2022 15:12:41 by RouterOS 6.47.9
software id = FMQK-ZJ9T
model = RB2011UiAS
/interface bridge
add admin-mac=2C:C8:1B:A1:7B:E4 auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether1 ] name=“ether1 [WAN]”
set [ find default-name=ether2 ] name=“ether2 (Vly)”
set [ find default-name=ether3 ] name=“ether3 (Krndl)”
/ip dns
set allow-remote-requests=yes servers=208.67.222.123,208.67.220.123
/ip firewall filter
add action=accept chain=input comment=
“defconf: accept established,related,untracked” connection-state=
established,related
add action=drop chain=input comment=“defconf: drop invalid” connection-state=
invalid
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=drop chain=forward comment=“Drop DNS” in-interface=
“ether3 (Krndl)” protocol=udp src-address=192.168.150.0/24 src-port=53
add action=drop chain=input comment=“defconf: drop all not coming from LAN”
in-interface-list=!LAN
add action=drop chain=forward comment=“defconf: drop invalid” connection-state=
invalid
add action=drop chain=forward comment=“defconf: drop all from WAN not DSTNATed”
connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=dst-nat chain=dstnat comment=
“DST NAT Krndl to 192.168.150.1 DNS server TCP” dst-port=53
in-interface=“ether3 (Krndl)” protocol=tcp src-address=192.168.150.0/24
to-addresses=192.168.150.1 to-ports=53
add action=dst-nat chain=dstnat comment=
“DST NAT Krndl to 192.168.150.1 DNS server UDP” dst-port=53
in-interface=“ether3 (Krndl)” protocol=udp src-address=192.168.150.0/24
to-addresses=192.168.150.1 to-ports=53
add action=masquerade chain=srcnat src-address=192.168.150.0/24
/ip service
set telnet disabled=yes
set ftp disabled=yes
set ssh disabled=yes
set www-ssl disabled=no
/lcd
set time-interval=daily
/system clock
set time-zone-name=Africa/Johannesburg
/system identity
set name=Valley
/tool bandwidth-server
set authenticate=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
Sorry, but you’ve already lost the war at the start, against porn,
because filters don’t block everything, and the students will probably always know more than you do.
The solution, which blocks the most, but still does not prevent completely, is to block EVERYTHING except the allowed sites.
Family shield mentions porn protection but mainly for home if you have a school account then likely more corporate/business and thus Umbrella would apply…
Thanks for the replies. I know its a losing battle but the post was more to figure out why its not working. All that I want to achieve is forcing dns traffic originating from my lan to the open dns family shield server, which it seems to be doing, but sites like p*rn hub still work just fine.
Paste this, empty all caches, also on devices, and retry:
/ip firewall filter
remove [find where comment="Drop DNS"]
/ip dhcp-server network
set [find] dns-server=192.168.88.1,192.168.150.1
/ip firewall nat
set [find where comment~"DST NAT Krndl to 192.168.150.1 DNS server"] dst-address=!192.168.0.0/16
/interface pppoe-client
set [find] use-peer-dns=no
Oh whoops! I added that filter rule in to test something and forgot about it. I’ve removed it and run the scripts you suggest but sadly its still not working as expected. Anyway, I’m rather going to setup a VLAN for the students and only allow certain web access. I think that would be easier.
Certain RB2011 models are officially supported by openwrt. Which allows much more customization for special applications, like yours, because being totally opensource.
I.e. content filtering can be forced much better running openwrt compared to RoS, using certain packages of openwrt.
In your case, DoH is the reason, that openDNS is not used.
As a first step to force usage of openDNS, you might install IP-based blocklists of all the “well-known” DoH-servers on the RB2011, to force the browsers to fall back to standard DNS.
In case, you have the possibility to ask all your students to install a special certificate on their devices, you can use an alternative method for content filtering, via proxy.
Assuming, you run openwrt.
