Norton connectsafe DNS and page redirect

RouterOS General
1

Hello,

I have established a mikrotik router hEx lite (192.168.1.1) between a VDSL modem (192.168.3.1) and a local network with wireless access points and clients in order to apply rules of safe browsing with norton connectsafe DNS servers.
For this, I have disabled DHCP server from VDSL modem and enabled it on the mikrotik router hEx. Secondly, I assigned static IP to mikrotik router hEx and routing rules/SRC NAT for the wireless clients and everything working as required. The DHCP server running on mikrotik router hEx assignes IP in the range 192.168.1.10 - 192.168.1.40 with DNS 192.168.1.1 and set primary and secondary DNS servers the Norton connectsafe DNS servers.
Everything work as required, however I would like to redirect wireless client browser to a local web server with a webpage to inform clients that they tried to browse unsafe content (based on the policy implemented by the norton connectsafe DNS). Currently, when a wireless client tries to browse to pornography,gambling,malicious website, a webpage of Norton connectsafe is shown (Ip http://54.200.58.62/…).
How could I redirect wireless clients to a LAN server webpage (192.168.1.16) and avoid showing the Norton connectsafe web page when unsafe content is browsed.

Thank you
DSL-Mikrotik.jpg

2

If all blocked domains resolve to 54.200.58.62, then simply redirect it to your server:

/ip firewall nat
add action=dst-nat chain=dstnat dst-address=54.200.58.62 in-interface=<LAN> to-addresses=192.168.1.16

You may limit it to only http(s) ports if you wish. Make sure you configure your web server to accept any hostname. And since it’s in same subnet as clients, you also need hairpin NAT:

/ip firewall nat
add action=masquerade chain=srcnat dst-address=192.168.1.16 src-address=192.168.1.0/24

But this will mask client’s original address, so if you were planning some logging who’s trying to access blocked stuff, you can’t do it this way. It would be possible, but you would have to put clients and server in different subnets, then you wouldn’t need this srcnat rule.

3

Thank you very much for the suggestion. With some small changes in the incoming interface, it seems to work.