Community discussions

 
edmondyjh
just joined
Topic Author
Posts: 18
Joined: Wed Nov 09, 2016 3:29 pm

bypass opendns

Thu Nov 10, 2016 4:57 pm

right now, i redirect all my dhcp client to use opendns, so how do i add my selected local ip to bypass the opendns and use back my service provider dns?


Sent from my iPhone using Tapatalk
 
tuzok
just joined
Posts: 6
Joined: Thu Nov 10, 2016 2:24 pm

Re: bypass opendns

Thu Nov 10, 2016 5:12 pm

I don't understand question mixing DHCP and DNS, if you refer to DHCP then make sure to have checked "Use Peer DNS" under your IP>DHCP Client settings.
 
edmondyjh
just joined
Topic Author
Posts: 18
Joined: Wed Nov 09, 2016 3:29 pm

Re: bypass opendns

Thu Nov 10, 2016 5:17 pm

my service provider uses this dns:-
1.9.1.9, 202.188.0.132 . I manage to redirect all my local dhcp client to use the opendns dns which is 208.67.220.220, 208.67.222.222. So how do i exclude or add in the local ip to use back my service provider dns?


Sent from my iPhone using Tapatalk
 
tuzok
just joined
Posts: 6
Joined: Thu Nov 10, 2016 2:24 pm

Re: bypass opendns

Thu Nov 10, 2016 5:29 pm

Set up OpenDNS entries in IP > DNS > Servers and make sure to check Use Peer DNS for your IP > IP Client of your WAN port. This will cause your DHCP server to propagate all four addresses.
If you want only your ISP's DNS on your Windows, I'd suggest to modify your network adapter IPv4 properties and set manually there.
 
erlinden
Member Candidate
Member Candidate
Posts: 174
Joined: Wed Jun 12, 2013 1:59 pm

Re: bypass opendns

Thu Nov 10, 2016 5:31 pm

For performance reasons I suggest using the internal DNS server of your Mikrotik as DNS server for all clients. You can forward requests to any DNS server you like, either OpenDNS or your provider. Still not clear what you would like to accomplish.
 
edmondyjh
just joined
Topic Author
Posts: 18
Joined: Wed Nov 09, 2016 3:29 pm

Re: bypass opendns

Thu Nov 10, 2016 5:49 pm

i have added some rules in my firewall/nat in which all my local traffic will be redirect to use 208.67.222.222, 208.67.220.220 (opendns) as the dns. example if i would like my ip which is "192.168.0.1" to use back my local provider dns, how do i do it? modifying the ipv4 properties manually doesn't helps too. i tried changing it manually to 1.9.1.9 , 202.188.0.132 , but its not working.


Sent from my iPhone using Tapatalk
 
User avatar
cdiedrich
Forum Veteran
Forum Veteran
Posts: 928
Joined: Thu Feb 13, 2014 2:03 pm
Location: Basel, Switzerland // Bremen, Germany
Contact:

Re: bypass opendns

Thu Nov 10, 2016 5:55 pm

I agree in not seeing a reason for this - but we're not here to discuss reasons but to provide help :-)

I would give this one a try:
/ip firewall address-list
add list=opendns address=208.67.222.222
add list=opendns address=208.67.220.220
/ip fiewall nat
add action=dst-nat chain=dstnat dst-address-list=opendns dst-port=53 protocol=udp src-address=192.168.0.1 to-addresses=1.9.1.9
EDIT: you say you have added fw rules to redirect all traffic to openDNS - that may be the reason why your manual change of DNS server doesn't work.
Put my rule atop your other DNS-modifying dst-nat rules.

-Chris
Christopher Diedrich
MTCNA, MTCUME, MTCWE
Basel, Switzerland
Bremen, Germany

There are 10 types of people: Those who understand binary and those who don't.
There are two types of people: Those who can extrapolate from incomplete data
 
edmondyjh
just joined
Topic Author
Posts: 18
Joined: Wed Nov 09, 2016 3:29 pm

Re: bypass opendns

Thu Nov 10, 2016 6:03 pm

thanks mate, will give it a try by tomorrow and update the results, the reason for this is "192.168.0.1 " is an administrator pc ip, so using back the service provider dns will unblock/unrestricted lotsa website as i have set to block lotsa categories in the opendns that i have set it.


Sent from my iPhone using Tapatalk
 
busla
just joined
Posts: 17
Joined: Tue Nov 08, 2016 12:35 pm
Location: Russia, Saint Petersburg

Re: bypass opendns

Thu Nov 10, 2016 11:34 pm

define custom DHCP option for local DNS
set this option for selected leases
 
edmondyjh
just joined
Topic Author
Posts: 18
Joined: Wed Nov 09, 2016 3:29 pm

Re: bypass opendns

Fri Nov 11, 2016 3:17 am

so how do i do that?


Sent from my iPhone using Tapatalk
 
edmondyjh
just joined
Topic Author
Posts: 18
Joined: Wed Nov 09, 2016 3:29 pm

Re: bypass opendns

Sun Nov 13, 2016 12:58 pm

the code given is not working, btw, here is the code that i added to catch the dns traffic:-


/ip firewall nat
add chain=dstnat action=dst-nat to-addresses=208.67.222.222 to-ports=53 protocol=tcp dst-port=53
add chain=dstnat action=dst-nat to-addresses=208.67.222.222 to-ports=53 protocol=udp dst-port=53
add chain=dstnat action=dst-nat to-addresses=208.67.220.220 to-ports=53 protocol=tcp dst-port=53
add chain=dstnat action=dst-nat to-addresses=208.67.220.220 to-ports=53 protocol=udp dst-port=53

* Anyone has another code that works to by pass this rules ?
 
Sob
Forum Guru
Forum Guru
Posts: 4812
Joined: Mon Apr 20, 2009 9:11 pm

Re: bypass opendns

Mon Nov 14, 2016 3:38 am

Make a list with addresses excluded from OpenDNS:
/ip firewall address-list
add address=192.168.1.111 list=no-opendns
And then do one of the following:

a) Add accept rule before your existing rules:
/ip firewall nat
add action=accept chain=dstnat src-address-list=no-opendns
b) Modify your existing rules like this:
/ip firewall nat
add action=dst-nat chain=dstnat dst-port=53 protocol=udp src-address-list=!no-opendns to-addresses=\
    1.2.3.4
...
And you only need two, one for udp and one for tcp. The other two won't ever get used, because all dns packets are caught by first two.
People who quote full posts should be spanked with ethernet cable. Some exceptions for multi-topic threads may apply.
 
edmondyjh
just joined
Topic Author
Posts: 18
Joined: Wed Nov 09, 2016 3:29 pm

Re: bypass opendns

Mon Nov 14, 2016 3:40 am

ok, thanks buddy, will try it later and update it


Sent from my iPhone using Tapatalk
 
edmondyjh
just joined
Topic Author
Posts: 18
Joined: Wed Nov 09, 2016 3:29 pm

Re: bypass opendns

Mon Nov 14, 2016 7:05 am

i tried the code as given by "sob", its working good, many thanks mate.


Sent from my iPhone using Tapatalk

Who is online

Users browsing this forum: Google [Bot] and 21 guests