Exclude an IP from DNS Catch All

[TheWood1978]

Hi

On the UDM I'm using the following script to catch all traffic even if the client is trying to use a different DNS server other than PiHole.

This works perfectly. However i have a requirement for one IP to use a different public DNS server. I am not having any luck excluding one IP from being redirected. Any help is appreciated.

Here is the current script.

#!/bin/sh

IPV4_IP="172.16.0.235"
#IPV6_IP="2607:fXXXXXXXXXXXXX03"
FORCED_INTFC="br0"

for intfc in ${FORCED_INTFC}; do
  if [ -d "/sys/class/net/${intfc}" ]; then
    for proto in udp tcp; do
      prerouting_rule="PREROUTING -i ${intfc} -p ${proto} ! -s ${IPV4_IP}  ! -d ${IPV4_IP} --dport 53 -j LOG --log-prefix [DNAT-${intfc}-${proto}]"
      iptables -t nat -C ${prerouting_rule} 2>/dev/null || iptables -t nat -A ${prerouting_rule}
      prerouting_rule="PREROUTING -i ${intfc} -p ${proto} ! -s ${IPV4_IP} ! -d ${IPV4_IP} --dport 53 -j DNAT --to ${IPV4_IP}"
      iptables -t nat -C ${prerouting_rule} 2>/dev/null || iptables -t nat -A ${prerouting_rule}

      # (optional) IPv6 force DNS (TCP/UDP 53) through DNS container
#      if [ -n "${IPV6_IP}" ]; then
#        prerouting_rule="PREROUTING -i ${intfc} -p ${proto} ! -s ${IPV6_IP}  ! -d ${IPV6_IP} --dport 53 -j LOG --log-prefix [DNAT-${intfc}-${proto}]"
#        ip6tables -t nat -C ${prerouting_rule} 2>/dev/null || ip6tables -t nat -A ${prerouting_rule}
#        prerouting_rule="PREROUTING -i ${intfc} -p ${proto} ! -s ${IPV6_IP} ! -d ${IPV6_IP} --dport 53 -j DNAT --to ${IPV6_IP}"
#        ip6tables -t nat -C ${prerouting_rule} 2>/dev/null || ip6tables -t nat -A ${prerouting_rule}

      #fix "reply from unexpected source: with dig, also fixes devices that reject a dns response from an ip that did not match their query target ip"
        #remove them if they already exist so they dont multiply, because we cannot use -C it throws "No chain/target/match by that name."
      iptables -t nat -D POSTROUTING -d ${IPV4_IP} -p tcp -m tcp --dport 53 -j MASQUERADE -m comment --comment "IPV4 DNS Pi-hole MASQUERADE"
      iptables -t nat -D POSTROUTING -d ${IPV4_IP} -p udp -m udp --dport 53 -j MASQUERADE -m comment --comment "IPV4 DNS Pi-hole MASQUERADE"
#      ip6tables -t nat -D POSTROUTING -d ${IPV6_IP} -p tcp -m tcp --dport 53 -j MASQUERADE -m comment --comment "IPV6 DNS Pi-hole MASQUERADE"
#      ip6tables -t nat -D POSTROUTING -d ${IPV6_IP} -p udp -m udp --dport 53 -j MASQUERADE -m comment --comment "IPV6 DNS Pi-hole MASQUERADE"

        #add the postrouting fix sleeping because some of the entries dont make it into post routing for some reason
      sleep 30
      iptables -t nat -A POSTROUTING -d ${IPV4_IP} -p tcp -m tcp --dport 53 -j MASQUERADE -m comment --comment "IPV4 DNS Pi-hole MASQUERADE"
      iptables -t nat -A POSTROUTING -d ${IPV4_IP} -p udp -m udp --dport 53 -j MASQUERADE -m comment --comment "IPV4 DNS Pi-hole MASQUERADE"
#      ip6tables -t nat -A POSTROUTING -d ${IPV6_IP} -p tcp -m tcp --dport 53 -j MASQUERADE -m comment --comment "IPV6 DNS Pi-hole MASQUERADE"
#      ip6tables -t nat -A POSTROUTING -d ${IPV6_IP} -p udp -m udp --dport 53 -j MASQUERADE -m comment --comment "IPV6 DNS Pi-hole MASQUERADE"

#      fi
    done
  fi
done

Thanks in advance.

[TheWood1978]

Ive got this working now by adding

for proto in udp tcp; do
  iptables -t nat -A PREROUTING -s 172.16.0.139 -p tcp -m tcp --dport 53 -j ACCEPT
  iptables -t nat -A PREROUTING -s 172.16.0.139 -p udp -m udp --dport 53 -j ACCEPT
  iptables -t nat -A PREROUTING -s 172.16.0.115 -p tcp -m tcp --dport 53 -j ACCEPT
  iptables -t nat -A PREROUTING -s 172.16.0.115 -p udp -m udp --dport 53 -j ACCEPT

At the top. Hope this helps anyone else.

[Tntdruid]

Can you do the same whit IPv6?

[TheWood1978]

Yeah i dont see why not if you have a static ipv6 address assigned.

[wolffcatsky]

Hey this is exactly what I want to do except I want it to go through NextDNS. Do I still use the NextDNS CLI proxy on the UDM?

[boostchicken]

the same script will work just fine just setup nextdns

[ghost]

Why use PREROUTING/POSTROUTING instead of FILTER? If you use DoH/DoT, you can block outbound UDP port 53 packets.

[wolffcatsky]

Depends on your objective, do you want to block, or do you want to redirect.