On my router with OpenWRT, I use dnsmasq for DNS poisoning to block ads. If the host is on the list, the router replies to the DNS request with 192.168.99.99, which only and always serves a 1x1 transparent gif (the pixelserv method).
However, local devices can bypass this by directly using their own DNS server. How can I reroute these DNS requests so the ads are blocked?.
I tried commands like these (18.104.22.168 and 22.214.171.124 being the DNS servers, 192.168.1.102 the source device, 192.168.1.1 the IP of my router):
iptables -t nat -A PREROUTING -d 126.96.36.199 -j DNAT --to-destination 192.168.1.1 iptables -t nat -A PREROUTING -d 188.8.131.52 -j DNAT --to-destination 192.168.1.1 # or: iptables -t nat -A PREROUTING -i wlan0 -s 192.168.1.102 -p udp --dport 53 -j REDIRECT --to-port 53 iptables -t nat -A PREROUTING -i wlan0 -s 192.168.1.102 -p tcp --dport 53 -j REDIRECT --to-post 53
I tried adding adding a traffic rule through the OpenWrt admin panel -> Source NAT, matching "Any TCP, UDP From IP 192.168.1.102 in lan To any host, port 53 in lan", with action "Rewrite to source IP 192.168.1.1, port 53". I believe this is effectuated in iptables as well either way.
But I find the DNS queries are still resolving:
root@OpenWrt:~# tcpdump -vvv -i wlan0 port 53 Chromecast.lan.42591 > google-public-dns-a.google.com.domain: [udp sum ok] 57897+ A? pubads.g.doubleclick.net. (42) google-public-dns-a.google.com.domain > Chromecast.lan.42591: [udp sum ok] 57897 q: A? pubads.g.doubleclick.net. 5/0/0 pubads.g.doubleclick.net. [5h59m59s] CNAME partnerad.l.doubleclick.net., partnerad.l.doubleclick.net. [4m59s] A 184.108.40.206, partnerad.l.doubleclick.net. [4m59s] A 220.127.116.11, partnerad.l.doubleclick.net. [4m59s] A 18.104.22.168, partnerad.l.doubleclick.net. [4m59s] A 22.214.171.124 (132)
Maybe a completely different method, for example through dnsmasq, would work? I could not find this, however.
(I've found some explanation on how to reroute to another remote DNS server, but that won't help me here. It's mostly for unblocking regions or for Tomato or DD-WRT. Also, this is closely related to my previous question)