GT-BE98 Pro 3006.102.5 DNSDirector

[stealurkill]

I was working properly before. From what I see the change is in what redirect to Router does.

I was going off the changelog here

- FIXED: DNSDirector "Router" mode would not always work properly
with IPv6 (now uses REDIRECT instead of DNAT, which was
backported from iptables 1.4.19).
- FIXED: DNSDirector would try to create iptables rules even
when that SDN should not allow DNSDirector if it shares
the main LAN interface. This could break DNSDirector
on the main network.

and this thread

GT-BE98 pro DNS Director issue with my pihole?

Hi everybody... First post. I'm running the Asuswrt-merlin firmware. It's pretty great! There's a larger story but I think my DNS director hates me. I pointed it at the User defnied 1 at my pihole and it seemed to put the iptable entry last, which mean it'll basically never get hit. #iptables...

www.snbforums.com

 

[Tech9]

I see. What you need to potentially change in your setup is stop redirections through the router's LAN IP (redirect to User Defined instead of Router) and probably select unfiltered upstream DNS servers for your Pi-hole(s). You have Quad9 filtered + Cloudflare unfiltered. This will stop the router as client in Pi-hole(s) logs and allow you to see better what's filtered. If Quad9 filters something upstream you'll never know what it was. Or if you want extra layer of protection make the second upstream DNS also filtered.

 

[stealurkill]

I see. What you need to potentially change in your setup is stop redirections through the router's LAN IP (redirect to User Defined instead of Router) and probably select unfiltered upstream DNS servers for your Pi-hole(s). You have Quad9 filtered + Cloudflare unfiltered. This will stop the router as client in Pi-hole(s) logs and allow you to see better what's filtered. If Quad9 filters something upstream you'll never know what it was. Or if you want extra layer of protection make the second upstream DNS also filtered.

That's what i had before and probably will go back. I switched due to the firmware update today for testing. My network is wild and controlling what goes out is ideal lol

 

[Tech9]

With 10M+ domains blocklist you perhaps don't need a Pi-hole. Just unplug the WAN cable for similar results.

 

[stealurkill]

With 10M+ domains blocklist you perhaps don't need a Pi-hole. Just unplug the WAN cable for similar results.

Lol For some reason this container shows both piholes for the amount of blocked domains. It's only 5 million. It's really mostly malware, trackers, ads, and pron.

I was more showing the queries and blocked.

 

[bennor]

Last thing, it seems since DNS Director is working properly now within this new firmware, I don't have to point the wan dns to the piholes to get the router to use it as the dns.

Unless something else is at play?

One comment about putting the Pi-Hole IP's in the Asus router's WAN DNS fields. This isn't a configuration that the Pi-Hole documentation recommends for Asus routers. Instead they recommend using the LAN DHCP Server DNS fields. As their documentation (link follows) indicates; when using the Pi-Hole IP addresses in the WAN fields and having Conditional Forwarding enabled on the PI-Hole, you can setup a potential feedback loop of requests that can flood/cripple the local network. Been there, accidentally done that (a long time ago when first using Pi-Hole).

ASUS router - Pi-hole documentation

docs.pi-hole.net

When Conditional Forwarding is enabled on the Pi-Hole and properly resolving client names; generally when looking at the Pi-Hole Query Logs, any Client entry with the router's name tends to be an indication of DNS Director performing a Redirection.

A note on Conditional Forwarding option in Pi-Hole. If using Guest Network Pro Profile with the Use same subnet as main network disabled (or on non 3006.102.x firmware, if using YazFi), be sure to input (if you haven't done so already) the Guest Network IP address subnet class into the Conditional Forwarding field to allow the router to process the Pi-Hole Conditional Forwarding name lookup requests for the Guest Network clients. For example, in my use case on the 3006.102.x firmware with two Guest Network Pro Profiles with Use same subnet as main network disabled for both profiles, I have the following in the Pi-Hole's DNS settings Conditional Forwarding field. It allows for correct name lookup and correct client name reporting in the Pi-Hole Query Log/reporting.

true,192.168.2.0/24,192.168.2.1,lan
true,192.168.52.0/24,192.168.2.1,lan
true,192.168.53.0/24,192.168.2.1,lan

In the above example, 192.168.2.0/24 is the main LAN, 192.168.52.0/24 is the first Guest Network Pro Profile, 192.168.53.0/24 is the second Guest Network Pro Profile. 192.168.2.1 is the router IP address. And "lan" is the local domain name (set on the router's LAN > RT-AX86U Pro's Domain Name field).

 

[stealurkill]

One comment about putting the Pi-Hole IP's in the Asus router's WAN DNS fields. This isn't a configuration that the Pi-Hole documentation recommends for Asus routers. Instead they recommend using the LAN DHCP Server DNS fields. As their documentation (link follows) indicates; when using the Pi-Hole IP addresses in the WAN fields and having Conditional Forwarding enabled on the PI-Hole, you can setup a potential feedback loop of requests that can flood/cripple the local network. Been there, accidentally done that (a long time ago when first using Pi-Hole).

ASUS router - Pi-hole documentation

docs.pi-hole.net

When Conditional Forwarding is enabled on the Pi-Hole and properly resolving client names; generally when looking at the Pi-Hole Query Logs, any Client entry with the router's name tends to be an indication of DNS Director performing a Redirection.

A note on Conditional Forwarding option in Pi-Hole. If using Guest Network Pro Profile with the Use same subnet as main network disabled (or on non 3006.102.x firmware, if using YazFi), be sure to input (if you haven't done so already) the Guest Network IP address subnet class into the Conditional Forwarding field to allow the router to process the Pi-Hole Conditional Forwarding name lookup requests for the Guest Network clients. For example, in my use case on the 3006.102.x firmware with two Guest Network Pro Profiles with Use same subnet as main network disabled for both profiles, I have the following in the Pi-Hole's DNS settings Conditional Forwarding field. It allows for correct name lookup and correct client name reporting in the Pi-Hole Query Log/reporting.

true,192.168.2.0/24,192.168.2.1,lan
true,192.168.52.0/24,192.168.2.1,lan
true,192.168.53.0/24,192.168.2.1,lan

In the above example, 192.168.2.0/24 is the main LAN, 192.168.52.0/24 is the first Guest Network Pro Profile, 192.168.53.0/24 is the second Guest Network Pro Profile. 192.168.2.1 is the router IP address. And "lan" is the local domain name (set on the router's LAN > RT-AX86U Pro's Domain Name field).

Yeah I have ran the pihole as the WAN dns since GT-AC5300 launch till last week. I have every client named and mac bound with no guest network. I knew it could cause issues, but the only issue i had was the router requesting too many queries too fast. I have noticed the asus router reaching out to some chinese site as well. This is one of my main concerns. I am not certain it truly is from the asus router but i can not track it down to a specific client either. This was before i turned on DNS Director as well. I have conditional forwarding setup similar with just one subnet as well.

 

[junior120872]

If one fails so i can switch everything over with the click of a button or two.

Why aren't you running keepalived on the systems then you'll only have to worry about 1 ip address?

 

[emwgee]

One comment about putting the Pi-Hole IP's in the Asus router's WAN DNS fields. This isn't a configuration that the Pi-Hole documentation recommends for Asus routers. Instead they recommend using the LAN DHCP Server DNS fields. As their documentation (link follows) indicates; when using the Pi-Hole IP addresses in the WAN fields and having Conditional Forwarding enabled on the PI-Hole, you can setup a potential feedback loop of requests that can flood/cripple the local network. Been there, accidentally done that (a long time ago when first using Pi-Hole).

ASUS router - Pi-hole documentation

docs.pi-hole.net

When Conditional Forwarding is enabled on the Pi-Hole and properly resolving client names; generally when looking at the Pi-Hole Query Logs, any Client entry with the router's name tends to be an indication of DNS Director performing a Redirection.

A note on Conditional Forwarding option in Pi-Hole. If using Guest Network Pro Profile with the Use same subnet as main network disabled (or on non 3006.102.x firmware, if using YazFi), be sure to input (if you haven't done so already) the Guest Network IP address subnet class into the Conditional Forwarding field to allow the router to process the Pi-Hole Conditional Forwarding name lookup requests for the Guest Network clients. For example, in my use case on the 3006.102.x firmware with two Guest Network Pro Profiles with Use same subnet as main network disabled for both profiles, I have the following in the Pi-Hole's DNS settings Conditional Forwarding field. It allows for correct name lookup and correct client name reporting in the Pi-Hole Query Log/reporting.

true,192.168.2.0/24,192.168.2.1,lan
true,192.168.52.0/24,192.168.2.1,lan
true,192.168.53.0/24,192.168.2.1,lan

In the above example, 192.168.2.0/24 is the main LAN, 192.168.52.0/24 is the first Guest Network Pro Profile, 192.168.53.0/24 is the second Guest Network Pro Profile. 192.168.2.1 is the router IP address. And "lan" is the local domain name (set on the router's LAN > RT-AX86U Pro's Domain Name field).

Hi,

I have four subnets that are separated from the main network for IoTs and guests - 192.168.52.x, 192.168.53.x, 192.168.54.x, 192.168.55.x

So if I set up Pi-hole Conditional Forwarding option as

true,192.168.50.0/24,192.168.50.1,lan
true,192.168.52.0/24,192.168.50.1,lan
true,192.168.53.0/24,192.168.50.1,lan
true,192.168.54.0/24,192.168.50.1,lan
true,192.168.55.0/24,192.168.50.1,lan

Do I also have to enable DNS director and set up their profile in redirection field?

 

[bennor]

Do I also have to enable DNS director and set up their profile in redirection field?

Yes, if you want the four IoT profiles DNS requests to be routed to the Pi-Hole. With DNS Director's Guest Network Pro Profiles routing to the Pi-Hole, and with the Pi-Hole's Conditional Forwarding enabled and properly configured, the Pi-Hole should correctly list the Guest Network Pro Profile client names in it's queries. Otherwise the Pi-Hole may simply list the DNS request as coming from the router rather than the Guest Network Pro client.

 

[emwgee]

Yes, if you want the four IoT profiles DNS requests to be routed to the Pi-Hole. With DNS Director's Guest Network Pro Profiles routing to the Pi-Hole, and with the Pi-Hole's Conditional Forwarding enabled and properly configured, the Pi-Hole should correctly list the Guest Network Pro Profile client names in it's queries. Otherwise the Pi-Hole may simply list the DNS request as coming from the router rather than the Guest Network Pro client.

Are dns queries of those subnets still routed to Pi-Hole even without setting up DNS Director, but just not showing the client name?
What about DNS server settings for those subnets, do I just leave it as DEFAULT?


Also after setting up Pi-Hole conditional forward as I mentioned above, some of the client names display in Pi-Hole query log has ".lan" appended to them. Is this how it is supposed to be?

 

[bennor]

Are dns queries of those subnets still routed to Pi-Hole even without setting up DNS Director, but just not showing the client name?
What about DNS server settings for those subnets, do I just leave it as DEFAULT?

In my very quick and dirty testing, with Guest Network Pro Profile in DNS Director set to No Redirection, and Global Redirection set to the Pi-Hole (User Defined DNS #1) it doesn't appear that the DNS requests of the Guest Network Pro clients are routed to the Pi-Hole. I've tested with the Guest Network Pro Profile DNS setting configured to Default and configured for Quad 9.

You may need to do some experimenting on your end to ensure the settings are working as you want them to work.

 

[emwgee]

In my very quick and dirty testing, with Guest Network Pro Profile in DNS Director set to No Redirection, and Global Redirection set to the Pi-Hole (User Defined DNS #1) it doesn't appear that the DNS requests of the Guest Network Pro clients are routed to the Pi-Hole. I've tested with the Guest Network Pro Profile DNS setting configured to Default and configured for Quad 9.

You may need to do some experimenting on your end to ensure the settings are working as you want them to work.

Thanks for the information, much appreciated.

 

[emwgee]

In my very quick and dirty testing, with Guest Network Pro Profile in DNS Director set to No Redirection, and Global Redirection set to the Pi-Hole (User Defined DNS #1) it doesn't appear that the DNS requests of the Guest Network Pro clients are routed to the Pi-Hole. I've tested with the Guest Network Pro Profile DNS setting configured to Default and configured for Quad 9.

You may need to do some experimenting on your end to ensure the settings are working as you want them to work.

None of the guest networks has internet access anymore once I changed their Guest Network Pro Profile in DNS Director set to "User Defined 1".
I used my phone to connect to each and get "Internet may not be available" message on my Samsung galaxy phone, no internet access after connected. Am I missing some settings ?





Here is the current DNS settings of my router:

Router ip is 192.168.50.1, Domain Name "lan"

LAN DNS server 1 is set to "192.168.50.33 (which is the Raspberry Pi running Pi-Hole with Unbound)", and Advertise router's IP in addition to user-specified DNS set to "no"
LAN DNS server 2 not assigned

WAN DNS setting is assign to "9.9.9.11, 149.112.112.11"
Enable DNSSEC support "yes"
Validate unsigned DNSSEC replies "yes"
Prevent client auto DoH "auto"
DNS privacy protocal "DNS-over-TLS"
DNS-over-TLS Profile "strict"
DNS-over-TLS Server List "1.1.1.1","1.0.0.1"

Four guest subnets - 192.168.55.x, 192.168.55.x, 192.168.55.x, 192.168.55.x, DNS setting all set to "DEFAULT"

Pi-Hole conditional forward setting
true,192.168.50.0/24,192.168.50.1,lan
true,192.168.52.0/24,192.168.50.1,lan
true,192.168.53.0/24,192.168.50.1,lan
true,192.168.54.0/24,192.168.50.1,lan
true,192.168.55.0/24,192.168.50.1,lan

Pi-Hole custom DNS server setting
127.0.0.1#5335

 

[bennor]

@emwgee, is your DNS Director User Defined DNS #1 set to 192.168.50.33?
In the Pi-Hole DNS Interface setting, have you selected the "Respond only on interface" option and applied the settings?

If the Pi-Hole is set to "Allow only local requests" then it likely won't respond to DNS requests outside the same IP subnet as the Pi-Hole device.

 

[emwgee]

@emwgee, is your DNS Director User Defined DNS #1 set to 192.168.50.33?
In the Pi-Hole DNS Interface setting, have you selected the "Respond only on interface" option and applied the settings?

If the Pi-Hole is set to "Allow only local requests" then it likely won't respond to DNS requests outside the same IP subnet as the Pi-Hole device.

yes, 192.168.50.33 is set up as User Defined DNS#1
yes, Pi-Hole is set to "Allow only local requests"

I will change Pi-Hole to "Respond only on interface eth0" and try again to see how it goes.

 

[emwgee]

@emwgee, is your DNS Director User Defined DNS #1 set to 192.168.50.33?
In the Pi-Hole DNS Interface setting, have you selected the "Respond only on interface" option and applied the settings?

If the Pi-Hole is set to "Allow only local requests" then it likely won't respond to DNS requests outside the same IP subnet as the Pi-Hole device.

Yes, that was it.
It is working now.

Guests and IoT subnet's devices IP started to show up in Pi-Hole query log now, and internet access is also available for these subnets after setting Pi-Hole to "Respond only on interface eth0".

Thanks for your help.

 

[stealurkill]

Why aren't you running keepalived on the systems then you'll only have to worry about 1 ip address?

lol just have not got around to it. and since i have not had any issues i have not even worried with it.