Use router as (external) DNS server

[Shira]

I have an RT-AC68U with Merlin and Diversion installed, is there any way I can use the router as a DNS server for other devices outside of my LAN? (i.e mobile phone on data)

 

[ColinTaylor]

Not really unless the clients were connecting to your router through its VPN server.

 

[sbsnb]

Why couldn't you just port forward 53 to the RT-68U and set your clients' DNS servers to your WAN IP?

 

[ColinTaylor]

Why couldn't you just port forward 53 to the RT-68U and set your clients' DNS servers to your WAN IP?

Because running a publicly accessible DNS server would be a magnet for bots/people wanting to abuse it. e.g. DNS amplification attacks. Same reason you don't host a publicly accessible email server.

 

[sbsnb]

Because running a publicly accessible DNS server would be a magnet for bots/people wanting to abuse it. e.g. DNS amplification attacks. Same reason you don't host a publicly accessible email server.

I agree it's a bad idea. It's not as difficult as it might sound to set up a VPN server and keep your mobile devices connected to the LAN via VPN at all times. That's how I operate.

 

[Shira]

I agree it's a bad idea. It's not as difficult as it might sound to set up a VPN server and keep your mobile devices connected to the LAN via VPN at all times. That's how I operate.

I tried that but Diversion doesn't seem to work through VPN.

 

[sbsnb]

Two things:

1. Is your VPN server advertising your router as the DNS server for clients to use?

2. Are your VPN clients are using the DNS server advertised by your VPN server (which should be the same as regular LAN clients use)?

 

[Shira]

I got it working finally, but using PPTP instead of OpenVPN.

 

[Jumpstarter]

https://www.aaflalo.me/2019/03/dns-over-tls/ there are instructions to setup your own DNS server, but you would have to adapt it to your setup ALOT, and you would have to have the skills and know how to do it. It is not something as simple as forwarding a port and exposing your connection to attack.

VPN is the better option, Let the DNS server gurus be the dns server gurus, while you be the regular home user is usually the better option.

 

[Zarrow]

Just reading about DNS amplification attacks. Is it safe to assume that Merlin default settings would not expose our routers to such an attack?
I did the dig test outlined on this page: http://openresolver.com/ using the WAN IP of my router and got
";; connection timed out; no servers could be reached"
so I guess I'm okay?

 

[ColinTaylor]

Just reading about DNS amplification attacks. Is it safe to assume that Merlin default settings would not expose our routers to such an attack?

Correct.