Force to use specific DNS provider at network

Question

OpenDNS offers a quite simple way for internet filtering by categories. Of course who could get the correct IP address can easily bypass the filter but it would be enough for my expectations.

The bigger problem is that changing DNS provider at client side is not a big deal.

So my question is whether it is possible to force to use only specific DNS provider at local network.

The target device is a WiFi router with OpenWRT. (However I would welcome any similarly simple to set up filtering solution but the main question is the DNS provider forcing.)

Solution 1

With iptables firewall this works (Openwrt also uses iptables):

iptables -t nat -A PREROUTING -s 192.168.1.0/24 -p udp --dport 53 -j DNAT --to 192.168.1.1
iptables -t nat -A PREROUTING -s 192.168.1.0/24 -p tcp --dport 53 -j DNAT --to 192.168.1.1

On your router use Opendns servers. 192.168.1.1 is the Openwrt router ip. 192.168.1.0/24 is the LAN network subnet. Modify the above rules according to your network subnet setup. If you are trying out the above rules on the openwrt prompt, then replace -A with -I. If you are saving the rules in a script that loads on bootup or on restart then -A switch should work. With this setup whatever dns servers the client machines use, when the dns request reaches the router, the destination ip will be changed to that of your router's ip. You can find out more about iptables on Openwrt here.

Solution 2

Yes, it is possible to make all the hosts in the local network to use only specific DNS provider. You can do this by configuring a Proxy server like Squid Proxy and making all the hosts in the local network to access the Internet only through this proxy server. So every request whether it is DNS request or HTTP request or any other request, will first go to the proxy server. This way whatever DNS entry would be written while configuring proxy server will be used by all the hosts in the local network.