How to force network clients to use specific DNS server?

blackguyza

blackguyza

Well-Known Member
Joined
Mar 6, 2009
Messages
453
Reaction score
11
Location
Heilbron, Free State
I am a network administrator at a high school and after setting up a pi-hole to restrict access to certain websites I realized that some learners are able to bypass the settings by changing the DNS settings on their mobile phones to something like 8.8.8.8.

I am running an Ubuntu 20.04.6 LTS server as the DHCP server.

My pi-hole is running on another Ubuntu server and this is our school's main DNS server used to block traffic from unwanted websites.
 
You can intercept DNS requests and redirect them to your internal DNS server. That needs to be done on the router (is your DHCP server also your router?).

For example, something along these lines using iptables (although this will depend on how your firewall is setup):
iptables -t nat -A PREROUTING -i <interface> -p udp --dport 53 -j DNAT --to <DNS_server_IP>:53
 
grim42 said:
You can intercept DNS requests and redirect them to your internal DNS server. That needs to be done on the router (is your DHCP server also your router?).

For example, something along these lines using iptables (although this will depend on how your firewall is setup):
iptables -t nat -A PREROUTING -i <interface> -p udp --dport 53 -j DNAT --to <DNS_server_IP>:53
Click to expand...
What is the plan with DoH?
 
Why are you letting phones in the network in the first place?
 
bwana said:
Why are you letting phones in the network in the first place?
Click to expand...
Because we have a shortage of computer resources at school and the better way is to allow learners to use their phones to access the internet and download past question papers, do their assignments, etc.
 
If it was me, I'd do a couple of things. First I'd switch out pi-hole for adguard home. Then I'll see which devices are connecting but not using adguard and ban them.
 
How about using pfsense on the router, then you could use something like pfBlocker-NG

Edit: Looks like not recommended, check video
 
Last edited:
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X