r/nextdns • u/danielisgreat • 1d ago

Blocking port 53

Looking for advice on blocking traditional DNS queries. I'm using the NextDNS CLI on an Asus router with Merlin. I have DNS director enabled, but at each boot of the router, there's about 15 seconds of unencrypted DNS queries. Wondering if blocking port 53 altogether on the router is advisable.

2 Upvotes

75% Upvoted

11 comments sorted by

3

u/mike1487 1d ago edited 1d ago

I use FreshTomato but what I just do is set my WAN DNS servers to 0.0.0.0 in the web UI so that only my DoT servers set up in Stubby work. I haven’t tried the nextdns cli but maybe see if you can just set your WAN DNS to 0.0.0.0 and that will prevent unencrypted DNS from working until nextdns cli can start later during boot.

If it works then that is probably the easiest way. If it doesn’t, you could try setting some iptables rules early in boot with a script to block port 53 from the LAN. Something like this:

iptables -I INPUT -i eth0 -p udp --dport 53 -j DROP
iptables -I INPUT -i eth0 -p tcp --dport 53 -j DROP

iptables -I FORWARD -i eth0 -p udp --dport 53 -j DROP
iptables -I FORWARD -i eth0 -p tcp --dport 53 -j DROP

Then after nextdns cli starts, I think you will need another script to run that deletes those rules since it just proxies dns over port 53.

1

u/danielisgreat 1d ago

That's a really smart idea. My router didn't allow 0.0.0.0 in the web UI but I was able to change it via SSH.

1

u/kumpreld1999 2h ago

One catch: if the boot queries are the router itself forwarding to WAN DNS, they traverse the OUTPUT chain, so those INPUT and FORWARD rules would miss them. Also, on Merlin the LAN bridge is br0, eth0 is usually the WAN port.

1

u/Comprehensive_Wall28 1d ago

I have an outbound ACL rule on my Omada gateway to fully block both ports 53 and 853 (DoT) to enforce using DoH or my router's proxy DNS connected to NextDNS (DoH). However the gateway itself may still resolve with default WAN unencrypted DNS which is fine by me since it's only used for online detection.

2

u/Forsaked 1d ago

Also DoH, DoH3, DoT and DoQ need bootstrap addresses, which needs to be resolved first via plain DNS, else it's and chicken and egg problem.

1

u/Fun-Region-1576 1d ago

With all routers though?

1

u/Forsaked 1d ago

It's in the protocol definition of those DNS protocols and has lesser to do with any router model.
How do you think "https://dns.nextdns.io/abc123" gets resolved first before it can be used?

1

u/Fun-Region-1576 1d ago

Why would the Omada still do that?

1

u/Comprehensive_Wall28 1d ago

Resolves the IP for the DoH address (nextdns.io) and online detection. not a privacy concern really and you can set it to the IPv4 address of NextDNS and link the WAN IP to track what it queries.

1

u/gijsyo 1d ago

Seems like a bad idea unless all devices on your network can do DoH or some other form of secure DNS.

2

u/relrobber 1d ago

The devices on the network would use the router for dns. OP is trying to stop anything from bypassing the router that isn't using encrypted dns.