Question setup DNS server on secondary router not working

[Dasa]

Hi all,

I want to setup DNS on secondary router to block ads on youtube and sites, it takes connection from main router with cat5, second router is setup as router (not AP), the router is tplink and under advanced under internet under Ipv4 I setup address of NextDNS (free) but it does not seem to be working.

When I test NextDNS from chrome built-in feature it works and blocks most ads on local news site but when doing this on secondary router nothing happens
I disabled secure DNS in chrome settings in case it causes problems but no change happened
I restarted router after adding the DNS info ofc
I tested with nslookup and it points to IP of the router correctly but server: unknown and it does lookup example.com correctly
I remembered to use ipconfig /flushdns but it did not help

Any idea what I am doing wrong?

Edit: wifi adapter DNS is set to automatic

 

[MrN1ce9uy]

You mentioned the IPV4 address set to NextDNS. That doesn't sound right. You would need to set the DNS address to NextDNS. You would also need to ensure you are not assigning local subnet IP addresses from the secondary router. You would also need to assign the main router's DNS as the local IP address of the DNS router (your secondary router). You would also need to ensure firewall rules allow for all of this.

Having two routers complicates things and can introduce double NAT, which is typically frowned upon. It would be simpler to just use the main router as your DNS forwarder to NextDNS and not have a secondary router.

 

[bill001g]

I really don't see what you are trying to accomplish.

If you just want to use nextdns as your dns server just change the main router DHCP setting so it gives your end device that rather than its own IP.

I don't see why you would need a second router. Almost no consumer router can actually act as a DNS server. They at best act as a DNS cache which itself causes lots of problems. There are third party firmware that can let a router run a real DNS function but that is a lot of effort.

The common way for home users to do this is to get a cheap raspberry pi and run PIHOLE. The raspberry pi will locally block DNS entries and if you want you can then have the raspberry pi forward the actual requests to a server like nextdns. Doing it this way you are in full control and can add or delete sites from the list at will. Any internet based service you have little to no control....well there are ones you can pay for that let you build your own filter lists.

 

[bill001g]

A added note. DNS has gotten very mesy lately. There are now settings in the browser and some other types of applications that will bypass the system DNS settings and use the setting in the application.

This was nice before microsoft supported encrypted DNS but now it is a pain having to check chrome and firefox etc to make sure there is not some strange DNS setting being used.

 

[Dasa]

.

You mentioned the IPV4 address set to NextDNS. That doesn't sound right. You would need to set the DNS address to NextDNS

I meant the DNS address

You would also need to ensure you are not assigning local subnet IP addresses from the secondary router.

you mean 255.255.??

I checked main router has 192.168.0 range
The secondary has 192.168.1 range

The weird thing I found is that main router has weird DNS in WAN status I can't find anything about it online 172.18.18.2 and 172.18.18.18
In LAN settings, DNS is empty...

You would also need to assign the main router's DNS as the local IP address of the DNS router (your secondary router)

Interesting tip didn't think it is possible to point DNS inside network like that... but the whole point of setting up secondary router is that I don't want people connected to main router to use my DNS settings, so I can leave that as it is? except is has weird DNS in status I need to figure out ofc.

Having two routers complicates things and can introduce double NAT, which is typically frowned upon. It would be simpler to just use the main router as your DNS forwarder to NextDNS and not have a secondary router.

First router is serving a family member separate floor/home, I don't want to mess with his setup unless I can help make his setup better.

 

[Dasa]

I really don't see what you are trying to accomplish.

If you just want to use nextdns as your dns server just change the main router DHCP setting so it gives your end device that rather than its own IP.

I don't see why you would need a second router. Almost no consumer router can actually act as a DNS server. They at best act as a DNS cache which itself causes lots of problems. There are third party firmware that can let a router run a real DNS function but that is a lot of effort.

The common way for home users to do this is to get a cheap raspberry pi and run PIHOLE. The raspberry pi will locally block DNS entries and if you want you can then have the raspberry pi forward the actual requests to a server like nextdns. Doing it this way you are in full control and can add or delete sites from the list at will. Any internet based service you have little to no control....well there are ones you can pay for that let you build your own filter lists.

Each router serve a different floor/home, I don't want to mess with floor of main router settings, unless I can fix things for them but prefer to leave things as is.

Main router does not reach the other floor, wifi always caused a problem, so I used cat5 to extend connection to a new router.

I don't really understand the difference between local DNS or service DNS (still a pc noob), I won't use NextDNS forever, it's not totally free, I will change to AdGaurd or something once I research the topic. I haven't yet.

For now I am not going for raspberry pi direction.

Yes I checked the chrome browser I have, it does not use anything.

The weird thing is that sites that claim to be able to find out what DNS I use kept pointing to DNS of my ISP, they didn't detect when I used Google DNS, only nslookup told me what DNS is in use. Any idea why?

 

[bill001g]

In many ways it is easier if you are using a different DNS to just put in it manually on the device.

Running 2 routers in the house can cause issues. If you have no need to say share files with other devices in the house it likely will be ok. Makes troubleshooting issues harder sometimes but it should work...just be careful that both routers do not use the same LAN ip subnet.

Although you can set the DNS in the router I do not always trust doing it that way. The router is acting as a proxy.

Best way is to put the DNS you want to use in the DHCP setting in the router. When the router assigned a IP to your end device it will also give it this DNS you assign. It pretty much is the same as if you had changed the setting manually in the nic but the DHCP server will now give you the DNS you want. The default is to give you the IP of the router itself and it act as a proxy. You can see what is being assigned with the IPCONFIG command.

I am not sure if the adblocking dns servers support encrypted DNS. Although nobody can see what you are doing on any site because of HTTPS encryption they can get the names of sites you are using. Encrypted DNS prevents that. They can still get the IP but since many IP are in large shared data centers it does not always get them the actual web site you are using.

You really want to use encrypted DNS if you can. Mostly it prevents your ISP from collecting data.

 

[MrN1ce9uy]

Firewall logs reveal a lot.

I'm not sure how advanced your router's firewall rules and capabilities are, but you can allow TCP/UDP port 53 and 853 only to the NextDNS DNS address and block TCP/UDP port 53 and 853 to all to help ensure you reach the desired DNS service.

 

[bill001g]

Firewall logs reveal a lot.

I'm not sure how advanced your router's firewall rules and capabilities are, but you can allow TCP/UDP port 53 and 853 only to the NextDNS DNS address and block TCP/UDP port 53 and 853 to all to help ensure you reach the desired DNS service.

Only partially works. A lot of the newer DNS is using DOH rather than DOT. Ie dns over http rather than TLS.
This is intentionally to prevent blocking of dns and encrypted dns. It uses port 443 just like HTTPS.

Just as it prevents the ISP or someone else from blocking your DNS it also prevent you from blocking a browser that is setup to use its own DNS. I am not sure if you can even block it with the windows firewall on the machine itself.

In this case I think it is purely a matter of getting it configured correctly and then being careful you do not accidentally bypass the settings.

 

[MrN1ce9uy]

Only partially works. A lot of the newer DNS is using DOH rather than DOT. Ie dns over http rather than TLS.
This is intentionally to prevent blocking of dns and encrypted dns. It uses port 443 just like HTTPS.

Just as it prevents the ISP or someone else from blocking your DNS it also prevent you from blocking a browser that is setup to use its own DNS. I am not sure if you can even block it with the windows firewall on the machine itself.

In this case I think it is purely a matter of getting it configured correctly and then being careful you do not accidentally bypass the settings.

The firewall rules should be configured in the router's firewall to ensure devices and IoT don't try to automatically use their own DNS (lots of IoT devices use 8.8.8.8 by default). DoH typically won't be initiated unless an application is configured to use it. However, there are some that could use it by default I suppose.

 

[Dasa]

In many ways it is easier if you are using a different DNS to just put in it manually on the device.

Running 2 routers in the house can cause issues. If you have no need to say share files with other devices in the house it likely will be ok. Makes troubleshooting issues harder sometimes but it should work...just be careful that both routers do not use the same LAN ip subnet.

Although you can set the DNS in the router I do not always trust doing it that way. The router is acting as a proxy.

Best way is to put the DNS you want to use in the DHCP setting in the router. When the router assigned a IP to your end device it will also give it this DNS you assign. It pretty much is the same as if you had changed the setting manually in the nic but the DHCP server will now give you the DNS you want. The default is to give you the IP of the router itself and it act as a proxy. You can see what is being assigned with the IPCONFIG command.

I am not sure if the adblocking dns servers support encrypted DNS. Although nobody can see what you are doing on any site because of HTTPS encryption they can get the names of sites you are using. Encrypted DNS prevents that. They can still get the IP but since many IP are in large shared data centers it does not always get them the actual web site you are using.

You really want to use encrypted DNS if you can. Mostly it prevents your ISP from collecting data.

On the secondary router I'm not worried about my PC, it's actually connected directly to main router to avoid wifi problems, I just wanted all other devices, TV, phones and other pc of family to avoid ads when connected to wifi of the secondary router.

I feel I really entered the rabbit whole with DNS, there is a lot of info I had no clue about, even though I am only scratching the surface but I have been testing and reading about DNS (just to know the abbreviations and terms) and I have found out the following:

The DNS I setup on my router (NextDNS and AdGaurgd) were really working when testing on my PC (I made my PC use secondary wifi temporarily) but they both don't block ads like I expected, I setup and account with Adgaurd and made sure everything is showing up on dashboard and everting is green and connected and blocked sites were accumulating in counter, and I used sites people mentioned by those DNS companies and 3rd party sites, and my own local site, in general DNS alone does not block anything near what a browser extension like adgaurd itself or ublock origin does for me , I kept complaining thinking they are not working when they were working just not like what I expected, the local site news seems almost 100% immune to DNS blocking, using incognito, restarting PC and router, Flushing DNS, nothing would remove their ads, the ads might be setup manually by the site and not coming from known ad sites, this is my conclusion but I don't know how to prove it, only browser extension can block their ads.

DNS does not block youtube ads for me which is 90% of the reason I wanted to set it up on my router!

2nd problem all these "free" DNSs are not really free, I barely used PC for one hour and I was at 2k out of 300k of monthly limit so I don't think this will work, it's even much worse, Adgaurd wants me to reconnect my router to their server everytime my IP change or pay to fix this, I don't know how their DNS work when not registering.

****************

Using 2 routers are the only option, wifi from main router is 100% blocked by floor walls, I don't what other method you suggest, maybe you mean not set it up as router mode you mean it? but I still prefer two different networks, yes they both have different IP 192.168.0 vs 192.168.1, there is no interest for any interactions between devices from each network at this time, my main PC is always connected to main router so it can connect to main network and I connect it to wifi of secondary router to connect to devices on secondary network.

The only problem I am aware of is phones connect to secondary network does not cast to TV unless router restarted, or I use code manually. I wish to solve this problem but I have no clue what is causing it.

*********************
I never heard of DNS for DHCP, I am using it now as advised, the router itself is pointing to main router though, using nslookup I get correct server of Adgaurd so DNS is working for devices connected to router.

**********************

I will keep looking into Encrypted DNS, but I feel hiding my activity from ISP or big brother won't work well unless I use a good paid VPN so I am not going to worry about this too much, I'll presume they see everything, I heard big sites use their own IP address, only small sites hide under a range of IP address .
**********

Since DNS is not blocking ads like I want specially youtube ads I don't know what is my next step but thank you for all the info, this has been eye opening for me, I needed to know all this, sadly can't seem to benefit from it.

Firewall logs reveal a lot.

I'm not sure how advanced your router's firewall rules and capabilities are, but you can allow TCP/UDP port 53 and 853 only to the NextDNS DNS address and block TCP/UDP port 53 and 853 to all to help ensure you reach the desired DNS service.

To make sure DNS is working? Now I think it is (except poor results), well I have TL-WR941HP v2.0, I see no error in logs except LED control that Tplink asks users to ignore, it has NAT forwarding section though with port triggering.

But since Adgaurd dashboard is saying it is working and blocking a lot of sites I guess it is working, 11k sites blocked in less than 24hours with light use and no useful results.


Based on this do I need to bother with quad9 or cloudflare or something else? I heard adgaurd was supposed to be the extreme one of them all.

 

[bill001g]

This is why a lot of people are using what is called pihole. A raspberry pi is going to be cheaper than most routers by a lot. I am not sure how involved setting up pihole and getting it to block the ads you want is. There are completely forums for people who are doing it.

The problem with DNS blocking is it assumes that the ads come from a different place than the content. This is great for the most offensive form of advertising and the ones where you worry about getting malware via ads. The ones that come from the site itself are a bit harder. Things like browser extensions can see the actual URL since they can see the data after it is unencrypted so they can filter certain URL from a location and not others.

Unfortunately google being one of worst offender of pushing unwanted adds also controls the OS on phones and the most common pc browser. We will see if they get the message when people abandon chrome on pc because they prevent blocking of ads and scripts.

 

[MrN1ce9uy]

To make sure DNS is working? Now I think it is (except poor results), well I have TL-WR941HP v2.0, I see no error in logs except LED control that Tplink asks users to ignore, it has NAT forwarding section though with port triggering.

But since Adgaurd dashboard is saying it is working and blocking a lot of sites I guess it is working, 11k sites blocked in less than 24hours with light use and no useful results.


Based on this do I need to bother with quad9 or cloudflare or something else? I heard adgaurd was supposed to be the extreme one of them all.

Firewall logs will show you what DNS your PC is using.

I wouldn't expect an adblocker to block YouTube ads in videos. But, I haven't looked much into that.

 

[Dasa]

This is why a lot of people are using what is called pihole. A raspberry pi is going to be cheaper than most routers by a lot. I am not sure how involved setting up pihole and getting it to block the ads you want is. There are completely forums for people who are doing it.

The problem with DNS blocking is it assumes that the ads come from a different place than the content. This is great for the most offensive form of advertising and the ones where you worry about getting malware via ads. The ones that come from the site itself are a bit harder. Things like browser extensions can see the actual URL since they can see the data after it is unencrypted so they can filter certain URL from a location and not others.

Unfortunately google being one of worst offender of pushing unwanted adds also controls the OS on phones and the most common pc browser. We will see if they get the message when people abandon chrome on pc because they prevent blocking of ads and scripts.

I wanted something free for the time being, but I am going to start looking into hardware options

Yeah they will keep evolving ways to put ads sadly and we need to keep up

I was die hard Firefox fan but had lot's of weird problems that they couldn't fix but I will dump chrome if I can't block ads with it.

Thanks for all the help

Firewall logs will show you what DNS your PC is using.

I wouldn't expect an adblocker to block YouTube ads in videos. But, I haven't looked much into that.

I tried finding DNS info but couldn't, maybe my router is not that advanced, it's ok I'm not interested in this anymore, I know DNS is working.

You watch ads in videos? using chrome extensions I never saw ads on youtube, I didn't know they exist or forgot lol, in video or around it. now I see everything once I disabled extensions to test DNS, I even have youtube popup for premium ad, it's nightmare without extensions.

Thank you for all the help!