Block Port 53 on Linksys WRT1900AC

[mstation]

Hello all!

I have recently started using the OpenDNS content filtering tool and I am quite happy with it.

However I would like to strengthen furthermore the system by blocking the users who are using user defined DNSs instead of the standard ones of OpenDNS.

I have read that I should add a rule on the router to forward port 53 and I have tried that on my Linksys WRT1900AC by doing what you see attached to this post.

However after applying such a rule all the DNS requests are not replying even those coming from computers which obtain the DNS automatically by the server.

By the way what IP address should I put, at the moment I am putting an address of a main switch we have that connects all the devices we have also including the WiFi access points.

Thanks for your help!

linksys.png

[mattwilson9090]

First, a correction, OpenDNS is not a content filtering tool. OpenDNS is a regressive DNS service with a number of additional security and filtering features, but they all leverage it's DNS based roots, meaning OpenDNS can only work with and filter domain names, it knows nothing about websites, webpages, URL's, content, or anything but the domain name it is told to look up.

As to you wanting to in some manner force all DNS traffic to OpenDNS, the screen shot you provided is for port forwarding, not any sort of outbound control or filtering. I haven't tested it, but there's a good chance that what you did would essentially "break the internet" for everything on your network since all DNS traffic into your network is being forwarded to the switch, not whichever device made the request in the first place. The address you are asking about is irrelevant since you are trying this with the wrong tool and in fact should delete what you added.

I don't have this model router so I don't even know if it can support this type of function but there are a few things I can suggest 1) make sure you have the latest firmware installed on the router 2) look in the router settings for an option that either specifically refers to port 53 and forwarding that kind of traffic or a section for firewall rules (for this task ignore anything that refers to port forwarding) 3) if the firmware from Linksys does not support this functionality consider 3rd party firmware such as DD-WRT, Tomato, or Toastman. Note that type of thing is generally considered to require some expertise or knowledge, and should not be undertaken by a technical novice

[mstation]

Dear,

thanks for your reply. Sorry if for ease I preferred to describe OpenDNS as a tool. I pretty much understand how DNS works and for me this is a good and simple way to apply a filtering content feature to my network.

As for the settings on the Router there seems to be nothing on this model that could allow me such a configuration. Since the Router is not of my property and since it is not even a cheap router I would prefer not to change it's Firmware with something unstable different from the original. Not to mention DD-WRT firmware seems not to be available for this model. OpenWRT on the other side seems to have an unstable version of it which I surely will not be flashing. I tried to quickly check for Tomato but did not find anything really relevant to the immediate usage.

So I would kindly like to change question to: What device could I purchase to place between my WRT1900AC and the Linksys 48P Switch capable of helping me with the additional features I am needed at this point?

Thanks!

[mattwilson9090]

The WRT1900AC and many other recent routers with ARM processors are problematic for the 3rd party firmware world. Although they supposedly intended it for use with that market segment, they aren't really supporting the people who develop those, so support for the ARM-based routers has been advancing slowly. I think most of the firmware developers would say that what they have is fairly stable and reliable, but still is only in a beta state of development.

I know there are multiple devices on the market that would do this, but I'm not familiar with many of them. For my own personal use and in my office I've been using an ASUS RT-N66U that I flashed with Toastman firmware (it's a branch from the final Tomato iteration). I chose Toastman for reasons other than forwarding port 53 traffic, but it has that feature as well. It cost me about $150 a year ago from Amazon.

I've been having good luck with the RT-N12D1 for about $50 with clients of mine who don't need the full horsepower of the N66U or the higher end 802.11N WiFi that I chose this hardware for. I don't think ASUS firmware supports port 53 forwarding, and I'm not sure if the N12D1 supports Toastman but you can look at the Toastman download page http://www.4shared.com/dir/v1BuINP3/Toastman_Builds.html/#dir=v1BuINP3 for a partial list of compatible hardware depending on your needs. From comments I've read the RT-N16 seems popular and quite stable. It's probably the highest end hardware before you step up to the N66U (at least in the ASUS line of routers)

[mstation]

Thanks for your reply.. The Asus RT-N66U seems to be quite a strong router. Would you still suggest it for a working environment with 30 to 40 users on daily?

I might consider using this as an alternative to the Linksys WRT1900AC but I am afraid it does not have the extra juice to handle easily all the users we have at the office.

Please let me know how big is your office and if you ever had issues that needed a reboot.

Thanks a lot,

[mattwilson9090]

Yes, the N66U is pretty powerful. More than what I need in a router, but I bought it largely for the advanced WiFi capability and it was the highest end router at the time that I knew Toastman would run at the same time. I'd say the hardware is comparable to the WRT1900 other than WiFi being a bit lower end (N rather than ac) but the WRT was too expensive, had features I didn't need (especially media and server features), and didn't support the firmware I wanted to use.

My office is small, and nowhere near the size you are talking. I've never had to reboot it for problems with the router, only if I made a settings change that required a reboot or electrical outages.

I generally wouldn't consider any consumer grade router, including the N66U or the WRT1900 for that many users, and would instead be looking at a business class UTM such as a SonicWall or Calyptix.

That said it would come down to the internet speed you have available, how many people are generally using the internet at a given time, what kind of traffic they are generating (especially VOIP), what kind of features you have turned on and even how many of them are using WiFi.

With that many users I'd say the odds are good that you have a true server that can handle DHCP and DNS so that load on the router, especially memory can be offloaded freeing up the router to act purely as a router.

Number of WiFi users is also a major consideration since you're presumably using WPA2 which requires encryption/decryption on the access point. If you have 2 or 3 WiFi users hosting on a single consumer router like this should be ok, but if have 20 or 30 that's going to make a huge impact on the processor and memory resources that already have to track router functions, NAT and whatever else. With that many you'd want at least one dedicated access point since WiFi can only host so many connections at once and WiFi bandwidth is limited and shared like with a hub rather than a switch.

Bottom line, yes, I think you could use the RT-N66U in this environment, including port 53 forwarding to OpenDNS, but you'd need to look closely at internet connection speed, what your users are doing with it, and whether or not you can offload local DHCP, DNS, and access point services somewhere else.

[theblackbird]

I know exactly the meaning of your screenshot! its not what you are thinking, it means following;

The setup that you have shown in your image tells the incoming traffic from internet to route to your computer (192.168.1.172) at port 53. For example, if your public IP address is 205.126.125.214 , then if you type 205.126.125.214:53 from outside of your network, you will be routed to 192.168.1.172:53

I have done similar setting on my computer when I want to access it from outside - different ports though.

By any chance were you able to block port 53 on your Linksys WRT1900AC ?

[mstation]

Unfortunately no. Looks like it is not possible for what I understood.. :'(