How to redirect ALL DNS traffic to OpenDNS

[stanthemam]

I am so lost at the moment. I have been searching the web for hours and can not manage to find a clear answer. I am trying to redirect all DNS traffic to OpenDNS. I have a son who is somewhat tech savvy and believe he has been using a google DNS (or some alternate form of DNS) to bypass the blocks I have in place with OpenDNS. I was told that I could disable port 53 on my modem, but when I did it blocked ALL outbound DNS traffic, including OpenDNS and denied any access to the internet. My modem only has a setting to block, not to allow, and it will not allow me to put a setting in place where all DNS traffic is rerouted to OpenDNS. Is there ANYTHING else I can do at all to resolve this issue? it has been driving me crazy all day.

[rotblitz]

You may be able to block other DNS services (like Google's) more explicitly.

If not, you may need another router to do what you want if your current router doesn't have this capabilities you're looking for.

[mattwilson9090]

Without knowing what you actually did, it's hard to say what you did wrong.

However, if what you did was to block ALL port 53 traffic you will disable all DNS functionality, including OpenDNS. A rule to block all port 53 traffic generally also needs a rule to allow port 53 traffic to OpenDNS to process BEFORE the blocking rule. The effects of this are to allow port 53 traffic to OpenDNS, but nowhere else.

Since you apparently can't implement an allow rule this might not be possible with your current combination of router hardware and firmware. You will likely need to change the firmware and/or hardware to something that allows this.

[stanthemam]

Is there an external firewall I could use to implement this? Or do you know of any firmware that is simple enough for a newby to use to implement such a command?

[rotblitz]

External firewalls are not a viable solution for home environments.

We cannot point you at an alternatively available firmware, because you missed to say what exact router model you have.

[stanthemam]

Oops! So I have a Hitron CGMN 3552. It is a modem and router in one. I do not have a separate router.

[rotblitz]

Ah yes, you mentioned this in another thread.  As I said there, I cannot help you with this device.

[stanthemam]

You had mentioned that I may need to allow OpenDNS explicitly? Do you mind elaborating on that? And also you mentioned that I may need to block Google DNS service. Do you know of a way to do this?

[bruce.thorton]

Go to your firewall custom screen. You  may be able to block access to ip address 8.8.8.8 and any other address there.

[stanthemam]

Do you mean my routers firewall or does the firewall on my computer work for the entire network? I am sorry if that is a terribly stupid question, I am new at this. The firewall on my modem is very limited and unfortunately does not allow for many changes.

[rotblitz]

"You had mentioned that I may need to allow OpenDNS explicitly?"

This has been explained by mattwilson9090 in the other thread.

"to block Google DNS service. Do you know of a way to do this?"

This is what bruce.thorton explained.  And yes, he means your router, because firewall rules on the computer are effective only on this computer.

[swemic]

Depending on what your modem / firewall could do, you might be able to do a STATIC NAT all UDP:53 traffic to OpenDNS server(s), guess that would be the best way to be absolutely sure that no other DNS service is used.

With this said, this means that you would alter both the source IP and the destination IP, which means that your modem / firewall need to be somewhat advanced capable to be able to handle such S-NAT:ing. 

However, if your modem / firewall is more of a home-user model, you should as stated previous
1. Create an Allow Rules for UDP/TCP port 53 to OpenDNS servers
2. Next in line of rules, create a Block All UDP/TCP port 53

Thats a semi-functional solution as well. 

[stanthemam]

Unfortunately all of the above is not possible to do with the modem/router combo that I have. The firewall settings are very minimal. They allow for a block port rule request, but they do not allow for an "allow" rule. So all I am able to do is turn off the port completely. It does not allow for any IP blocks either so blocking the google DNS will not work. This modem also does not allow any changes in the NAT settings so I am also at a loss there. So I'm at square one again. I feel like I have tried everything and nothing is working in my favour unfortunately.

[rotblitz]

If you want, you may post screen shots of the related router page(s) here. I may then run into new ideas.  Or if you have an electronic version of your router manual, you can attach it here.

[stanthemam]

Sure. Here are a few screenshots of the modem/router combo that I am using. There are also screenshots of my firewall settings. I can not seem to find a manual.

http://www.screencapture.ru/file/4df0531f

http://www.screencapture.ru/file/cBF11748

http://www.screencapture.ru/file/1d528c46

http://www.screencapture.ru/file/e26F7AE5