Captive DNS

captive-dns.conf

firewall {
    name GUEST_IN {
        default-action accept
        description "packets from guest network"

        rule 1000 {
            action accept
            description "allow DNS to pihole"
            destination {
                address 10.65.49.3
                port 53
            }
            protocol tcp_udp
        }

        rule 1001 {
            action drop
            description "block access to external name servers"
            destination {
                port 53
            }
            protocol tcp_udp
        }

        rule 2000 {
            action accept
            description "allow established/related"
            protocol all
            state {
                established enable
                invalid disable
                new disable
                related enable
            }
        }
    }
}
services {
    nat {
        rule 12 {
            description "Captive DNS for IoT network"
            destination {
                address !10.65.49.3
                port 53
            }
            inbound-interface eth1.20
            inside-address {
                address 10.65.49.3
                port 53
            }
            log enable
            protocol tcp_udp
            type destination
        }

        rule 5002 {
            description "Translate DNS reply back for IoT network"
            destination {
                address 10.65.49.3
                port 53
            }
            log disable
            outbound-interface eth1.20
            protocol tcp_udp
            type masquerade
         }
    }
}