NextDNS catch-all for UDM (+IPv6)

0000000000_README.md

This gist may be out of date!

It's now located in an actual repo:

https://github.com/vt0r/nextdns-catchall

10-nextdns-catchall.sh

#!/bin/sh
# ---
# This file goes in /data/on_boot.d/10-nextdns-catchall.sh (mode a+x)

SERVICE_FILE="nextdns-catchall.service"
SOURCE_FILE_PATH="/data/${SERVICE_FILE}"
SYSTEMD_FILE_PATH="/etc/systemd/system/${SERVICE_FILE}"

# Exit right away if the source file is not present
if [ ! -f  $SOURCE_FILE_PATH ]; then
  echo "Can't find service file ${SOURCE_FILE_PATH}"
  exit 1
fi

sha256() {
  sha256sum $1 | cut -d' ' -f1
}

INSTALLED_SUM="$(sha256 $SYSTEMD_FILE_PATH)"
SOURCE_SUM="$(sha256 $SOURCE_FILE_PATH)"

if [ "$INSTALLED_SUM" = "$SOURCE_SUM" ]; then
  echo "Already installed and up to date. Doing nothing."
  exit 0
fi

cp $SOURCE_FILE_PATH $SYSTEMD_FILE_PATH
systemctl daemon-reload
systemctl enable $SERVICE_FILE
systemctl start $SERVICE_FILE

nextdns-catchall.service

# This file goes in /data/nextdns-catchall.service (mode a+r)
[Unit]
Description=NextDNS Catch all traffic
After=nextdns.service
Requires=nextdns.service

[Install]
WantedBy=multi-user.target nextdns.service

[Service]
Type=oneshot
RemainAfterExit=yes

# Add one of these for each bridge interface that has a LAN IP
# and hosts a LAN subnet (one for each VLAN). Examples:
ExecStart=sysctl -w net.ipv4.conf.br0.route_localnet=1
# ExecStart=sysctl -w net.ipv4.conf.br100.route_localnet=1
# ExecStart=sysctl -w net.ipv4.conf.br200.route_localnet=1
# ...
# Add one of these for each VPN interface (WireGuard, OpenVPN, Teleport)
# ExecStart=sysctl -w net.ipv4.conf.wgsrv1.route_localnet=1
# ExecStart=sysctl -w net.ipv4.conf.tun0.route_localnet=1
# ...
ExecStart=/usr/bin/env bash -c "iptables -w 30 -t nat -N NEXTDNS_CATCHALL || iptables -w 30 -t nat -F NEXTDNS_CATCHALL"
ExecStart=/usr/bin/env bash -c "iptables -w 30 -t nat -C PREROUTING -m udp -p udp --dport 53 -j NEXTDNS_CATCHALL >/dev/null 2>&1 || iptables -w 30 -t nat -A PREROUTING -m udp -p udp --dport 53 -j NEXTDNS_CATCHALL"
ExecStart=/usr/bin/env bash -c "iptables -w 30 -t nat -C PREROUTING -m tcp -p tcp --dport 53 -j NEXTDNS_CATCHALL >/dev/null 2>&1 || iptables -w 30 -t nat -A PREROUTING -m tcp -p tcp --dport 53 -j NEXTDNS_CATCHALL"
# Have some internal (or external) DNS servers you want to allow unencrypted queries to?
# The following two examples show how you can add exceptions to the catch all for UDP and TCP
# NOTE: this will allow UNENCRYPTED queries to hit any IP(s) you add here as exceptions, so be careful!
#       Allowing any external IPs here defeats the purpose of this script if you need to leave your internal network to reach them!
# You should specify each IP as a CIDR (just append /32), and you can add multiple, comma-separated, right after "-d" (destination)
# --
# ExecStart=iptables -w 30 -t nat -A NEXTDNS_CATCHALL -p udp -m udp -d 172.27.72.1/32,192.168.0.1/32 --dport 53 -j RETURN
# ExecStart=iptables -w 30 -t nat -A NEXTDNS_CATCHALL -p tcp -m tcp -d 172.27.72.1/32,192.168.0.1/32 --dport 53 -j RETURN
ExecStart=iptables -w 30 -t nat -A NEXTDNS_CATCHALL -p udp -m udp --dport 53 -j DNAT --to-destination 127.0.0.1:5342
ExecStart=iptables -w 30 -t nat -A NEXTDNS_CATCHALL -p tcp -m tcp --dport 53 -j DNAT --to-destination 127.0.0.1:5342
ExecStart=/usr/bin/env bash -c "ip6tables -w 30 -t nat -N NEXTDNS_CATCHALL || ip6tables -w 30 -t nat -F NEXTDNS_CATCHALL"
ExecStart=/usr/bin/env bash -c "ip6tables -w 30 -t nat -C PREROUTING -m udp -p udp --dport 53 -j NEXTDNS_CATCHALL >/dev/null 2>&1 || ip6tables -w 30 -t nat -A PREROUTING -m udp -p udp --dport 53 -j NEXTDNS_CATCHALL"
ExecStart=/usr/bin/env bash -c "ip6tables -w 30 -t nat -C PREROUTING -m tcp -p tcp --dport 53 -j NEXTDNS_CATCHALL >/dev/null 2>&1 || ip6tables -w 30 -t nat -A PREROUTING -m tcp -p tcp --dport 53 -j NEXTDNS_CATCHALL"
ExecStart=ip6tables -w 30 -t nat -A NEXTDNS_CATCHALL -p udp -m udp --dport 53 -j DNAT --to-destination ::1:5342
ExecStart=ip6tables -w 30 -t nat -A NEXTDNS_CATCHALL -p tcp -m tcp --dport 53 -j DNAT --to-destination ::1:5342

ExecStop=iptables -w 30 -t nat -D PREROUTING -m udp -p udp --dport 53 -j NEXTDNS_CATCHALL
ExecStop=iptables -w 30 -t nat -D PREROUTING -m tcp -p tcp --dport 53 -j NEXTDNS_CATCHALL
ExecStop=-iptables -w 30 -t nat -D PREROUTING ! -d 127.0.0.0/8 -m udp -p udp --dport 53 -j NEXTDNS_CATCHALL
ExecStop=-iptables -w 30 -t nat -D PREROUTING ! -d 127.0.0.0/8 -m tcp -p tcp --dport 53 -j NEXTDNS_CATCHALL
ExecStop=iptables -w 30 -t nat -F NEXTDNS_CATCHALL
ExecStop=iptables -w 30 -t nat -X NEXTDNS_CATCHALL
ExecStop=ip6tables -w 30 -t nat -D PREROUTING -m udp -p udp --dport 53 -j NEXTDNS_CATCHALL
ExecStop=ip6tables -w 30 -t nat -D PREROUTING -m tcp -p tcp --dport 53 -j NEXTDNS_CATCHALL
ExecStop=-ip6tables -w 30 -t nat -D PREROUTING ! -d ::1 -m udp -p udp --dport 53 -j NEXTDNS_CATCHALL
ExecStop=-ip6tables -w 30 -t nat -D PREROUTING ! -d ::1 -m tcp -p tcp --dport 53 -j NEXTDNS_CATCHALL
ExecStop=ip6tables -w 30 -t nat -F NEXTDNS_CATCHALL
ExecStop=ip6tables -w 30 -t nat -X NEXTDNS_CATCHALL

If that works out for you, with or without the multi-dest stuff, I'll add commented examples to the original gist above, just in case anyone else wants to allow certain non-localhost DNS servers, as I'm sure you're not the only one with this use case. Might be time to convert this into a real git repo lol...

Hey @vt0r,

Legend! Looks like that works!

I appreciate the help on this one :)

Made some changes to nextdns-catchall.service again, and they should be fully backwards compatible. Here's the list:

1. First, ensure it injects the symlinks (WantedBy) for nextdns.service. This ensures systemd will try to start this after nextdns starts
2. Next, replace rules that ignore DNS traffic destined for 127.0.0.1/8 (like dnsmasq) with less specific ones that just match UDP/TCP on port 53. This goes back to circumventing the built-in dnsmasq server, as the nextdns-injected config can potentially get ignored. This has the added benefit of also redirecting some queries sent by the UDM itself - though not all
3. Also, we added >/dev/null 2>&1 to silence error output from the first iptables -C commands that check for existence of a specific rule. It doesn't need to be printing a failure every time, as that's misleading. The command we run after the OR (||) does succeed and outputs nothing, so we stop that here.
4. Finally, clean up the old rules that ignore 127.0.0.1/8 in PREROUTING tables, since the rule format changed a bit in the latest edit. These ExecStop commands are prefixed with -, as they're expected to fail after the first time, and we don't want those expected failures to impact the stop of our service.

I'd recommend anyone using this to update. Before applying the updates, you can run systemctl stop nextdns-catchall.service if you want to manually clean up rules first. If you do not do this stop step first, then after updating /data/nextdns-catchall.service and running /data/on_boot.d/10-nextdns-catchall.sh, you may want to run a systemctl restart nextdns-catchall.service (once) just for good measure to make sure that extra cleanup happens, if necessary. This will only need to happen once on this change, due to the way the rules added to (and removed from on stop) the PREROUTING tables changed slightly.

Also, I'm going to move this whole thing into a real git repo and will share the link here when done. This ensures we can have real issue tracking, pull requests, etc.

EDIT - done. Added a README file to the top of the list that points to the new repository. You can find it here:

https://github.com/vt0r/nextdns-catchall