Kids try to change the dns of the computer

[alblinux (dini vaj)]

Hello do have a solution?
Because i have the similar problem, i have a pihole server and i want to that all the dns traffic should go through pihole.
Thats because some kids try to change the dns of the computer or smarphone so they can access not allowed websites.

Thx

[jon]

Hello @alblinux - Welcome to the IPFire Community!

this should help point the kids in the right direction:

Force clients to use IPFire DNS Server - The IPFire Wiki

[alblinux (dini vaj)]

Hello,

i have tried this before the post, but with this solution i cant use the pihole dns service.
It just use the dns from ipfire.

I try to explain:
Ipfire is 192.168.0.1
pihole (debian 11) is 192.168.0.5.

When i activate the firewall rule it accept just as dns server 192.168.0.1 all others are blocked.

Maybe i misunderstand something.

Sorry for my bad english

[jon]

Did you find this post?

Redirect all traffic from Green to PiHole

Hello Sujan - Welcome to the IPFire Community! When reading through the Community posts you will see that PiHole is not recommended due to security issues. Since the pi-hole filters DNS records, DNSSEC is not possible from the client to the external DNS server (hope I explained this correctly). See: Having said that… What you have proposed above is what I have setup for my GREEN network. Client (DNS) → PiHole (DNS) → IPFire (DNS) → to external DNS Server This works fine but as I said it …

Keeping in mind pihole is not recommended, you may want to try this:

-and this-

Does this help?

[alblinux (dini vaj)]

No. it doesnt

[hvacguy (Shaun HVAC)]

How about a firewall rule.
allow 192.168.0.5 service group DNS
drop green service group DNS

Your next problem is blocking DoH.
That may be possible by using Proxy. or Ip Block list.
would try block list first

[alblinux (dini vaj)]

Will try this soon.

With this i success but will try

iptables -I CUSTOMPREROUTING -t nat -p udp --dport 53 -m iprange --src-range 192.168.0.9-192.168.0.30 -j DNAT --to-destination 192.168.0.5

[hvacguy (Shaun HVAC)]

If they are using DoH
You will need something else for that.

[alain (Alain Stucki)]

If they are changing their DNS configuration I guess they are not babies anymore. From my experience, it’s hopeless to try fixing a social problem with a technological solution. The kids will win this race. They will find ways to avoid whatever obstacle you install. They will simply hack their way around it.

Talking to the kids, explaining them why you filter some traffic, establish trust between you and the kids so if they want to visit parts of the internet that you block they will talk to you and you can have a very fruitful discussion which will build up trust even more. Visit those bad corners of the web together, discuss what you see and why that can be dangerous. You will become their hero! That was how I “fixed the problem” and I’m very proud to see how my kid learned to handle the internet and keep away from the dark side.