LAN DNS traffic is no longer redirected to dnsmasq

[m-dilorenzi]

Steps to reproduce

• Enable Threat Shield DNS from the UI (Security > Threat Shield DNS) selecting the lan zone
• Check the resulting configuration: uci show adblock.global.adb_nftdevforce → 'lan'
• Resolve the actual device behind that zone: the zone lan maps to network green, which maps to device eth0
• Inspect the generated ruleset: nft list chain inet adblock pre-routing
• From a LAN client, send a DNS query to an external resolver, bypassing the firewall's DNS: dig @8.8.8.8 -x <client_ip> +short

Expected behavior

DNS traffic from the selected zones is redirected to the local dnsmasq instance on port 53, and DoT on port 853 is rejected, so that clients configured with a custom DNS server are still filtered by Threat Shield DNS.

Actual behavior

The enforcement rules are generated using the firewall zone name as iifname. Since iifname matches on the actual network device name, the rules never match any packet and the counters stay at zero:

root@NethSec:~# nft list chain inet adblock pre-routing
table inet adblock {
	chain pre-routing {
		type nat hook prerouting priority mangle; policy accept;
		iifname "lan" meta nfproto { ipv4, ipv6 } meta l4proto { tcp, udp } th dport 53 counter packets 0 bytes 0 redirect to :53
		iifname "lan" meta nfproto { ipv4, ipv6 } meta l4proto { tcp, udp } th dport 853 counter packets 0 bytes 0 goto _reject
	}
}

The value should be a network device (eth0 in this setup), not a zone name:

adblock.global.adb_nftdevforce='lan'    # actual
adblock.global.adb_nftdevforce='eth0'   # expected

Workaround

Add the enforcement rules manually, using the real device name instead of the zone name. Retrieve the device of each zone you want to enforce:

. /lib/functions/network.sh
network_get_device dev green && echo "$dev"

Then add the rules to the existing chain (replace eth0 with the device from the previous command):

nft add rule inet adblock pre-routing iifname "eth0" \
    meta nfproto { ipv4, ipv6 } meta l4proto { udp, tcp } th dport 53 counter redirect to :53
nft add rule inet adblock pre-routing iifname "eth0" \
    meta nfproto { ipv4, ipv6 } meta l4proto { udp, tcp } th dport 853 counter goto _reject

Verify with nft list chain inet adblock pre-routing that the counters start increasing.

Caveat: these rules live in memory only. They are lost on reboot and every time adblock is reloaded or restarted — including the scheduled cron reload — so they need to be re-applied, e.g. from a hotplug/startup script.