# DNS Hijacking on Wi-Fi **URL:** \ **Category:** VPN, DNS, Leaks\ **Created:** [May 15, 2024, 8:55pm UTC](https://forum.gl-inet.com/t/dns-hijacking-on-wi-fi/42335 "2024-05-15T20:55:31Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![DylanE](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/dylane/32/17311_2.png) [@DylanE](https://forum.gl-inet.com/u/DylanE)\ **Post date:** [May 15, 2024, 8:55pm UTC](https://forum.gl-inet.com/t/dns-hijacking-on-wi-fi/42335/1 "2024-05-15T20:55:31Z")
I am using a Flint 2 on the last release 4.5.8. I am running AdGuard on my router and I want to force every device through it. Some of my devices use custom DNS, I followed this guide: [https://openwrt.org/docs/guide-user/firewall/fw3\_configurations/intercept\_dns](https://openwrt.org/docs/guide-user/firewall/fw3_configurations/intercept_dns) But it doesn’t do anything more than the “Override DNS settings for all clients” setting in the GL-iNet UI, as far as I know. This works great for devices connected through cable, but I also would like to be able to override my DNS settings for devices on the Wi-Fi, like my phone. I have a hard time finding anything about DNS Hijacking on Wi-Fi. Are there any guides for this? Has anyone done it successfully? Thanks Dylan ---
**Author:** ![Renato](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/r/858c86/32.png) [@Renato](https://forum.gl-inet.com/u/Renato)\ **Post date:** [May 15, 2024, 9:50pm UTC](https://forum.gl-inet.com/t/dns-hijacking-on-wi-fi/42335/2 "2024-05-15T21:50:53Z")
> [@DylanE](#): > > but I also would like to be able to override my DNS settings for devices on the Wi-Fi, like my phone. On your phone (Android): Settings → Network and Internet → Private DNS → OFF Now your phone will get the DNS from your router. ---
**Author:** ![DylanE](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/dylane/32/17311_2.png) [@DylanE](https://forum.gl-inet.com/u/DylanE)\ **Post date:** [May 15, 2024, 9:54pm UTC](https://forum.gl-inet.com/t/dns-hijacking-on-wi-fi/42335/3 "2024-05-15T21:54:12Z")
I am trying to hijack the DNS from router side for Wi-Fi devices. I am not trying to change the DNS settings on my Wi-Fi devices. ---
**Author:** ![admon](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/admon/32/32880_2.png) [@admon](https://forum.gl-inet.com/u/admon)\ **Post date:** [May 16, 2024, 4:21am UTC](https://forum.gl-inet.com/t/dns-hijacking-on-wi-fi/42335/4 "2024-05-16T04:21:17Z")
Hijacking isn’t possible if the device does not use plain DNS. So the advice of @Renato is indeed correct. ---
**Author:** ![DylanE](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/dylane/32/17311_2.png) [@DylanE](https://forum.gl-inet.com/u/DylanE)\ **Post date:** [May 16, 2024, 7:11am UTC](https://forum.gl-inet.com/t/dns-hijacking-on-wi-fi/42335/5 "2024-05-16T07:11:57Z")
Hi Admon, The phone is just an example of one of the devices. So for my own understanding, if I understand your message correctly. The DNS over TLS firewall configuration: "Configure firewall to filter DoT traffic forcing LAN clients to switch to plain DNS." [https://openwrt.org/docs/guide-user/firewall/fw3\_configurations/intercept\_dns](https://openwrt.org/docs/guide-user/firewall/fw3_configurations/intercept_dns) Is impossible to pull off for Wi-Fi? I haven't tried installing banIP through LuCi, the OpenWrt documentation says: DNS over HTTPS Utilize banIP to filter DoH traffic forcing LAN clients to switch to plain DNS. Is that still worth the try, or is that also impossible to force devices with to use my DNS? Thank you Dylan ---
**Author:** ![admon](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/admon/32/32880_2.png) [@admon](https://forum.gl-inet.com/u/admon)\ **Post date:** [May 16, 2024, 7:15am UTC](https://forum.gl-inet.com/t/dns-hijacking-on-wi-fi/42335/6 "2024-05-16T07:15:00Z")
In my opinion, it's a waste of time because there is DoH for example. Trying to ban all IPs of all DNS servers ... isn't a real way either. > [@Separate subnet for DNS (pros and cons discussion)](https://forum.gl-inet.com/t/separate-subnet-for-dns-pros-and-cons-discussion/42125/11): > > As written above, you simply can’t. Since DoH will use HTTPs you can’t block it. You can try to block as much as possible but there is always a way around it. As soon as an device uses DoH it will be able to get around your AdGuard DNS. I would just accept that and live with it. A game of cat and mouse doesn't make much sense. ---
**Author:** ![DylanE](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/dylane/32/17311_2.png) [@DylanE](https://forum.gl-inet.com/u/DylanE)\ **Post date:** [May 16, 2024, 7:22am UTC](https://forum.gl-inet.com/t/dns-hijacking-on-wi-fi/42335/7 "2024-05-16T07:22:29Z")
That is unfortunate. But thanks a lot for your quick response. ---
**Author:** ![hecatae](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/hecatae/32/20467_2.png) [@hecatae](https://forum.gl-inet.com/u/hecatae)\ **Post date:** [May 16, 2024, 10:30am UTC](https://forum.gl-inet.com/t/dns-hijacking-on-wi-fi/42335/8 "2024-05-16T10:30:38Z")
There's a detailed thread on using IP sets over on the Openwrt forum: > **[Blocking Lan clients from using DoH](https://forum.openwrt.org/t/blocking-lan-clients-from-using-doh/152573)** > > following up on earlier threads, I finally got round to using the recipe at https://openwrt.org/docs/guide-user/firewall/fw3\_configurations/intercept\_dns to block potentially hostile LAn clients from using DoH. I have a couple of errors, can... It builds from the Wiki page and is successful in blocking DoH ---
**Author:** ![admon](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/admon/32/32880_2.png) [@admon](https://forum.gl-inet.com/u/admon)\ **Post date:** [May 16, 2024, 10:52am UTC](https://forum.gl-inet.com/t/dns-hijacking-on-wi-fi/42335/9 "2024-05-16T10:52:51Z")
Please keep in mind that blocking based on IPs have disadvantages and isn't really reliable. ---
**Author:** ![hecatae](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/hecatae/32/20467_2.png) [@hecatae](https://forum.gl-inet.com/u/hecatae)\ **Post date:** [May 16, 2024, 11:07am UTC](https://forum.gl-inet.com/t/dns-hijacking-on-wi-fi/42335/10 "2024-05-16T11:07:05Z")
Oh agreed, especially when there's things like iCloud Private Relay that people like to enable and then complain that stuff does not work. ---
**Author:** ![DylanE](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/dylane/32/17311_2.png) [@DylanE](https://forum.gl-inet.com/u/DylanE)\ **Post date:** [May 16, 2024, 11:41am UTC](https://forum.gl-inet.com/t/dns-hijacking-on-wi-fi/42335/11 "2024-05-16T11:41:27Z")
Thank you, @hecatae and @admon for your help! It indeed looks like that if you block the DoH providers, the devices won't automatically switch to the routers DNS. It is unfortunate, but also better for security reasons. ---
**Author:** ![hecatae](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/hecatae/32/20467_2.png) [@hecatae](https://forum.gl-inet.com/u/hecatae)\ **Post date:** [May 16, 2024, 12:34pm UTC](https://forum.gl-inet.com/t/dns-hijacking-on-wi-fi/42335/12 "2024-05-16T12:34:31Z")
Yes, that's why I gave up with doing so as I have family members who enable iCloud Private Relay and I'm tired of the tech queries. ---
**Author:** ![slesar](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/slesar/32/13581_2.png) [@slesar](https://forum.gl-inet.com/u/slesar)\ **Post date:** [May 16, 2024, 3:28pm UTC](https://forum.gl-inet.com/t/dns-hijacking-on-wi-fi/42335/13 "2024-05-16T15:28:44Z")
I used Tasker app on my android. When I am at home and does match name ssid then auto turn off private dns setting on my phone. Reason I made hostname for local domains which I need to access LAN devices. When does not match any WiFi ssid then turn on private dns setting on my phone. ---
**Author:** ![maholio](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/m/9f8e36/32.png) [@maholio](https://forum.gl-inet.com/u/maholio)\ **Post date:** [May 17, 2024, 5:45pm UTC](https://forum.gl-inet.com/t/dns-hijacking-on-wi-fi/42335/14 "2024-05-17T17:45:34Z")
> [@DylanE](#): > > Is that still worth the try, or is that also impossible to force devices with to use my DNS? Is I wrote here, it is just not good idea. > [@Separate subnet for DNS (pros and cons discussion)](https://forum.gl-inet.com/t/separate-subnet-for-dns-pros-and-cons-discussion/42125/17): > > Purely theoretical you can use [this](https://github.com/hagezi/dns-blocklists/blob/main/dnsmasq/doh.txt) or [this](https://github.com/hagezi/dns-blocklists/blob/main/ips/doh.txt) list BUT! I don’t think it will block ALL DOH. Blocking DOH can cause connection issues. It is reducing security. ---
**Author:** ![bruce](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/bruce/32/35649_2.png) [@bruce](https://forum.gl-inet.com/u/bruce)\ **Post date:** [October 29, 2025, 11:38am UTC](https://forum.gl-inet.com/t/dns-hijacking-on-wi-fi/42335/15 "2025-10-29T11:38:58Z")