Force DNS and VPN Kill Switch

Technical Support for Routers
1

Regarding the “custom DNS” - if I am correct this disables peer DNS for both Wan and WWAN and also adds custom DNS in DHCP and DNS.
However, I do not understand what the “Force all clients to use” does. I presume it calls the script below (found in Firewall>Custom Rules (in Luci).
Can someone confirm this and explain in laymans terms what it does and why it is needed (as custom DNS settings look water-tight to me)?

force_dns() {
lanip=$(ifconfig br-lan |sed -n ‘s/.dr:(.) Bc.*/\1/p’)
iptables -t nat -A PREROUTING -s 0/0 -p udp --dport 53 -j DNAT --to $lanip
iptables -t nat -A PREROUTING -s 0/0 -p tcp --dport 53 -j DNAT --to $lanip
}
force=$(uci get glconfig.general.force_dns)
if [ -n “$force” ]; then
force_dns
fi

 

Regarding the Kill-Switch (Force VPN) - ie. No internet if VPN is not connected. This appears to delete the Lan > Wan forward and replace it with Lan > VPN Client and enable masquerding.

However, when I added the kill-switch in my old router, I ended up also changing the following:
Disabling maquerading on WAN/WWAN and changing the Input > accept
This seems to have the same effect, so I was wondering if both are as good as each other?

Other observations (what I did before):
Permenantly set Input on VPN > reject (just following a tutorial I read)
Permenantly enable MSS Clamping (MTU Fix) on VPN and Wan/WWan (is there any downside)?

Comments welcome!
Glitch

2

Will resume to work the day after tomorrow. Sorry for late reply.

Some of the clients use custom DNS server, which tries to bypass the DNS settings of the router. For example, google chrome cast always want to use google DNS.

The custom DNS settings only set the DNS server of the router. When the client doesn’t its own DNS server and need to resolve DNS from the router, the custom DNS settings will work. However, if the client has its own DNS settings, it will not resolve the DNS from the router.

The "force all DNS " to use tries to hijack the DNS revolving protocol so that even the client has set a DNS server, the router will still be able to override this.