Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there anyway to force computers to use a specific DNS? Even if a computer has a defined a DNS address that I don't want, all of its DNS traffic from it will be resolved using the specific DNS. I guess I'm trying to say is there a way to emulate a proxy so to speak with out making one.

The whole reason why I'm doing this is that I use OpenDNS for web filtering but the only thing that you need to do to bypass that is just type in a different DNS server in Windows.

One idea could be to somehow use a Captive portal to stop web traffic until the user has the correct DNS server. I don't know how to use a captive portal to check a DNS setting though...

Any ideas would be great. Thanks.

share|improve this question
up vote 9 down vote accepted

If you want you computers on your LAN to only permitted to use a specific DNS server you need to block UDP port 53 outgoing on your firewall to all IP addresses along with adding rules to explicitly permit the IPs of the "allowed" DNS servers.

If your users want to get around that they'll just run a VPN tunnel to an off-site box and get DNS from there. You can try and block that, too, but they'll just fight you another way. (After all, you can tunnel IP over DNS if you really want to! Heh heh...)

Your efforts aren't pointless, but you will have to fight an arms race that, by definition, no one can possibly win, if you want to stop everybody. Blocking DNS queries to J. Random DNS server will stop the average person.

share|improve this answer
Alright thanks guys I will try this out. :) I guess I need to read up on the common ports and see what they do. – Austin Harsh Aug 8 '09 at 15:58

If it's an option for you, only a member of the administrator group can change a network adapter settings. Assign the DNS address by DHCP and make them a standard user and you should be ok.

share|improve this answer

The best user experience would be to hijack anysourceip:53 to go to your :53 with a firewall rule to forward requests.

If you block port 53, the end user with a custom dns will not be getting domain name resolution, and could cause a poor user experience. While if you redirect it, they will be getting online without calling in customer support, or the IT admin. It will reduce support time, and if that costs money, it will save money.

If you're using microtik in /ip firewall nat

add chain=dstnat action=dst-nat to-addresses= to-ports=53 protocol=tcp dst-port=53 
add chain=dstnat action=dst-nat to-addresses= to-ports=53 protocol=udp dst-port=53 


share|improve this answer
I know tech savvy can bypass this, but the likely hood of a tech savvy user calling in to tech support are extremely low, as they would have figured this out and changed ports, or noticed a captive portal in place. This just gets people online, and using your openDNS or other preferred DNS. – Clown Man Aug 8 '15 at 0:39

If you are looking to prevent users on your network from some other dns server you will need to block access at the firewall. If you do that you will need to provide a dns server that you allow to have outside access. Any dns server can be used to proxy dns requests.

Some like dnsmasq are designed for the task. M0n0wall uses it for exactly that reason.

It wont stop everyone but it will allow you better control.

share|improve this answer

You need to block DNS (port 53) from all servers except the one you intend to use.

Easiest solution I can think of would be to install something like IPCop, SmoothWall, Monowall, pfSense (all FREE) on a spare PC (very low system requirements) and run an actual PROXY.

That's essentially what you're wanting to do... emulate a proxy without making one. ;-)

Installing something like IPCop is pretty painless, has Squid proxy built in, you can add URLFilter for free, then run the whole thing as a transparent proxy. Problem solved.

But all that aside... what you're looking to do is block port 53 to all IPs except for the OpenDNS servers.

As Evan mentioned, its not going to make it IMPOSSIBLE... but its going to keep the majority out. ;-)

Hope this helps.

share|improve this answer
I will try out those apps. Thanks. – Austin Harsh Aug 8 '09 at 16:38

Within your LAN you could put up a DHCP serving the DNS you want. All DHCP enabled clients would go with yours. If there is already a DHCP server out there, just make sure you answer quicker, or do some ARP poisoning/spoofing.

share|improve this answer

I think this is what I'm going to do, I already have tomato firmware on my linksys router so I'm going to set the DDNS to opendns and then check the box that says intercept DNS port udp 53. I think that should work.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.