DNS NAT Rule slowing down browsing and load-times from websites

A couple of suggestions.

1/. create a firewall at the top of your firewall list that blocks dns over https rather than use the web proxy.

2/. change the default DNS setting to point at your pi-hole.

3/. create a firewall rule that allows DNS traffic between your various LAN/s and the pi-hole

The following screenshot is the NAT rule for my NTP server.

Ian

thanks for your suggestions and effort.

1. good idea, will try this...but solves not the problem for nat.

2. you mean the nat rule to point on pihole? i was thinking about that, but it would be a problem, when pihole would be down suddenly. So the thought was for LAN1 to point on the interface which normally should be default. But here I think that creates some kind of looping.

3. will not be needed, because the nat rules etc works perfectly for all others - only LAN1 is affected and the pihole is in the same subnet.

for ntp I have also a rule like that. only difference there despite of the service and networks is the MASQ, which has no effect and need there. tried that also. or what was your thought for that screenshot?

Thank you again, Ian.

The mASQ is required because the devices do no/ always send NTP (123) or DNS (53) and causes delays while the device shifts DNS destinations which will accept its DNS request if that makes sense?

Ian

Thx for explanation.

Tried that also, but it doesnt make any difference if MASQ or not... browsing keeps slow.

Same NAT rules on other LAN2 and WLANs working as expected and browsing is fast.

Hi,

have you reviewed logviewer when the issue is happening refined to either service 53 or your test pc IP address?

Ian

You build a loop isnt it? So PI will also be fetched by this rule? 

Pi only has configured external dns servers.

workflow should be: internal device requests dns (whether internal or external host / url) and ends on sophos interface; sophos serves all internal hostnames, external requests will be handled by pihole.

but yes: because pihole is in LAN1, the nat rule will cause that dns requests from pi will start looping. ***... i am such a stupid.

so solution would be, to exclude pihole from that nat rule or to place it in the subnet from the router in front of sophos.

short question: nat rules are handled like firewall rules? first hit and done? so beginning at the top id1, id2, etc.

seems to work.

nd said:

nat rules are handled like firewall rules? first hit and done?

Yes, It's the same way as Firewall rules. (First Hit)

thx :)

thx :)