0

Assign profile to specific subnet only via command line.

I am using the nextdns github command line setup via a unifi udmpro.  I have 4 subnets.  I am trying to leave my management subnet (192.168.1.0/24) alone (no profile) so i choose to run a CLI config command to assign to the other 3 as follows (12345 is not my profile of course):  

sudo nextdns config set \
-profile 10.10.10.0/24=12345 \
-profile 10.10.20.0/24=12345 \
-profile 10.10.30.0/24=12345
sudo nextdns restart

I have a VPN client (proton VPN) setup in the UDMPRO for a specific host on the management
lan (192.168.1.0/24) that wasnt assigned a profile. It does connect to the VPN but it
connects to the nextdns profile for DNS despite not being on any of the assigned subnets.
It has no other setting to force it (DNS set to auto in network settings,browser set
to auto for DNS).  Is there a different way to assign a profile to not use a profile?

3 replies

null
    • R_P_M
    • 4 days ago
    • Reported - view

    Not possible via the CLI to assign no profile, it's either one of your subnet profiles or (in this case) the default profile. It cannot apply no profile to a device using the CLI (in it's current form).

    You'd have to bypass the CLI with that specific host and set some other DNS IP(s).

    • concept3736
    • 21 hrs ago
    • Reported - view

    Thank you for the info.  One more bit of information is the UDMPRO client VPN setup is using a Wireguard configuration file with an address outside of the listed LAN subnets and a corresponding dns (10.2.0.2/32 with DNS 10.2.0.1).  That doesn’t bypass the profiles in this case? 

      • R_P_M
      • 20 hrs ago
      • Reported - view

       I'm not entirely sure how the UDMPro handles VPNs. I would think that any DNS lookup request sent to the router will be handled by the NextDNS CLI. So I would guess that this host getting the VPN is not completely isolated from your network (by completely tunnelling all traffic to the VPN).

      If the VPN was directly setup on the host itself, I believe in that case it definitely will bypass the CLI.

Login to reply

Content aside

  • 20 hrs agoLast active
  • 3Replies
  • 26Views
  • 2 Following