Transparent Netflix only region unblock with Asuswrt Merlin

Ad-free time!, UnoTelly etc. services provide a nice way to unblock regions for Netflix and others using their custom DNS servers.

But I don't want to direct all my DNS traffic to them and I'm too lazy to manually configure all my devices (phones, tablets, media center boxes etc.). So here's how to transparently unblock Netflix for all your devices using the Asuswrt Merlin firmware. It's a custom router firmware which can be used on the Asus RT-N66U router for example.

Prerequisites

Enable JFFS partition and SSH login from http://<ROUTER-IP>/Advanced_System_Content.asp

Configure dnsmasq

Login to the router using SSH and type

echo "server=/netflix.com/<UNBLOCK-DNS-SERVER-IP>" > /jffs/configs/dnsmasq.conf.add

Replace <UNBLOCK-DNS-SERVER-IP>with the correct ip address.

This way only the dns queries for netflix.com will go to the unblocking dns provider.

Reboot the router or just dnsmasq.

Chromecast

Chromecast has hard coded DNS servers to 8.8.8.8 and 8.8.4.4. Luckily we can use simple iptables rules to redirect Chromecast DNS queries back to our router.

Since iptables rules are not persistent we must add them to the nat-start hook

cat > /jffs/scripts/nat-start <<EOF
iptables -t nat -A PREROUTING -s <CHROMECAST-IP>/32 -d 8.8.4.4 -p udp --dport 53 -j DNAT --to <ROUTER-IP>
iptables -t nat -A PREROUTING -s <CHROMECAST-IP>/32 -d 8.8.8.8 -p udp --dport 53 -j DNAT --to <ROUTER-IP>
EOF

Make the hook executable

chmod +x /jffs/scripts/nat-start

Reboot the router or execute the hook manually.

Links

Tomato && DD-WRT documentation on Ad-free Time! https://adfreetime.com/get-started/chromecast/

dnsmasq on Ubuntu http://askubuntu.com/questions/419099/how-to-use-custom-dns-server-for-selected-domains-only/419100#419100