Opex Network Gateway
A DNS and access-control gateway for ISP networks
A DNS engine with DoH and DoT, policy-based filtering and direct MikroTik integration, managed from an Arabic dashboard. Under development.
This system is under development and has not been released. The page describes what has actually been built so far.
Opex Network Gateway is a platform under development for managing DNS on ISP networks: a private DNS engine running on your own server, encrypted DNS protocols (DoH and DoT), per-client and per-group filtering policies, and MikroTik script generation with direct synchronisation to the router. This page describes what has actually been built so far; the product has not been released yet.
Who is this system for?
- Internet service providers and network operators that use MikroTik
- Network administrators who need DNS and access control per client or group
The problem it solves
Controlling DNS and access normally takes separate tools
Different policies for different clients
The need to apply a specific policy to a client, a group or a schedule without configuring each device by hand.
Filtering bypass
Well-known DoH and DoT providers and CNAME chains can sidestep blocking unless this is handled explicitly.
Manual router configuration
Copying address lists and blocking rules to each router by hand is slow and error-prone.
How it works
How a query is handled
Identify the client
By address, network or the DoH/DoT identifier.
Pick the policy
The client policy, then its group’s, then the default.
Filter
Allow, then Safe Search, then blocking and lists — ahead of the cache.
Cache and upstream
An answer from cache or from the upstream server, with failover.
Check the answer
CNAME chains and resulting addresses are checked against the rules.
Client
- DoH / DoT / UDP / TCP
Edge
- CaddyTLS and HTTP/2
Engine
- DNS engineGo — never reads PostgreSQL while answering
Configuration and state
- RedisPublishes configuration and lists
- PostgreSQLSettings
- ClickHouseLogs and statistics
Features
DNS engine and protocols
A DNS engine over UDP and TCP
Supports IPv4 and IPv6 with a cache, multiple upstreams and local records, managed from the dashboard.
DoH and DoT
DNS over HTTPS and over TLS, reading the reverse proxy’s certificates and picking up renewals without a restart.
Client identification
By an identifier in the DoH path or the DoT name, or by network (CIDR), with ready-made setup profiles for Apple, Android, Windows and browsers.
Filtering and policies
Policies per client or group
Categories, filter lists, weekly schedules and allow and block rules, with Safe Search for common search engines.
Anti-bypass
Blocks well-known DoH and DoT providers and inspects CNAME chains and resulting addresses in answers.
Applications and address discovery
Block an application by name through its domains, discover its addresses actively and passively, block a single address, with a built-in application library.
A “why was it blocked?” tool
Checks a domain and states why it was blocked.
MikroTik integration
RouterOS script generator
Application address lists, static DNS, using the gateway as the router’s DNS, forcing all DNS to the gateway, and a self-updating script. Each script removes what an earlier run added so it can be run again.
Direct sync over the REST API
Sends only the differences and touches only entries carrying the gateway’s comment, with a dry run that shows the plan without changing anything. The router password is stored encrypted and never returned.
Platform and security
Roles, permissions and two-step login
Default and custom roles, TOTP, API keys, manageable sessions and an append-only audit log.
Arabic RTL dashboard with English
Light and dark themes and a strict content-security policy.
Deployment with Docker Compose
Separate services with health checks, automatic restarts and persistent volumes; only the reverse proxy and DNS ports are exposed publicly.
In progress now
Parts of this have been written but are not finished yet.
Query log and DNS dashboard
A query log with privacy options, statistics and a live view.
Telegram and email notifications
Alerts for router and upstream outages and for certificates nearing expiry.
Benefits for you
A policy per client
Instead of configuring each device individually.
Automated MikroTik setup
Differences-only sync and a dry run before applying.
Privacy and security by design
Encrypted secrets, audit without secrets, and a query log with privacy modes.
Usage scenarios
Blocking an application for a group of subscribers
Pick the application from the library and add it to the group’s policy; its domains are blocked on the engine, and you can generate its address list and push it to a MikroTik router.
Forcing the network to use the gateway
Generate the “force DNS” script: the router redirects all DNS queries to the gateway and blocks DoT and well-known DoH providers, with the gateway itself exempt.
Technology, requirements and integrations
Technology
- GoDNS engine and API
- React + TypeScriptDashboard
- PostgreSQLSettings and users
- ClickHouseLogs and statistics
- RedisState and change distribution
- CaddyReverse proxy and TLS
- Docker ComposeDeployment
Requirements
- The first release has not shipped yet; final operating requirements will be announced at release.
- A Linux server running Docker, with port 53 bound for the engine.
- A MikroTik router with the REST API (RouterOS 7) for direct sync, or manual script import.
Integrations
- MikroTik: script generator and direct sync over the REST API
- DoH and DoT using Caddy certificates
- Telegram and email for alerts (in progress)
Frequently asked questions
Is the product available now?
No. Opex Network Gateway is under development and has not been released. You can write to us to learn its status or to discuss your needs.
What has been built so far?
A DNS engine with DoH and DoT, client identification, policy and schedule-based filtering, application management and address discovery, MikroTik integration, and a dashboard with roles and two-step login. These parts were tested locally.
Are there performance figures?
We do not publish performance figures that have not been measured on the target hardware. Measurements will be published when available.
Request a demo or information
Tell us what you need and we will get back to you.