6 ms·

At home I've got a pihole handling my DNS, including using DoH to Cloudflare. I assume that this configuration is superior to whatever FF is doing natively, an

• apocalyptic0n3 6y ago
  If you do not disable Firefox's DoH support, it will by pass your Pi-Hole entirely. So you'd lose all the benefits of that and be limited to just the protections Firefox provides (which are great, to be clear. Just not as good as a well-sourced Pi0Hole)
  • deeter72 6y ago
    This is why I absolutely despise DoH. SysAdmins have no direct control over it. In my organization we have blocked direct IP access from userspace VLAN's to all known public DNS servers thus forcing all clients to rely on the company DNS servers, which is not the most ideal way to do things.
    • yjftsjthsd-h 6y ago
      Don't you just set a canary domain - https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli... - and then it's disabled for your network?
      • deeter72 6y ago
        Again not the most ideal way to do things and Mozilla is doing a different approach to Chrome and Edge. and also a concern is that malware can use DoH to retrieve data without logging suspicious DNS queries on Firewall DNS logs which are monitored to highlight of new domains that have not been pre-approved. DNS should be something that is handled by the OS. I favor DoT which is secure and practical over DoH.
        • deleted 6y ago
          [deleted]
        • jefftk 6y ago
          > malware can use DoH to retrieve data without logging suspicious DNS queries on Firewall DNS logs Malware can already query IPs of its choice to learn about other IPs it should contact. DoH doesn't let it do anything new.
          • jlgaddis 6y ago
            In a corporate network, it's pretty common to block all outgoing DNS traffic (53/TCP and 53/UDP), except from the company's DNS servers. In that case, DoH does let malware do something new -- block the company's existing DNS policies, quert logging, and security monitoring!
            • jefftk 6y ago
              DoH is a protocol for using HTTPS to learn what IPs to talk to. Malware does not need DoH to do this. They can simply run an ordinary HTTPS server with a self-signed cert on an arbitrary IP, with a simple JSON-based or whatever protocol, and have support for that in their client.
              • jlgaddis 6y ago
                > Malware does not need DoH to do this. Yes, you're right, of course. There are any number of things that malware can do. Most of it doesn't, however, and can either be stopped completely or, at the least, detected quite easily using some basic techniques.
            • topranks 6y ago
              Not really. Malware could always use some proprietary wrapping in TLS to hide name resolution. Domain fronting through Azure is still a thing for instance.
        • jlgaddis 6y ago
    • speedgoose 6y ago
      Why do you want them to rely on the company DNS servers?
      • deeter72 6y ago
        Active Directory, Internal Domains, monitoring, blocking, etc.
      • jlgaddis 6y ago
        1. Internal names won't resolve if a client is using, for example, 1.1 as their DNS server (breaking, among other things, logging on to an Active Directory domain!) 2. Many companies have established DNS logging and monitoring in place for security.
      • topranks 6y ago
        Policy. Not sending my private browsing data/DNS history to a third party (Cloudflare, Google etc.)
• DyslexicAtheist 6y ago
  > and I should disable FF's DoH support? yeah there is no reason (I can think of) why you need FF DoH with your setup. In fact if you were to enable DoH in FF it would bypass your pie-hole - so you most certainly want to avoid that. my setup looks pretty much like yours with some additional /etc/hosts blocking[1] on the client just to avoid the round-trip to the pie-hole. it's also a double insulation (but it's more of a performance reason than bc of paranoia). I found that switching off ipv6 dns resolution in FF (`network.dns.disableIPv6` in about:config) has tremendously sped up my DNS lookups in FF (though I haven't had time to analyze why). in case you're worried about homograph phishing attacks you could also add a regex to your pie-hole's dnsmasq (not sure what piehole uses but I know it has a fork of dnsmask that supports regex) so that punicode domains (any domains matching "xn--") are sinkholed to 0.0.0.0 as well. [1] https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts
• SAI_Peregrinus 6y ago
  No need to disable Firefox's DoH support, just point it at your pihole as the DoH provider.
  • pbhjpbhj 6y ago
    How do you do that without accessing each client, like how do I disable DoH on my home network for all devices without having to access all devices?
    • SAI_Peregrinus 6y ago
      Well, there's the use-application-dns.net canary domain (if it resolves to a response code other than NOERROR or to NOERROR but lacks both A and AAAA records), Firefox will fall back to using the OS DNS. Otherwise it's up to the application, just like with DNS it's always been the application's choice whether to use the OS-provided DNS or to use their own (eg via proxy or VPN). In short, you can't. But you never could stop an application from tunneling DNS over some other channel before, so that's nothing new.
• topranks 6y ago
  It’s basically the same minus the filtering. Cloudflare are getting all your browsing info from DNS. Your ISP from SNI.
• a1369209993 6y ago
  Strictly speaking you should run DoH to your pihole, to prevent local-network attacks, but that's a fairly minor issue and supposedly (epistemic status: outright hearsay) DoH is intentionally difficult to configure correctly (ie to a non-mozilla-approved server).