4 ms·
That's why you block port 53 in both UDP and TCP so nothing can bypass it. I also block most known DoH servers outright.
by netr0ute 5y ago
That's why you block port 53 in both UDP and TCP so nothing can bypass it. I also block most known DoH servers outright.
- silon42 5y agoAlso need to block all hosts not allowed by your own DNS server. Also need to give each "untrusted" app a separate local IP (in future: must have NAT for IPv6 too).
- silon42 5y agoOr just force the use of HTTP/S proxy.
- tremon 5y agoI also block most known DoH servers outright. When someone hosts a DoH server on a cdn/AWS/Azure/Google shared IP address, you can't block it by IP; and if the client uses ESNI, you can't block it by HTTP header inspection either.
- netr0ute 5y agoHow will the client know what address to send DoH to? You wouldn't just hardcode an IP unless you want that predictable address manually blocked in the firewall.
- Havoc 5y ago>That's why you block port 53 in both UDP and TCP so nothing can bypass it. Already done...something is still sneaking through...or cloudflares test is unreliable (or my iptables rules are wrong lol)