4 ms·

Time to ban/firewall DoH then.

• JohnFen 5y ago
  Good luck with that. I strongly object to DoH, but it exists and we have to deal with it. The only approach that I could come up with to do so was to install a proxy to MITM all HTTPS connections to allow me to filter out DoH requests.
• 3np 5y ago
  As it intentionally looks like HTTPS traffic, that's a different game; you kind of have to whitelist rather than blacklist. Here's an idea that supposes you have some server available: Force all traffic over your network, even when roaming (VPN). Squid+Privoxy as HTTP proxy (your choice if you want to DPI and add own TLS CA as root on devices, in which case you can actually block it, or just do HTTP CONNECT). Optionally also set up a SOCKS5-proxy (microsocks). Configure all applications to go over proxy. Applications that don't support it can usually be "proxified" with tsocks or proxychains4. Now you have more fine-grained control over your traffic. You can do fun stuff like setting up several incoming ports, several outgoing proxies (including Tor/I2P) and allow/block based on destination, domain, protocol, etc. Finally disable outgoing traffic on your devices/route to a black hole. Or route it via your VPN at least, where you can do some rudimentary stuff with nftables/iptables. Oh, and something not everyone knows: you can route traffic based on uid/gid on Linux, so on your workstation you can leverage that too selectively control traffic on an application-basis. On non-rooted Android and iOS, I suspect this is not perfectly achievable but if you have the time you can get pretty far otherwise. It's an arms race and I feel like we can keep up.