4 ms·

Yes, I use ipset on openwrt to block all known public DoH IPs. That is still not enough. You need custom DNAT rules to forward all queries to port 53 to your lo

Yes, I use ipset on openwrt to block all known public DoH IPs. That is still not enough. You need custom DNAT rules to forward all queries to port 53 to your local resolver (at my home at least, Google and Garmin devices insist on using their own DNS servers)

lazerl0rd 5y ago
That doesn't work here. DNS over HTTPS (DoH) uses port 443, which you probably don't want to forward to your local resolver.
- fguerraz 5y ago
  Yes, I mean you block DoH using ipset AND you redirect attempt to use other non-DoH resolvers