4 ms·

Is AdGuard Home a solution for this, will a Roku still work with DNS ad blocking?

• Havoc 2y ago
  Some TV boxes now have hardcoded dns to prevent this
  • gnabgib 2y ago
    Over :53 can be blocked/re-routed to your recursive DNS server by your router.. although that's more than many user's ability, sure. Seems unlikely it's DoH[0] (:443) since that would be.. hard coding an IP or a DNS lookup loop (turtles.. all the way down). But it's possible in combination with :53 above (you'd need to recursive-block the common DoH domains https://cloudflare-dns.com/dns-query https://cloudflare-dns.com/dns-query https://mozilla.cloudflare-dns.com https://mozilla.cloudflare-dns.com https://dns.google/dns-query https://dns.google/dns-query but possibly also some device-specific IPs.. dns.roku.com?) DoT[1] (:853) could also be used (1.1.1.1, 8.8.8.8, 9.9.9.9)... guess it's worth watching traffic/blocking that port (if that's your concern). [0]: https://en.wikipedia.org/wiki/DNS_over_HTTPS https://en.wikipedia.org/wiki/DNS_over_HTTPS [1]: https://en.wikipedia.org/wiki/DNS_over_TLS https://en.wikipedia.org/wiki/DNS_over_TLS
    • mox1 2y ago
      I utilize pfSense to hijack all outgoing port 53 connections and just re-route them to the local DNS server. From there, I allow AdGuard DNS out over port 953. I then use pfBlockerNG with a few block-lists to block DoH and known DNS over 443 servers. Overall works fairly well, I've had an issue or two when a device cant talk to 1.1.1.1 directly....
  • Saris 2y ago
    That can be blocked on your outgoing firewall, or if it's standard DNS on 53 use a NAT rule to force it to your DNS server.
• girishso 2y ago
  Does DNS blocking work with Apps (e.g. YouTube android) using Certificate pinning?
  • BenjiWiebe 2y ago
    Certificate pinning prevents MITM. It doesn't prevent blocking. What could prevent blocking is if the device uses DoH for DNS.