3 ms·

> Devices trying to use DoT or DoH??? Blocked, PiHoles take over. How? I can see you only allowing some ports through the firewall, but presumably TCP 443 is o

> Devices trying to use DoT or DoH??? Blocked, PiHoles take over. How? I can see you only allowing some ports through the firewall, but presumably TCP 443 is one of those. According to Cloudflare [0] DoH uses that. What if Samsung uses that, or figures DoT on port 443 works better? Do you only allow specific destinations for these devices? I actually use a similar setup, only I removed pihole and just use some lists in my opnsense's unbound (didn't notice much difference). My "smart" TV is pretty awful, so it's just unplugged (which makes it dumb, so now I love it). I've tried putting it on a dedicated VLAN with no internet access so I could try using the built-in Chromecast functionality – didn't have much luck. I've set up the mDNS repeater and allowed ports through, but that doesn't seem enough. [0] https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-https/ https://developers.cloudflare.com/1.1.1.1/encryption/dns-ove...

h4kunamata 1y ago
I followed this blog to get the firewall dynamic firewall in place: https://labzilla.io/blog/force-dns-pihole https://labzilla.io/blog/force-dns-pihole Like you said, you cannot just block 443, the dynamic firewall uses a public list, which contains all the public DNS known to man ( the last bit was just to sound a little dramatic haha ) So OPNSense will block anything within that list in both 443 and 853. So my Samsung QLED TV can no longer use Google:443 for DNS resolution. OPNSense blocks it and redirect it to PiHole, a NAT is also required to avoid devices getting mad. I didn't pay a kidney for that smartTV back in 2019 to make it dumb, when it is on, PiHole logs goes brrrrrrrr It is also one of the reason why my whole network was going down, it was making too much request exhausting PiHole 150 concurrent DNS requests, there is a flag to increase that and no more issues. Google:443: DNS request only, not actual 443 request gets blocked Cloudflare:443: DNS request only, no actual 443 request gets blocked etc etc Read that blog I shared to understand it. If I run a dig google.com @8.8.8.8, PiHole terminal shows the request If I run 8.8.8.8:443 on the browser, OPNSense firewall log shows access denied, the same msg when my TV turns on or my Home Assistant goes on. DoT on 853 is simple to block on its own, no much secret there.
- silon42 1y ago
  Good stuff. As an alternative, has someone tried running http/s proxy on the firewall and blocking the rest of client HTTPS (except maybe for whitelist devices)?
  - illiac786 1y ago
    Not all devices support proxies and it means you are blocking all UDP traffic (RTP, QUIC…) traffic, this will definitely not make your internet experience better…
- illiac786 1y ago
  I have similar setup with adguard and opnsense, and here is another list for public known DoH servers (including IPv6): https://raw.githubusercontent.com/dibdot/DoH-IP-blocklists/refs/heads/master/doh-ipv6.txt https://raw.githubusercontent.com/dibdot/DoH-IP-blocklists/r... https://raw.githubusercontent.com/dibdot/DoH-IP-blocklists/refs/heads/master/doh-ipv4.txt https://raw.githubusercontent.com/dibdot/DoH-IP-blocklists/r...
  - h4kunamata 1y ago
    That is cool, but the list looks too small, the list https://public-dns.info/nameservers-all.txt https://public-dns.info/nameservers-all.txt is a lot bigger.

h4kunamata 1y ago

I followed this blog to get the firewall dynamic firewall in place: https://labzilla.io/blog/force-dns-pihole https://labzilla.io/blog/force-dns-pihole Like you said, you cannot just block 443, the dynamic firewall uses a public list, which contains all the public DNS known to man ( the last bit was just to sound a little dramatic haha ) So OPNSense will block anything within that list in both 443 and 853. So my Samsung QLED TV can no longer use Google:443 for DNS resolution. OPNSense blocks it and redirect it to PiHole, a NAT is also required to avoid devices getting mad. I didn't pay a kidney for that smartTV back in 2019 to make it dumb, when it is on, PiHole logs goes brrrrrrrr It is also one of the reason why my whole network was going down, it was making too much request exhausting PiHole 150 concurrent DNS requests, there is a flag to increase that and no more issues. Google:443: DNS request only, not actual 443 request gets blocked Cloudflare:443: DNS request only, no actual 443 request gets blocked etc etc Read that blog I shared to understand it. If I run a dig google.com @8.8.8.8, PiHole terminal shows the request If I run 8.8.8.8:443 on the browser, OPNSense firewall log shows access denied, the same msg when my TV turns on or my Home Assistant goes on. DoT on 853 is simple to block on its own, no much secret there.

silon42 1y ago
Good stuff. As an alternative, has someone tried running http/s proxy on the firewall and blocking the rest of client HTTPS (except maybe for whitelist devices)?
- illiac786 1y ago
  Not all devices support proxies and it means you are blocking all UDP traffic (RTP, QUIC…) traffic, this will definitely not make your internet experience better…
illiac786 1y ago
I have similar setup with adguard and opnsense, and here is another list for public known DoH servers (including IPv6): https://raw.githubusercontent.com/dibdot/DoH-IP-blocklists/refs/heads/master/doh-ipv6.txt https://raw.githubusercontent.com/dibdot/DoH-IP-blocklists/r... https://raw.githubusercontent.com/dibdot/DoH-IP-blocklists/refs/heads/master/doh-ipv4.txt https://raw.githubusercontent.com/dibdot/DoH-IP-blocklists/r...
- h4kunamata 1y ago
  That is cool, but the list looks too small, the list https://public-dns.info/nameservers-all.txt https://public-dns.info/nameservers-all.txt is a lot bigger.