Redirect Hardcoded DNS devices

[johnpoz]

@the-other yeah block rule for 853 would stop dot, but most devices don't use dot they use doh. Doh hides itself in normal looking 443 (https) traffic. So you need a list of known doh servers be it fqdn or IP or both.. I block both.. and log what IPs try to hit the rules..

I believe pfblocker has a built in list that has well known doh servers.

[the other]

@johnpoz thanx for clarifying! I knew that DoH is a b... to go around, yeah there is a blocklist for pfblocker, but it is another race one must enter.
I was just confused, cause it was mentioned above, that mitm was need for DoT as well...
:)

[johnpoz]

@the-other yeah its going to be a never ending game of wack-a-mole for sure..

Keep in mind I have heard of doh using other ports as well 5053, 453 as examples.

[the other]

@johnpoz haven't heard of that...thanks again! Another race to enter...*sigh

[bingo600]

@johnpoz said in Redirect Hardcoded DNS devices:

Keep in mind I have heard of doh using other ports as well 5053, 453 as examples.

Wuuutttt

[johnpoz]

@the-other

https://github.com/oneoffdallas/dohservers/blob/master/iplist.txt

dnscrypt.ca is using Port 453 for DoH (instead of 443)

https://www.speedguide.net/port.php?port=5053
5053 tcp rlm DNS over HTTPS (used by Cloudflared)

I think this is some proxy/relay sort of thing running on pi-hole.. But that they are using other ports other than 443 just points other ways to circumvent blocking it, etc..

its a never ending game of wack-a-mole..

[bingo600]

@johnpoz
Sigh ....

Now my floating(s) use a Port Alias , and not just 443 ... Sigh

Thnx

[SteveITS]

@bohaman re: pfBlockerNG-devel, I usually use Alias Native and create my own aliases, so I use the DOH/Great Wall feed and have rules like this that block any port, to listed IPs:

[johnpoz]

@steveits you actually allow doh? Really? I would never in a million years allow that on purpose.. I don't care the device, if some device required doh - I wouldn't be using that device.

My take on doh is its yet another loss of control that the big players are tricking the end users into thinking they have their best interests -- which is utter and complete BS!!

[SteveITS]

@johnpoz said in Redirect Hardcoded DNS devices:

if some device required doh - I wouldn't be using that device.

It is my Dish (satellite) DVR. :) Not the part that downloads guide and software updates, but the "on demand" movie channels (which is basically an app) use only DoH not DNS. If it's blocked, no movies. ¯\(ツ)/¯

Edit: the ICMP is so I don't think my Internet is down if I ping 8.8.4.4. ‍

[johnpoz]

@steveits really? That blows.. Have you thought of cutting the sat connection? I have been directv for years and years and years. And i am so ready to get rid of it - but wife is hard to convince - she knows how to use it, and she loves being able to record 8 different things at the same time..

And this is the last year for sunday ticket on directv, so next year -- I might be able to just get rid of it? Fingers crossed..