Re:DNS Privacy Considerations
by netr0ute on Saturday July 31, 2021 @09:37AM
(#28018019)
That's why you block port 53 in both UDP and TCP so nothing can bypass it. I also block most known DoH servers outright.
[ Parent
| on HN ]
I also block most known DoH servers outright.
When someone hosts a DoH server on a cdn/AWS/Azure/Google shared IP address, you can't block it by IP; and if the client uses ESNI, you can't block it by HTTP header inspection either.
How will the client know what address to send DoH to? You wouldn't just hardcode an IP unless you want that predictable address manually blocked in the firewall.
Also need to block all hosts not allowed by your own DNS server. Also need to give each "untrusted" app a separate local IP (in future: must have NAT for IPv6 too).
Or just force the use of HTTP/S proxy.
>That's why you block port 53 in both UDP and TCP so nothing can bypass it.
Already done...something is still sneaking through...or cloudflares test is unreliable (or my iptables rules are wrong lol)