News for hackers. Stuff that matters.

A comment on Firefox DNS-over-HTTPS. Parent comment

Re:Firefox DNS-over-HTTPS by fguerraz on Friday April 08, 2022 @09:06AM (#30956337)
Yes, I use ipset on openwrt to block all known public DoH IPs. That is still not enough. You need custom DNAT rules to forward all queries to port 53 to your local resolver (at my home at least, Google and Garmin devices insist on using their own DNS servers)
[ Parent | on HN ]
Re:Firefox DNS-over-HTTPS by lazerl0rd on Friday April 08, 2022 @09:37AM (#30956617)
That doesn't work here. DNS over HTTPS (DoH) uses port 443, which you probably don't want to forward to your local resolver.
[ Parent | on HN ]
Re:Firefox DNS-over-HTTPS by fguerraz on Friday April 08, 2022 @11:59AM (#30958867)
Yes, I mean you block DoH using ipset AND you redirect attempt to use other non-DoH resolvers
[ Parent | on HN ]