Disabling Firefox's automatic switch to DoH

[RMerlin]

psotconf will work, however make sure you enable custom script/config supports on the System page.

Also check the System Log, it should confirm that it detects and processes your postconf. If not, then double check the filename and location.

 

[dave14305]

I tried the first post config on an AC87U and it does not work.

I activated the option (Prevent Firefox DoH in WAN Setting) on an AC68U and it does work, but as AC87U has not reached the 384.14 it does not have that option.

Has any one have an idea for it to work? Basically we are trying to prevent employees from NSFW content at the office to avoid a future lawsuit, and they are now using this option (small office of 6 people only)

This setting will only prevent the automatic switch to DoH, but won’t prevent a deliberate switch by the Firefox user. See:
https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https

 

[L&LD]

I tried the first post config on an AC87U and it does not work.

I activated the option (Prevent Firefox DoH in WAN Setting) on an AC68U and it does work, but as AC87U has not reached the 384.14 it does not have that option.

Has any one have an idea for it to work? Basically we are trying to prevent employees from NSFW content at the office to avoid a future lawsuit, and they are now using this option (small office of 6 people only)

Are they allowed to use their own devices? Or are they supplied with the devices they need to perform their jobs?

Either not allow them to connect with 'foreign' devices to the work network or lock down the supplied devices so that they can't change any pertinent settings that allow them this bypass ability.

 

[tiko]

psotconf will work, however make sure you enable custom script/config supports on the System page.

Also check the System Log, it should confirm that it detects and processes your postconf. If not, then double check the filename and location.

It worked now, I forgot to CHmod the file and hell was risen on router

Are they allowed to use their own devices? Or are they supplied with the devices they need to perform their jobs?

Either not allow them to connect with 'foreign' devices to the work network or lock down the supplied devices so that they can't change any pertinent settings that allow them this bypass ability.

The problem here is that laptops are changed every week or so, because they are rented. Software to control the users is not possible to use it.

Any way, even if we used Radius on the network with certificates on both ends, users still can use firefox and enable this option on the pcs we provide, so it is not possible to do as you say.

 

[L&LD]

@tiko, rented laptops? Cheaper to buy refurbished and install Microsoft 365 with full control on them, no?

 

[tiko]

@tiko, rented laptops? Cheaper to buy refurbished and install Microsoft 365 with full control on them, no?

Hello, yes, don't want to go full off topic but is a small business where we are editing political advertising. So, it is better to rent some MacBook Pro's with all the licenses included than to buy them, because this lasts for only 3 months and every designer goes back to his/her own job. Sounds crazy but in this times we have to look for new ways to make money.

Cheers!

 

[schnappi]

Why use:
server=/use-application-dns.net/
instead of:
address=/use-application-dns.net. /0.0.0.0

 

[ColinTaylor]

Why use:
server=/use-application-dns.net/
instead of:
address=/use-application-dns.net. /0.0.0.0

I think there's a typo in the second statement:

address=/use-application-dns.net. /0.0.0.0
                                ^^

Did you really mean address=/use-application-dns.net/0.0.0.0 or actually address=/use-application-dns.net/?

The first returns 0.0.0.0 and the second returns NXDOMAIN. A reply of of 0.0.0.0 will not disable DoH. https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet

See post #7.
From the dnsmasq man page:

As for --server, one or more domains with no address returns a no-such-domain answer, so --address=/example.com/ is equivalent to --server=/example.com/ and returns NXDOMAIN for example.com and all its subdomains.