DNS setting

[Tech9]

I just wanted to tell you ports blocking alone is not a solution. Speaking of Asuswrt-Merlin, better plan of action is multiple barriers: intercept and redirect DNS queries on ports 53, 853 (DNSFilter); block known DoT, VPN and Proxy servers on both IP/DNS (Skynet/Diversion), block common VPN ports (Services Filter), use filtering DNS service with corresponding categories (OpenDNS/NextDNS). Not guaranteed, but will discourage most average users.

 

[Morris]

I just wanted to tell you ports blocking alone is not a solution. Speaking of Asuswrt-Merlin, better plan of action is multiple barriers: intercept and redirect DNS queries on ports 53, 853 (DNSFilter); block known DoT, VPN and Proxy servers on both IP/DNS (Skynet/Diversion), block common VPN ports (Services Filter), use filtering DNS service with corresponding categories (OpenDNS/NextDNS). Not guaranteed, but will discourage most average users.

I'm spoiled by using Paloalto Firewalls. Access lists and DNS redirecting is so 20th Century. I guess I could settle for Fortinet, at least there low end costs about the same as a decent router.

Morris

 

[Tech9]

Access lists and DNS redirecting is so 20th Century.

This is the original question, Morris:

How do I block anybody from bypassing my dns using merlin firmware even if they use a VPN?

 

[Morris]

This is the original question, Morris:

Yep, and I answered it. The issue is insufficient technology. One can stop the person that can only follow a script and annoy the expert who will go to war with you if they chose to and you will both waste a lot of time till someone gets frustrated and gives up.

 

[porfavorhelp]

You should be able to block most VPN connections by blocking all of this:

• PPTP (Point-to-Point Tunneling Protocol) – This protocol uses port 1723 TCP.
• L2TP (Layer Two Tunneling Protocol) – This protocol uses port 1701 TCP, Port 500 UDP, and port 4500 UDP.
• IPSec (Internet Protocol Security) – This protocol uses port 500 UDP and ports 4500 UDP.
• STP (Secure Socket Tunneling Protocol) – This protocol uses port 443 TCP.
• OpenVPN – This protocol uses port 1194 TCP/UDP and port 443 TCP.

Morris

Thank you Morris! I will try that

 

[porfavorhelp]

Can I disable these protocol on WAN - NAT router settings to make it easy?

 

[ColinTaylor]

Can I disable these protocol on WAN - NAT router settings to make it easy?

Yes, you can block outgoing connections to PPTP, L2TP and IPSec servers by setting their NAT Passthrough option to disabled.

You can't block SSTP or OpenVPN running on port 443 because that port is used by HTTPS. As RMerlin said in post #7 the only way to block them is by the destination IP address.

 

[Morris]

Thank you Morris! I will try that

As pointed out. My cut and past included 443/tcp which is used for https. Don't block that one

 

[CaptainSTX]

Port blocking will be a whack a mole in frustration. Many options.

Ports that are used on my router.

StrongVPN WireGuard 50001
StrongVPN OpenVPN 8293 & 1194
PIA OpenVPN 1197 & 1198

In addition both providers offer other port options

 

[Morris]

Port blocking will be a whack a mole in frustration. Many options.

Ports that are used on my router.

StrongVPN WireGuard 50001
StrongVPN OpenVPN 8293 & 1194
PIA OpenVPN 1197 & 1198

In addition both providers offer other port options

it depends who you are dealing with. It it is someone that knows how to click an installer and say OK to every question you can easily stop them. Otherwise a conversation and if they don't comply booting them off your network is the way to go.

Morris

 

[Tech9]

It it is someone that knows how to click an installer and say OK to every question you can easily stop them.

Your solution simply doesn't work. You refuse to understand why. Go ahead and help @porfavorhelp.

 

[Morris]

Your solution simply doesn't work. You refuse to understand why. Go ahead and help @porfavorhelp.

If a VPN is permitted, then it's not possible. Blocking a VPN link is possible for some types via ports, in other cases you must block what could turn out to be a long list of destination IP's.

 

[Tech9]

long list of destination IP's

It is long indeed. Someone is working on it:

GitHub - ejrv/VPNs: List of datacenter & VPN IP addresses

List of datacenter & VPN IP addresses. Contribute to ejrv/VPNs development by creating an account on GitHub.

github.com

 

[Zastoff]

The NextDNS setup i use for the kids seems to work so far and tested it on one of my devices and it blocked my vpnprovider and I could not connect(tested with several servers), With the block bypass-methods enabled.
So think it is a good start and if needed add Ip blocklists too skynet.
Edit:
Nextdns is not needed if bypass-method lists are used with Diversion and Skynet