Does DNS director block port 53 and/or 853 outgoing?

[vmachiel]

Hi,

So I have two raspberry PI's running pihole and unbound. I have set all my devices to those IPs as DNS, and set up DNS director. Basically it blocks everything and sends it to the raspberry pis.

But I'm wondering: some clients may use hard coded DoT using port 853. Does DNS director block those and send them to my designated DNS servers? The documentation is unclear.. or maybe I missed, in that case sorry.

And what about DoH? To know what the address is to send the requests to, the client will first have to get that via a normal DNS (53) or DoT (853). I'm assuming port 53 outbound is blocks by the directory and send to the designated DNS servers? (I have known DoT address block list).

Thanks!

 

[ColinTaylor]

But I'm wondering: some clients may use hard coded DoT using port 853. Does DNS director block those and send them to my designated DNS servers?

DNS Director drops port 853 traffic which (should) force the client to fall back to traditional (port 53) DNS, which can then be redirected.

And what about DoH?

DoH is indistinguishable from other HTTPS traffic so you would have to block it by destination domain name or IP address, similar to how ad-blocking works.

 

[bennor]

So I have two raspberry PI's running pihole and unbound. I have set all my devices to those IPs as DNS, and set up DNS director. Basically it blocks everything and sends it to the raspberry pis.

Just make sure DNS Director is properly setup to allow only the Raspberry Pi through (No Redirection). The way it's supposed to work (as I understand it) is that all DNS requests that tries to bypass the Raspberry Pi's will be routed to the Raspberry Pi. The Pi-Hole log should show the router as the source when the routing happens.

An old example of how to use DNS Director with Raspberry Pi's (Pi-Hole/Unbound) at this post:
https://www.snbforums.com/threads/pihole-dns.74646/page-3#post-712319

 

[vmachiel]

DNS Director drops port 853 traffic which (should) force the client to fall back to traditional (port 53) DNS, which can then be redirected.


DoH is indistinguishable from other HTTPS traffic so you would have to block it by destination domain name or IP address, similar to how ad-blocking works.

Thanks, I have those destination domains blocked (known DoH domains).

Just make sure DNS Director is properly setup to allow only the Raspberry Pi through (No Redirection). The way it's supposed to work (as I understand it) is that all DNS requests that tries to bypass the Raspberry Pi's will be routed to the Raspberry Pi. The Pi-Hole log should show the router as the source when the routing happens.

An old example of how to use DNS Director with Raspberry Pi's (Pi-Hole/Unbound) at this post:
https://www.snbforums.com/threads/pihole-dns.74646/page-3#post-712319

Thanks. I have it setup this way.

Thanks for the replies!