Enabling DNS-over-TLS (DoT) is now allowing a flood of ads through

[Ronbo]

Well Well. While posting this thread, I discover that changes I made to Firefox are the issue!
network.trr.mode 0 -> 2
network.security.esni.enabled false -> true
The above settings were related to more secure DNS-over-HTTPS (DoH)

When I enabled the above Firefox configuration, it allows a flood of ads. It makes me appreciate all the wonderful software provided by contributors!
***********************************************************************************************
I am going ahead with the post because I do detail my DNS related settings and this may help someone else.

I am running 384.15 Asus Merlin on an AC86U router. Since installing 384.15 I have had issues with DNS I didn't notice in prior releases. Some devices (such as my SmartTV, a Kindle, old ipad & Firestick) couldn't connect to the internet at all using the Gateway 192.168.1.1 and DNS 192.168.1.1. Most of my network devices could access the Internet using these Gateway/DNS settings. Very confusing why some worked & others didn't. I also continued to get DNS leaks.

I am running amtm, Skynet, Diversion, ya-block-malware

Prior to making the bolded changes below, I had a handful of devices that simply would not access the internet. Once I started using DNS-over-TLS, every single device on the network connects to the internet. However, all the above adware/malware blockers appear to no longer block anything. It appears that my traffic is not going through the router the way it was. When I use Firefox to browser a website, I see ads popping up everywhere.

I tried to use different DNS settings to get all my devices accessing the Internet.

LAN/DHCP Server
DNS Server 1 & 2: Blank
Advertise router's IP in addition to user-specified DNS: Yes
WINS Server: Blank
WAN DNS Setting
Connect to DNS Server Automatically: No
DNS Server 1: 8.8.8.8
DNS Server 2: 1.1.1.1
Forward local domain queries to upstream DNS: No
Enable DNSSEC support: No
DNS Privacy Protocol: DNS-over-TLS (DoT) <-- Was set to NONE
DNS-over-TLS Profile: Strict
I have 4 Preset Servers in the list
VPN Client
Accept DNS Configuration: Strict
Create NAT on tunnel: Yes
Inbound Firewall: Block
Force Internet traffic through tunnel: Policy Rules (Strict)
Block routed clients if tunnel goes down: Yes
ALL-LAN 192.168.1.0/24 0.0.0.0 VPN

Question: Does anyone know what, if any, servers (like CloudFlare but not CloudFlare) handle DNS-over-TLS (DoT) who advertise they don't record/track DNS queries coming through their servers?

 

[krgck]

Enable "Prevent client auto DoH"

And what comes to DoT providers here is good list: https://dnsprivacy.org/wiki/m/mobile.action#page/1277971

 

[XIII]

NextDNS might be of interest to you:

• no logging by default: https://nextdns.io/privacy
  
• can block ads via blocklists: https://nextdns.io/faq

One of the developers is a (recent) member of this forum.

 

[Mutzli]

NextDNS might be of interest to you:

• no logging by default: https://nextdns.io/privacy
  
• can block ads via blocklists: https://nextdns.io/faq

One of the developers is a (recent) member of this forum.

and you can configure Firefox to use NextDNS as default resolver:

 

[RMerlin]

Well Well. While posting this thread, I discover that changes I made to Firefox are the issue!
network.trr.mode 0 -> 2
network.security.esni.enabled false -> true
The above settings were related to more secure DNS-over-HTTPS (DoH)

When I enabled the above Firefox configuration, it allows a flood of ads. It makes me appreciate all the wonderful software provided by contributors!

What you did there is basically tell Firefox to ignore any DNS features from your router, and use their built-in DNS handling instead. So if you have ad blocking implemented on your router, you are bypassing it by using that feature.

 

[rgnldo]

network.trr.mode 0 -> 2

Your router's ad blocking is based on your DNS.
with this activated:
.trr = Trusted Recursive Resolver
will have another resolver, doing a bypass DNS. Like VPN, it ignores any local DNS service management.

It is an unreliable feature at the browser level. You will have problems.

 

[JohnD5000]

What you did there is basically tell Firefox to ignore any DNS features from your router, and use their built-in DNS handling instead. So if you have ad blocking implemented on your router, you are bypassing it by using that feature.

Is there any test to confirm that what we setup on our router is what is being used by our browser?

 

[RMerlin]

A typical DNS leak test should confirm which DNS your browser is using:

https://www.dnsleaktest.com/

 

[ankhazam]

Hi,
I wanted to confirm one thing about DoT in RMerlin firmware. Namely is this comment still valid and in e.g. 384.17 we still need to set it instead of leaving those fields blank?

IMPORTANT: for DNS Privacy to work in IPv6, you must set IPv6 DNS Server in IPv6 page (not equivalent to add IPv6 DoT servers on the WAN -> Internet Connection page) to your router's LAN IPv6 Link-Local Address. You can find your router's LAN IPv6 Link-Local Address in System Log -> IPv6 tab.