Solved Help with Forcing All Traffic to DNS

[macster2075]

buying other hardware/software or a better router/gateway/firewall that has support for blocking browser based DoH, blocking those DNS addresses that DoH browsers are using

Do you know of any software or router that has these capabilities?

 

[bennor]

Do you know of any software or router that has these capabilities?

The article (pushing one companies products) I posted earlier in this thread appears to discuss options to blocking DoH.
https://www.currentware.com/blog/dns-over-https-how-to-stop-users-from-bypassing-your-web-filter/

Cisco: https://umbrella.cisco.com/blog/doh-dns-over-https-to-block-or-not-to-block
https://support.umbrella.com/hc/en-us/articles/360001371526-Web-Browsers-and-DNS-over-HTTPS-default

If you do an internet search you'll likely find other vendors who are pushing similar products.

PFsense (maybe): https://jpgpi250.github.io/piholemanual/doc/Block DOH with pfsense.pdf

https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https

Disable DoH on the browser: https://techdocs.akamai.com/etp/docs/disable-doh-browsers

 

[Tech9]

Known DoH servers blocklist:

GitHub - oneoffdallas/dohservers: A list of publicly available DNS over HTTPS (DoH) servers

A list of publicly available DNS over HTTPS (DoH) servers - oneoffdallas/dohservers

github.com

 

[chongnt]

Known DoH servers blocklist:

GitHub - oneoffdallas/dohservers: A list of publicly available DNS over HTTPS (DoH) servers

A list of publicly available DNS over HTTPS (DoH) servers - oneoffdallas/dohservers

github.com

I use a similar blocklist by @SomeWhereOverTheRainBow

GeneratedAdblock/NoBypass.list at master · jumpsmm7/GeneratedAdblock

Contribute to jumpsmm7/GeneratedAdblock development by creating an account on GitHub.

github.com

 

[macster2075]

I've used both of them and it won't work. Still able to bypass by enabling doh on browser.

 

[Tech9]

I use a similar blocklist by @SomeWhereOverTheRainBow

I don't know. One of Dallas, one over the Rainbow... can't trust them.

've used both of them and it won't work.

Your blocking wasn't set right because One of Dallas works very well for popular servers.

 

[macster2075]

Just to make sure I am using these correctly..
I am inserting those links into Pihole adlist section... is that the way to do it?

Like this...

then hit save, then it shows up in the list below...right?

After this, do I need to do change anything else?

 

[Tech9]

I don't have Pi-hole to test it for you. It works well on pfBlocker-NG I'm using. Check Pi-hole format compatibility. Flush on-device DNS caches.

 

[bennor]

Just to make sure I am using these correctly..
I am inserting those links into Pihole adlist section... is that the way to do it?

Like this...
View attachment 46787

then hit save, then it shows up in the list below...right?
View attachment 46788

After this, do I need to do change anything else?

Are you updating Gravity (Tools > Update Gravity > Update) after adding the new block list? If not, you need to update Gravity so the Pi-hole updates its database(s).

 

[macster2075]

Oh crap.. I forgot about updating gravity.. will do that and report back.!

 

[macster2075]

@bennor Updating gravity did the trick! - Not sure which list did the trick though.. won't hurt any having both in there right?

 

[bennor]

@bennor Updating gravity did the trick! - Not sure which list did the trick though.. won't hurt any having both in there right?

Pi-Hole is smart enough when it compiles it's Gravity database to weed out the duplicates addresses/IP's when using multiple ad block lists.

 

[macster2075]

Thanks all for helping out.

 

[SomeWhereOverTheRainBow]

@bennor Updating gravity did the trick! - Not sure which list did the trick though.. won't hurt any having both in there right?

Keep in mind, my list also blocks proxy and vpn services alike. It doesn't discriminate between the type of bypass being blocked.

 

[macster2075]

Keep in mind, my list also blocks proxy and vpn services alike. It doesn't discriminate between the type of bypass being blocked.

I saw an error on yours in Pihole. Something about one of the sites had an error.

 

[SomeWhereOverTheRainBow]

@bennor Updating gravity did the trick! - Not sure which list did the trick though.. won't hurt any having both in there right?

If you are only concerned with doh, here is a good list

https://raw.githubusercontent.com/dibdot/DoH-IP-blocklists/master/doh-domains.txt

 

[SomeWhereOverTheRainBow]

I saw an error on yours in Pihole. Something about one of the sites had an error.

Most likely it is an abandon site and pihole detected it is no longer resolvable. Pihole will weed that out and only use the good ones from the list. My list is compiled from multiple maintainers lists.

 

[macster2075]

Oh ok.. how often is that list updated?

 

[SomeWhereOverTheRainBow]

Oh ok.. how often is that list updated?

My list is updated nightly, their list are usually a couple of times a week to nightly. I don't check for the resolvability of the domains they provide. Too much work just to compile domains.

 

[macster2075]

Keep in mind, my list also blocks proxy and vpn services alike.

When you say it blocks vpns.. does that mean, it blocks vpn apps on smart devices from connecting to the Internet?