Force SafeSearch in DuckDuckGo

[SomeWhereOverTheRainBow]

So I would have to know which IP address are using outbound doh connection on port 443?
Based on the answers I got previously on this post, I thought doh would bypass all filtering at the router level, no matter what.. that's the impression I got from it.
But you're saying there's a way block that?

The router is still the gatekeeper of outbound/inbound connections. And DNSMasq (or pihole) still controls any unencrypted initial query that occur on port 53 (if dnsfilter is forcing traffic).

 

[macster2075]

The router is still the gatekeeper of outbound/inbound connections. And DNSMasq (or pihole) still controls any unencrypted initial query that occur on port 53 (if dnsfilter is forcing traffic).

I have DNSfilter setup as Router and I have Cloudfare as DNS in WAN and it works.. adult websites are blocked and SafeSearch is working as it should...but as soon as I enable doh in Firefox, all that filtering goes out the window, which I guess it's the intended purpose of doh...just wanted to see if there's a way around that.

 

[SomeWhereOverTheRainBow]

I have DNSfilter setup as Router and I have Cloudfare as DNS in WAN and it works.. adult websites are blocked and SafeSearch is working as it should...but as soon as I enable doh in Firefox, all that filtering goes out the window, which I guess it's the intended purpose of doh...just wanted to see if there's a way around that.

Use the no bypass list I posted above in your blocker. Give that a try.

 

[macster2075]

Use the no bypass list I posted above in your blocker. Give that a try.

Do I add that list here?

 

[macster2075]

I tried to access via ssh
/jffs/configs/hosts.add

but I get "not found".

 

[SomeWhereOverTheRainBow]

Do I add that list here?
View attachment 36249

No to an ad locker like pinhole or diversion

 

[macster2075]

I didn't know what Diversion was until today. I guess Im trying to understand the difference between blocking urls via the router vs Pihole. Or why doh is able to bypass the router's dns server, but not the Pihole dns.

 

[macster2075]

No to an ad locker like pinhole or diversion

So I've added just one website as a test to the pihole block list. It blocks access to the website, but not when doh is enabled in the browser.

 

[dave14305]

So I've added just one website as a test to the pihole block list. It blocks access to the website, but not when doh is enabled in the browser.

The idea is that when using DoH, the browser needs to make an initial normal DNS request for the DoH resolver URL domain. With Firefox, the default DoH service uses the domain mozilla.cloudflare-dns.com. So you would set PiHole to block that domain name (which is included in Somewhere's block list) so that Firefox cannot negotiate the DoH connection and falls back to regular DNS, which can be manipulated.

 

[macster2075]

The idea is that when using DoH, the browser needs to make an initial normal DNS request for the DoH resolver URL domain. With Firefox, the default DoH service uses the domain mozilla.cloudflare-dns.com. So you would set PiHole to block that domain name (which is included in Somewhere's block list) so that Firefox cannot negotiate the DoH connection and falls back to regular DNS, which can be manipulated.

Oh I see.. I'm still trying to find how I can add those 700 domains to pihole.. so far I've found that I also need the ip address and if that's the case, that's gonna take a long time. There has to be an easier way.

 

[SomeWhereOverTheRainBow]

The idea is that when using DoH, the browser needs to make an initial normal DNS request for the DoH resolver URL domain. With Firefox, the default DoH service uses the domain mozilla.cloudflare-dns.com. So you would set PiHole to block that domain name (which is included in Somewhere's block list) so that Firefox cannot negotiate the DoH connection and falls back to regular DNS, which can be manipulated.

Thank you for your much more elegant explanation.

 

[SomeWhereOverTheRainBow]

Oh I see.. I'm still trying to find how I can add those 700 domains to pihole.. so far I've found that I also need the ip address and if that's the case, that's gonna take a long time. There has to be an easier way.

Copy and paste the link into piholes adblock list.

 

[SomeWhereOverTheRainBow]

Copy and paste the link into piholes adblock list.

The list gets updated whenever a new bypass url is discovered.

 

[macster2075]

The list gets updated whenever a new bypass url is discovered.

oh, that's great.. and do I have to update it on my end as well, or will pihole auto update it like it does with the adlists?

 

[SomeWhereOverTheRainBow]

oh, that's great.. and do I have to update it on my end as well, or will pihole auto update it like it does with the adlists?

It will get updated on your end whenever pihole detects that the file has been updated on the upstream. Pihole takes care of everything else.

 

[macster2075]

It will get updated on your end whenever pihole detects that the file has been updated on the upstream. Pihole takes care of everything else.

Well, we'll see how it goes. I know it's a cat and mouse thing... and there's always going to be a loophole for everything...kids nowadays are way too smart or have smart friends hehe.
All I can do is try lol.

 

[macster2075]

One more quick question though.. so even if I configure pihole with cloudfare for DNS over HTTPS.. that still doesn't fix my issue right?
Meaning, Firefox will still be able to bypass Pihole and will I still need to add that list you provided?

 

[macster2075]

Copy and paste the link into piholes adblock list.

So I've added the link to the pihole block list, but I can still access a few that I've tried from the list.

 

[macster2075]

I notice if I add facebook.com it blocks it, but even if I add one of those domains from the list individually it won't block it...it completely ignores it.
This is without using Firefox..Im using Edge with no doh.

 

[macster2075]

So It seems adding them individually using wildcard is blocking the domains. Is there a way to add them another way since it looks like adding the link has no impact.