Stopping DNS over HTTP bypassing DNSFilter

[lianthar]

As a short addendum I tried pinging the cloudflare DoH URLs. Totally different IPs resolve for this:

Pinging chrome.cloudflare-dns.com [104.18.27.211] with 32 bytes of data:
Reply from 104.18.27.211: bytes=32 time=15ms TTL=58

Pinging mozilla.cloudflare-dns.com [104.16.249.249] with 32 bytes of data:
Reply from 104.16.249.249: bytes=32 time=11ms TTL=58

 

[SomeWhereOverTheRainBow]

Make the router resolve the cname cloudflare-dns.com to a different null ip or simply block it with a dns based solution or block it with skynet.

 

[sbsnb]

Ok so then I also tested by manually setting my DNS server to 1.1.1.1 on my laptop network settings. The What's My DNS Server website gives me exactly the same IP for the responding DNS server as when I used the browser DoH for Cloudflare. So while I am requesting name resolution via 1.1.1.1 - it is still using one of Cloudflare's pool of DNS servers. How this is operating at Layer 3 I'm not sure - is the name resoolution response coming back from 1.1.1.1 or from 162.158.1.37?

It's coming from 1.1.1.1, which can be one of many physical servers. Anycast is treating an IP address like a domain name - as an alias for a particular server or servers. The difference is that the resolution takes place on Cloudfare's routers, not on the client. The client is none the wiser, so blocking 1.1.1.1 blocks the request from ever getting to Cloudfare's routers. The request can't be resolved because it never makes it to Cloudfare.

 

[lianthar]

Make the router resolve the cname cloudflare-dns.com to a different null ip or simply block it with a dns based solution or block it with skynet.

Yes - as per my earlier post I am using Cleanbrowsing DNS service to block all the DoH hostnames. I think NextDNS has a similar list but you could easily create your own.

 

[Zastoff]

Yes - as per my earlier post I am using Cleanbrowsing DNS service to block all the DoH hostnames. I think NextDNS has a similar list but you could easily create your own.

Here is the NextDNS list for blocking bypass methods (Encrypted DNS, VPNs, proxies and more)
edit:
Guess NextDNS do not include their own DoT and DoH in this list

#NextDNS DoH
dns.nextdns.io

#NextDNS DoT
dns1.nextdns.io
dns2.nextdns.io

This list can not directly be added in Diversion i think

 

[cptnoblivious]

Here is the NextDNS list for blocking bypass methods (Encrypted DNS, VPNs, proxies and more)
edit:
Guess NextDNS do not include their own DoT and DoH in this list

#NextDNS DoH
dns.nextdns.io

#NextDNS DoT
dns1.nextdns.io
dns2.nextdns.io

This list can not directly be added in Diversion i think

Thanks for the list. It's quite large..

 

[SomeWhereOverTheRainBow]

https://raw.githubusercontent.com/nextdns/metadata/master/parentalcontrol/bypass-methods

you can add it as a domains block list to diversion. or a black list. Here is what i recommend, if you are only trying to control a certain group of devices from using these to circumvent the block list. You could easily add these to an alternate blocking list, and add the devices you want using DNSFilter to that alternate blocking list. For further instructions on how to setup an alternate blocking list with diversion, and how to add clients to it please see diversions website FAQ area. https://diversion.ch/ .@thelonelycoder has an ingenious design for allowing a separate blocklist to control a subset of devices on a given network.

 

[SomeWhereOverTheRainBow]

Here is the NextDNS list for blocking bypass methods (Encrypted DNS, VPNs, proxies and more)
edit:
Guess NextDNS do not include their own DoT and DoH in this list

#NextDNS DoH
dns.nextdns.io

#NextDNS DoT
dns1.nextdns.io
dns2.nextdns.io

This list can not directly be added in Diversion i think

dont forget

firefox.dns.nextdns.io

 

[SomeWhereOverTheRainBow]

I would recommend importing as a blacklist with diversion versus a blocklist simply for skynet/diversion share listing because if skynet doesn't block the associated IP addresses, then it can easily be circumvented with an IP address because diversion is only blocking the FQDN.

 

[lucluke]

Here is the NextDNS list for blocking bypass methods (Encrypted DNS, VPNs, proxies and more)
edit:
Guess NextDNS do not include their own DoT and DoH in this list

#NextDNS DoH
dns.nextdns.io

#NextDNS DoT
dns1.nextdns.io
dns2.nextdns.io

This list can not directly be added in Diversion i think

Thanks! Here's the Encrypted DNS part of it that you can use directly as a hosted blacklist in Diversion:

https://pastebin.com/raw/s4RVm6fA

I've also blocked 8.8.8.8 and 1.1.1.1 (with secondary) in the UI via https://support.unlocator.com/article/190-how-to-block-google-dns-on-asus-router as I'm using 9.9.9.9 for DoT.
This stopped my Google Nest Hub from working ("check internet connection"), they're insisting on using 8.8.8.8.
Would be cool if skynet had a setting for blocking DoH and DoT.

 

[lucluke]

Reverse lookup these hostnames ,and block the IPs.

Diversion (hostnames) and Skynet (IPs) working together (via dedicated blocklists) could be a good solution to block encrypted DNS:

cloudflare-dns.com
dns.cloudflare.com
one.one.one.one
..

1.1.1.1
1.0.0.1
..