# DNS Hijacking Doc - 2 rules for DNS over HTTPS

**URL:** <https://forum.openwrt.org/t/dns-hijacking-doc-2-rules-for-dns-over-https/112573>\
**Category:** Talk about Documentation\
**Created:** [November 21, 2021, 2:24pm UTC](https://forum.openwrt.org/t/dns-hijacking-doc-2-rules-for-dns-over-https/112573 "2021-11-21T14:24:09Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![shoulders](https://forum.openwrt.org/letter_avatar/shoulders/32/5_5575768a8748004e209b776fc1b2916d.png) [@shoulders](https://forum.openwrt.org/u/shoulders)\
**Post date:** [November 21, 2021, 2:24pm UTC](https://forum.openwrt.org/t/dns-hijacking-doc-2-rules-for-dns-over-https/112573/1 "2021-11-21T14:24:09Z")

</div>

On the page [https://openwrt.org/docs/guide-user/firewall/fw3\_configurations/intercept\_dns#dns\_over\_https](https://openwrt.org/docs/guide-user/firewall/fw3_configurations/intercept_dns#dns_over_https)

In the following code, IPv4 and IPv6 are defined separately but the rule is exactly the same for both protocols.

Can someone check this and then combine the rules confusing. If I have missed something then you should at least call one Deny-DoH6

```
# Filter DoH traffic
uci -q delete firewall.doh_fwd
uci set firewall.doh_fwd="rule"
uci set firewall.doh_fwd.name="Deny-DoH"
uci set firewall.doh_fwd.src="lan"
uci set firewall.doh_fwd.dest="wan"
uci set firewall.doh_fwd.dest_port="443"
uci set firewall.doh_fwd.proto="tcp udp"
uci set firewall.doh_fwd.family="ipv4"
uci set firewall.doh_fwd.ipset="doh dest"
uci set firewall.doh_fwd.target="REJECT"
uci -q delete firewall.doh6_fwd
uci set firewall.doh6_fwd="rule"
uci set firewall.doh6_fwd.name="Deny-DoH"
uci set firewall.doh6_fwd.src="lan"
uci set firewall.doh6_fwd.dest="wan"
uci set firewall.doh6_fwd.dest_port="443"
uci set firewall.doh6_fwd.proto="tcp udp"
uci set firewall.doh6_fwd.family="ipv6"
uci set firewall.doh6_fwd.ipset="doh6 dest"
uci set firewall.doh6_fwd.target="REJECT"
uci commit firewall
/etc/init.d/firewall restart

```

Also the last command in this block **ipset setup** fails because the switch **setup** does not exist.

I am running OpenWrt 20.02.01

Thanks

---

<div class="post-metadata">

**Author:** ![dave14305](https://forum.openwrt.org/user_avatar/forum.openwrt.org/dave14305/32/26290_2.png) [@dave14305](https://forum.openwrt.org/u/dave14305)\
**Post date:** [November 21, 2021, 2:39pm UTC](https://forum.openwrt.org/t/dns-hijacking-doc-2-rules-for-dns-over-https/112573/2 "2021-11-21T14:39:24Z")

</div>

The ipsets are different. There is one for matching IPv6 entries and one for matching IPv4 entries.

---

<div class="post-metadata">

**Author:** ![shoulders](https://forum.openwrt.org/letter_avatar/shoulders/32/5_5575768a8748004e209b776fc1b2916d.png) [@shoulders](https://forum.openwrt.org/u/shoulders)\
**Post date:** [November 21, 2021, 3:09pm UTC](https://forum.openwrt.org/t/dns-hijacking-doc-2-rules-for-dns-over-https/112573/3 "2021-11-21T15:09:46Z")

</div>

So why is there only 1 rule for DNS over TLS DoT?

You could just combine the rules.

Any explanation would be appreciated.

---

<div class="post-metadata">

**Author:** ![vgaetera](https://forum.openwrt.org/user_avatar/forum.openwrt.org/vgaetera/32/113586_2.png) [@vgaetera](https://forum.openwrt.org/u/vgaetera)\
**Post date:** [November 21, 2021, 4:41pm UTC](https://forum.openwrt.org/t/dns-hijacking-doc-2-rules-for-dns-over-https/112573/4 "2021-11-21T16:41:48Z")

</div>

DoT port is unique matching both IPv4 and IPv6 traffic, so filtering by port works well.  
DoH uses the same port as HTTPS, so we need to filter by the destination IP address.

There are many public DoH servers, and filtering them all efficiently relies on IP sets.  
Each IP set contains only IPv4 or IPv6 entries, so a couple of sets/rules is necessary.

See also: [Ipset setup does not work - #2 by vgaetera](https://forum.openwrt.org/t/ipset-setup-does-not-work/112075/2)

---

<div class="post-metadata">

**Author:** ![system](https://forum.openwrt.org/uploads/default/original/3X/7/4/740520c71f00039bbf001045c682f0ecb25e905a.png) [@system](https://forum.openwrt.org/u/system)\
**Post date:** [December 1, 2021, 4:42pm UTC](https://forum.openwrt.org/t/dns-hijacking-doc-2-rules-for-dns-over-https/112573/5 "2021-12-01T16:42:43Z")

</div>

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.