I have a question concerning DNS hijacking when clients use their own private DNS configuration (e.g. my phone). On my phone, when checking with dnsleak, the OpenWRT's DNS resolvers from stubby do not appear. This still applies when I use a Intercept-DNS rule that forwards all IPv4/6 traffic to the router port 53 which is then sent to stubby. Also, adblock's blacklist does not work properly. Is there a solution without the need of an extra Pi running Pihole oder Adguard Home? This seems especially important for the possibility of parental control.
Thanks in advance!
Phones fall back to DoH , you need canary domains to convince them int port53
Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
Remember to redact passwords, MAC addresses and any public IP addresses you may have:
ubus call system board
cat /etc/config/network
cat /etc/config/firewall
No, nothing to stop someone from offering their service on a non-standard port. Got any examples of DoT or DoH on some other port, very doubtful on existence.
A proprietary closed-source application may implement its own resolver, and they may choose to only do name resolutions from their servers. If they are smart enough, they may also predict hijacking and blocking, choosing a non standard port.
Assuming DNS over UDP, at layer 2 or 3 you may capture these and redirect them to your local server (TCP works too, but requires more work, and you probably can't prevent the 3-way handshake with the remote server from happening).
Encrypted traffic is a no go, unless you can predict these exchanges are DNS, and block them.
DoH plus private DNS-server/recursor on the web will do the job. However, such a special environment needs quite some effort to be set up. Against such a smart installation you might still be able to fight using DPI. Or even just using wireshark and a lot of patience to examine destination IPs and their correlation
But for standard usage case, DNS intercept, blockage of the well-known DoH-servers and dest port 853 plus blockage of well known VPN-IPs (and blockage of QUIC) should be sufficient. Thats what I am doing in my hobby project for parental control.
Thanks for the replies. Have to digest some of the ideas. Here's my configuration.
Do I get right, that if I block the encrypted DoH and DoT, clients try to use unencrypted ways and can be filtered again?
As already remarked by other you need a DNS hijacking rule for port 53 and for 853 (which nowadays amounts to blocking port 853)
Furthermore you need to set the canary domains for Apple and Google/Firefox
The hard part is blocking DoH servers for that you need e.g. a banip blocklist
I am traveling, so do not have the specific instructions handy but the HTTPS-DNS proxy actually has a setting which does just that (safe the blocking of DoH)
Just to be clear to both posters with DNS concerns.
A DNS Leak site will show the [Public] IP of the machine that actually did the DNS lookup.
You can configure OpenWrt in one of 2 ways:
your DNS softwware can be configured to use other DNS server (caching DNS)
you configured the OpenWrt to perform the recursive lookup itself (this is a "true" DNS server")
If you configure your machine to do the latter, DNS Leak Tests will show you or your ISP as the nameserver. This is particularly true if you are behind carrier-grade NAT.
Ya think, well colour me surprised, But, what does that have to do with well known providers, providing well known services, on well known IPs/Ports, Quad9, Google, Cloudflare... Again DoT should not present an issue, DoH on the other hand is problematic, CONTRARY to the post to which I responded.
config rule
option name 'Block-Public-DNS'
option enabled '1'
option src 'lan'
option dest 'wan'
option dest_port '53 853 5353'
option proto 'tcpudp'
option family 'any'
option target 'REJECT'
You do not want to block dst port 53, at all. You want to redirect traffic targeting port 53 to your local DNS server. If you block all of these ports and an application/system isn't using your local DNS server, you just broke name resolution.
The blocking approach won't work if the application's resolver doesn't have a fallback to standard DNS at port 53. In this case, you've also broke name resolution.
You asked "Got any examples of DoT or DoH on some other port", and I gave you a practical example that is actually employed in some applications. You didn't make any demand that the DNS server had to be hosted by a well-known/big company.
Well-known services have nothing to do with the possibility of DNS leaks. Applications CAN leak DNS on their own, if programmed in such a way.
Okay thanks again. I am not sure about practical implication from all these aspects. Am I right that it is pretty tricky to filter all DoT/DoH possibilities in order to reach full avoidance of DNS leakage? And is it correct that from a privacy perspective this filtering is not so much of an issue as large companies are not (yet) using it to get their info about "customers"/people?
In fact I think I can try having the phone itself set up as safe for kids and accept its DoT activity. Meanwhile I use the OpenWRT functionality mainly for stationary appliances and hope they stick with unencrypted DNS? Does this make sense? Or is leak to be expected?
One last question. What about the option "Force DNS" in Adblock? Does it help here? Is it even necessary or is it already implemented with the mentioned firewall rule that blocks ports 53 and 853?
