Comment on I finally figured out how to virtualize my OPNsense firewall. Suck it, Roku.
Silejonu@kbin.social 10 months agoI suspect DoT and DoH still go through, though? I mean you can always block the port 853 for DoT, but DoH is another story.
That’s correct. I block DoT in my firewall and block known DoH domains in piHole. I’m sure stuff slips through occasionally but the vast majority of my DNS requests are handled by piHole.
Traditional DNS over UDP/53 is insecure but I’m using ProtonVPN’s DNS server over VPN externally so I’m not worried about that.
I see. I may try to do something similar but towards Unbound on my OPNSense router, if that's possible.
jemikwa@lemmy.blahaj.zone 10 months ago
Yeah you’d need an L7 application layer filtering firewall to catch DoH since it would detect the SSL packet signature on port 53. Unfortunately that balloons the cost of the device past a reasonable level for a home aficionado.