undefined | Better HN

0 pointsycombinatrix1y ago0 comments

block all outgoing traffic to port 53 in your router. this catches everything using plaintext DNS or DoT.

0 comments

This does nothing to stop anything intentionally circumventing your DNS settings. There's no reason DNS traffic has to be on port 53, and DoH is undetectable.

ycombinatrixOP1y ago

>This does nothing to stop anything intentionally circumventing your DNS settings.

It makes it substantially more difficult. My firewall statistics are proof of that. On a production network you'd have everything blocked.

j / k navigate · click thread line to collapse

0 pointsycombinatrix1y ago0 comments

block all outgoing traffic to port 53 in your router. this catches everything using plaintext DNS or DoT.

0 comments

caymanjim1y ago

This does nothing to stop anything intentionally circumventing your DNS settings. There's no reason DNS traffic has to be on port 53, and DoH is undetectable.

ycombinatrixOP1y ago

>This does nothing to stop anything intentionally circumventing your DNS settings.

It makes it substantially more difficult. My firewall statistics are proof of that. On a production network you'd have everything blocked.

j / k navigate · click thread line to collapse