<div dir="ltr"><div class="gmail_default" style="font-family:arial,sans-serif;color:rgb(0,0,0)">Well, the real issue is DNS "leakage", because some (most?) browsers and lots of phone apps use their own resolvers, thus bypassing your advertised DNS resolver. My solution is on the router: I set up dnsmasq as my local resolver (with adblock and DNSSEC, stubby is my backend for DoT), don't even bother advertising it and then have three sets of firewall rules to make sure all hosts adhere to the One True DNS:</div><div class="gmail_default" style="font-family:arial,sans-serif;color:rgb(0,0,0)"><br></div><div class="gmail_default" style="font-family:arial,sans-serif;color:rgb(0,0,0)">1) DNS redirect: All LAN device requests to WAN (or LAN) at port 53 are redirected to the router:53.</div><div class="gmail_default" style="font-family:arial,sans-serif;color:rgb(0,0,0)">2) DoT block: All LAN devices attempting to access port 853 anywhere are blocked.</div><div class="gmail_default" style="font-family:arial,sans-serif;color:rgb(0,0,0)">3) DoH block: All LAN devices that attempt to access port 443 on WAN are checked against a couple of sets of host IP addresses (one each for IPv4 and v6), and if the external host is a known-DoH resolver, the request is blocked. (I update nightly from <a href="https://github.com/dibdot/DoH-IP-blocklists">https://github.com/dibdot/DoH-IP-blocklists</a>)</div><div class="gmail_default" style="font-family:arial,sans-serif;color:rgb(0,0,0)"><br></div><div class="gmail_default" style="font-family:arial,sans-serif;color:rgb(0,0,0)">When setting this up, I would watch tcpdump for various requests and convinced myself that I was catching 99% of everything, but I have not even tried to figure out DNS-over-QUIC and how it might be getting past my rules.</div><div class="gmail_default" style="font-family:arial,sans-serif;color:rgb(0,0,0)"><br></div><div class="gmail_default" style="font-family:arial,sans-serif;color:rgb(0,0,0)">
<div class="gmail_default" style="font-family:arial,sans-serif;color:rgb(0,0,0)">#1
means that if I go to any machine in the house and say 'nslookup
<a href="http://blarg.com">blarg.com</a> 8.8.8.8' or 'dig @<a href="http://8.8.8.8">8.8.8.8</a> <a href="http://blarg.com">blarg.com</a>', then I see my router as
the DNS resolver in the response, even though I explicitly asked for
8.8.8.8 to resolve it. Which in turn means that DNS configuration on a
per-machine is not required, and anyone connecting to my network is subject to my rules.</div><div class="gmail_default" style="font-family:arial,sans-serif;color:rgb(0,0,0)"><br></div><div class="gmail_default" style="font-family:arial,sans-serif;color:rgb(0,0,0)">#3 causes some browsers to hang because they really, really want to use DoH. Usually there is a browser setting to disable DoH, so it resorts to plain DNS (at least there is in Firefox, which is what I make everyone here use; yeah, I'm dictator :) ).<br></div><div class="gmail_default" style="font-family:arial,sans-serif;color:rgb(0,0,0)"><br></div>
</div><div class="gmail_default" style="font-family:arial,sans-serif;color:rgb(0,0,0)"><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sun, Dec 18, 2022 at 9:57 AM Michael Smith <<a href="mailto:michael@kmaclub.com">michael@kmaclub.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="auto"><div dir="ltr"></div><div dir="ltr">I am not aware of a way, but hopefully someone else has ideas. </div><div dir="ltr"><br></div><div dir="ltr">I run two instances of pihole. One for the grown ups that points upstream to 1.1.1.1 and the other points to 1.1.1.3. </div><div dir="ltr"><br></div><div dir="ltr">Then I use similar stanzas below to point the clients to the right pihole</div><div dir="ltr"><br></div><div dir="ltr">Michael </div><div dir="ltr"><br><blockquote type="cite">On Dec 18, 2022, at 9:10 AM, Jonathan Stafford <<a href="mailto:thecabinet@gmail.com" target="_blank">thecabinet@gmail.com</a>> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr"><div dir="ltr">Thanks, Michael. That will work to get them using that server, but it's totally bypassing dnsmasq which means my local entries from /etc/hosts don't resolve. I'd like both things to work to be difficult :)</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sun, Dec 18, 2022 at 10:36 AM Michael Smith <<a href="mailto:michael@kmaclub.com" target="_blank">michael@kmaclub.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<div>On 12/18/22 06:59, Jonathan Stafford
wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">--server provides a way to change upstream
resolvers based on the domain being queried. Is there a way to
make the same sort of change based on the client doing the
querying? For example, I'd like the IP address range I use for
my kids' devices to use 1.1.1.3.
<div><br>
</div>
</div>
</blockquote>
<p><br>
</p>
<p>You can achieve this using tags:</p>
<p><br>
</p>
<p><br>
</p>
<p><span style="font-family:monospace"><span style="color:rgb(0,0,0);background-color:rgb(255,255,255)"># Define DNS
servers
</span><br>
dhcp-option=option:dns-server,1.1.1.1<br>
</span><span style="font-family:monospace"><span style="color:rgb(0,0,0);background-color:rgb(255,255,255)">dhcp-option=tag:kidsdevices,option:dns-server,1.1.1.3</span><br>
</span></p>
<p><span style="font-family:monospace"><br>
</span></p>
<p><span style="font-family:monospace"><span style="color:rgb(0,0,0);background-color:rgb(255,255,255)">dhcp-host=0c:51:01:95:d3:36,set:kidsdevices
# Ipad
</span><br>
dhcp-host=58:41:4E:CD:D2:0A,set:kidsdevices # Iphone<br>
</span></p>
<p><span style="font-family:monospace"><br>
</span></p>
<p><span style="font-family:monospace">Michael</span></p>
<p><span style="font-family:monospace"><br>
</span></p>
</div>
_______________________________________________<br>
Dnsmasq-discuss mailing list<br>
<a href="mailto:Dnsmasq-discuss@lists.thekelleys.org.uk" target="_blank">Dnsmasq-discuss@lists.thekelleys.org.uk</a><br>
<a href="https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss" rel="noreferrer" target="_blank">https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss</a><br>
</blockquote></div>
</div></blockquote></div>_______________________________________________<br>
Dnsmasq-discuss mailing list<br>
<a href="mailto:Dnsmasq-discuss@lists.thekelleys.org.uk" target="_blank">Dnsmasq-discuss@lists.thekelleys.org.uk</a><br>
<a href="https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss" rel="noreferrer" target="_blank">https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss</a><br>
</blockquote></div>