[tatsuya46]

on r49289 im testing icloud relay and to see how it works (it shouldnt) with my dns filter list. it seems icloud relay uses dns over https, and the 2 icloud relay domains mask.icloud.com and mask-h2.icloud.com are already blocked to 0.0.0.0 and ::. but my iphone can still bypass my entire blocklist if i enable icloud relay.

i already have forced dns redirection and forced dns redirection (DoT) enabled. how can i force DoH to do the same and be overridden by the local dns?

[the-joker]

Afaik DNS over HTTPS bypasses some filters, e.g. host files and perhaps others.

Also what static DNS servers are you using? The must support DoH e.g. 1.0.0.1 and 9.9.9.9 do, others also, I rather peel my eye lids off rather than use google anything..

[tatsuya46]

cloudflare right now ipv4/6. the blocklist is handled by unbound and unbound checks local-zone before forwarding.. why im confused

[Alozaros]

[dale_gribble39]

This commit only seems to apply to dnsmasq; but conditional compile options are present for smartdns and unbound in the affected file. Shouldn't dnsmasq forward requests to the proxy of choice (smartdns / unbound) or vice-versa? Visual lecture aids are welcome to explain the "problem".

https://svn.dd-wrt.com/changeset/49289

[egc]

I am the author of https://svn.dd-wrt.com/changeset/49289

For Firefox Browser it is possible to signal NOT to use DoH with the help of a canary domain see:
https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet

But it can be manually overridden.

You cannot redirect DoH, your only option is to block all DoH addresses with IPSET.
The IPSET guide (a sticky in the Advanced Networking forum) has a paragraph about this.

But even then tech save users will use a proxy server they setup in the cloud or even use a VPN (you can use IPSET to block all known VPN servers), but again if they setup their own in the cloud (which is really easy and free, I am running a free Oracle Cloud server with OpenVPN and WireGuard) you are toast.

Bottom line only real thing that might work is using IPSET with a whitelist.

[Alozaros]

if im not wrong this option persist in dnscrypt-proxy v2
use-application-dns.net for force/check the use of firefox DOH..and overrides it..
if im not wrong there was a thread somewhere around DDWRT where a chap was looking for this option where you can add this in DNSmasq exactly like egc patch address=/use-application-dns.net in order to prevent the use of DOH and than you get the slap in the face with tor browsers like opera GX and others..

This reminds me, once i was called to my friend private school to consult the Internet filtering options... kids are so crafty and clever this days..

and yep IPset seems to be the best solution so far...even if its a bit of an effort...to deploy and set up...

[the-joker]

TBH unless you need your specific icloud relay for something it maybe easier to just not use it.

icloud sounds like something Apple, just thinking about it I get a rash.