Hacker News Reader

I went to the effort of setting up a pihole, and pointing all the devices on my network to it.

When I saw this notification for the first time yesterday I was a bit annoyed - do I now have to think about every application ignoring OS level settings and using its own?

View on HN

Yes, I use ipset on openwrt to block all known public DoH IPs. That is still not enough. You need custom DNAT rules to forward all queries to port 53 to your local resolver (at my home at least, Google and Garmin devices insist on using their own DNS servers)

That doesn't work here. DNS over HTTPS (DoH) uses port 443, which you probably don't want to forward to your local resolver.

Yes, I mean you block DoH using ipset AND you redirect attempt to use other non-DoH resolvers

Reply on news.ycombinator.com