It's common to block ngrok and the like using their domain exactly for this reason. Although CF and their SNI encryption will be much more difficult.
On a more general note, tangential to the article and specifically regarding blocking DoH and friends, it's pretty trivial to do this with a DNS backed firewall. I do this for my IoT vlan:
- default deny all outbound
- set dnsmasq to populate an ipset/nftset with DNS responses
- have a firewall rule that hole punches for traffic destined for any ip in the set
- now it's just DNS filtering like usual
This means any successful outbound connection must be prefixed with a successful DNS query that is resolved by the local Dnsmasq instance. Any query that hits an unblocked DNS endpoint does not populate the set used for whitelisting, and is dead in the water - making DoH, DoT, DoQUIC, and such unviable.
Obviously, hole punch exceptions as needed (E.g. For direct connects to static ip addresses).
It may work in the limited context that is your IoT network but for any corp, user of the web, etc Cloudflare IPs will open almost immediately for all but the most selective (non-CF) DNS records.
Or you don’t allow any CF DNS records or IP ranges and cut yourself off from half the internet.
That’s what parent meant.
See: https://developers.cloudflare.com/cloudflare-one/connections...