Hi,
Am new here!
Am trying to create firewall or NAT rules to force only OPENDNS on PPPOE users network, even if they change to other dns in their devices.
I have seen lot of tutorials, and seems not to working on only on PPPOE users, if they change their devices to google DNS or other DNS
thanks.
Can’t realistically be done due to DNS over HTTPS
A lot of websites are now enforcing DNS over HTTPS which effectively means it does not care what DNS servers you set. I.e. google knows valid IP addresses, if any DNS server attempted to redirect google.com to somewhere else, it denies it and instead contacts a well known encrypted DNS server to get a valid IP
This is creating a nightmare for a lot of scenario’s, it makes content filtering EXTREMELY difficult. It’s touted as a safety/security mechanism to prevent spoofing, man-in-the-middle attacks etc. Which to some degree is good but also it completely defeats a big part of the internet and being decentralized. Now it puts all of the control in organizations like Google/Facebook/Etc that can get on that approved HTTPS DNS servers list. So they can get your browsing data quite easily at the source before its fed to you
More importantly its difficult to cache DNS entries for speed, or filter out rubbish like ads/porn/whatever. The only way to mitigate this is with a frankly terrible solution, by forcefully blocking all access to all well known HTTPS DNS servers (a list that can change, so it requires a script to run that keeps it updated) and then only allow port 53 to a known server. This still will not get around any applications that have hardcoded DNS entries (i.e. Google, Microsoft etc) and it will be impossible to filter or redirect them. It will also completely deny access to i.e. https sites that happen to be hosted on the same IP address
In short: its a flapping nightmare
It sure complicates things.
I’m filtering out as much as possible, looking at the counters there is not that much traffic except for DOT/DOH In the browser-side I disabled these “secure dns” lookups where possible
Blocking DNS-over-HTTPS is done against a “RougeDNS” ACL which is a dynamic list…unfortunately I think its not that up-to-date anymore. (721 entries in the list)
Apart from that I’ve some NAT-rules which intercept any classic tcp/udp-53 and deliver this to Pihole.
All of this off course is not 100% tight, a product like RouterOS is far from advanced in the upper layers of OSI
Users can always use some VPN to take a big crap on all your stupid filtering.
With Mikrotik products (only) yes, impossible to close the loopholes.
In todays corporate/enterprise environments, I would never use Mikrotik in a FIREWALLING/UTM context. They make extremely versatile & flexibel products with a 1000 knobs to play with (not all knobs working by the way) to solve all sorts of switching, routing & connectivity scenario’s
Price-wise … lot’s of knobs for a low price!
thanks guys for your answers.