Skip to main content

DNS Whac-A-Mole


When configuring and operating a LAN the DNS variants of DoT (DNS over TLS) and DoH (DNS over HTTPS) are a pain as they bypass the normal DNS policies and usage agreements.

So the solution is to Whack them. The result is the fail back to normal DNS and policy implementations.

The first wack is to constrain DoT. Here we go:

/sbin/iptables -i br0 -I FORWARD 1 -p tcp --destination-port 853 -j DROP

The next is DoH. Its more complex. DoH requires at least one valid DNS call and therein lies the path to mess with it. On DNSMASQ you can signal via the canary domains by doing this:


You can also apply a custom hosts file like this:

And to really miss with it you can:

/sbin/iptables -i br0 -I FORWARD 1 -d,,,,, -p tcp --destination-port 443 -j DROP
This article was originally published over in LinkedIn: DNS Whac-A-Mole


Popular posts from this blog

LDWin: Link Discovery for Windows

LDWin supports the following methods of link discovery: CDP - Cisco Discovery Protocol LLDP - Link Layer Discovery Protocol Download LDWin from here.

Battery Room Explosion

A hydrogen explosion occurred in an Uninterruptible Power Source (UPS) battery room. The explosion blew a 400 ft2 hole in the roof, collapsed numerous walls and ceilings throughout the building, and significantly damaged a large portion of the 50,000 ft2 building. Fortunately, the computer/data center was vacant at the time and there were no injuries. Read more about the explosion over at hydrogen tools here .

STG (SNMP Traffic Grapher)

This freeware utility allows monitoring of supporting SNMPv1 and SNMPv2c devices including Cisco. Intended as fast aid for network administrators who need prompt access to current information about state of network equipment. Access STG here (original site) or alternatively here .