From mboxrd@z Thu Jan 1 00:00:00 1970 From: Tapani Tarvainen To: development@lists.ipfire.org Subject: Re: Should we block DoH by default? Date: Wed, 04 Mar 2020 12:56:45 +0200 Message-ID: <20200304105645.GA18957@tehanu.it.jyu.fi> In-Reply-To: <4E2571B2-5250-42CD-B608-0353D579E088@ipfire.org> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============6325316421878672351==" List-Id: --===============6325316421878672351== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit On Mar 04 10:11, Michael Tremer (michael.tremer(a)ipfire.org) wrote: > >> Regarding external DNS servers, IoT and similar things > >> come to my mind, which have their resolvers hard-coded in the firmware. > > > > Thinking about those, how about an option to *redirect* connections > > to port 53 of external servers to IPFire rather than rejecting them? > > Yes, we could do that for 53 UDP and TCP, but not for 853 obviously. Right. But if some IoT thingy relies on a hard-coded DNS-over-TLS server there's little we can do about it, but redirection could save the day with those that use good old 53. -- Tapani Tarvainen --===============6325316421878672351==--