In general official OpenWRT guide (link) have following recommendations:
Block DoT
uci -q delete firewall.dot_fwd
uci set firewall.dot_fwd="rule"
uci set firewall.dot_fwd.name="Deny-DoT"
uci set firewall.dot_fwd.src="lan"
uci set firewall.dot_fwd.dest="wan"
uci set firewall.dot_fwd.dest_port="853"
uci set firewall.dot_fwd.proto="tcp udp"
uci set firewall.dot_fwd.target="REJECT"
uci commit firewall
service firewall restart
Redirect DNS
# Configure firewall
uci set firewall.dns_int.name="Redirect-DNS"
uci set firewall.dns_int.dest_ip="192.168.2.2"
uci commit firewall
service firewall restart
# Configure network
uci add_list network.lan.ipaddr="192.168.2.1/24"
uci commit network
service network restart
So the main discussion is:
If created separate subnet for DNS will it increase stability and security?
If DoT blocked on router, can I ensure that all DNS traffic resolved on router and router pass all traffic via Wireguard (to hide DND requests from ISP)
WebRTC under question. Should (and can it?) be blocked on router to prevent IP leak?
Generally I need clients to force use my DNS which will be resolved through VPN to avoid any information leak to ISP.
I think many people get confused between VPN using a client app on the PC and using VPN by router.
For example, WebRTC: Your PC canât leak data by its real IP because it does not know about it. From the view of the PC, nothing changed while using the router as VPN - but there is no way to produce a leak. Leaking could be possible using a VPN app, but not by routing everything using a router.
I donât see any reason why creating an additional subnet for DNS should be 1. a necessary and 2. a good thing. The manual you found isnât for GL devices and does not make sense in any way. Just ignore it.
Blocking DoT does not make any sense either. Yes, it might leak your used DNS server - but it wonât leak your location. And there are plenty of ways to make DNS requests to the internet without using DoT. (By using DoH for example, which you simply canât block)
No. Itâs not powerful enough, nor does OpenWrt provide this feature out of the box.
There are solutions like Installing Netify on OpenWrt but for me this does not sound like a real way of getting a ârealâ firewall.
You can try to ban as much as possible - but as I said before, devices can freely decide if they will use your router as a DNS resolver or if they donât.
Just enable DNS rewriting (âOverride DNS Settings for All Clientsâ), which will take care of most things - and ignore all others since itâs lost time.
Since DoH will use HTTPs you canât block it.
You can try to block as much as possible but there is always a way around it. As soon as an device uses DoH it will be able to get around your AdGuard DNS.
