School Chromebook bypasses local DNS (DoH/DoT) – how to force local DNS on OPNse

[MaartenVT]

Hi everyone,

I'm hoping to get some advice on how to properly handle a managed school Chromebook on my home network powered by OPNsense and AdGuard Home.

The issue:
My son was given a school-managed Chromebook. The device appears to be hardcoded/configured via Google Admin policies to strictly use DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT).

• If I try to block or interrupt DoH/DoT traffic on my network, the Chromebook completely loses internet access and refuses to connect. It does not fall back to the local DNS servers assigned via DHCP.
• If I allow DoH/DoT, the Chromebook completely bypasses my local DNS security and filtering (AdGuard Home).

What I've considered/tried so far:

• I have completely disabled IPv6 on my local network (LAN is IPv4-only).
• I know the device's IP and MAC address.
• I could put the Chromebook into a dedicated VLAN to isolate it from the rest of my home network, but that doesn't solve the issue of filtering the traffic originating from the Chromebook itself.
• Dropping standard DoH/DoT IP lists or blocking port 853 / known DoH endpoints causes the device to report "No Internet".

Has anyone successfully dealt with strictly managed ChromeOS devices on OPNsense? Is there a recommended approach (e.g. specific NAT port forwards, blocking specific canary domains, or handling ChromeOS network checks) to force local DNS usage without breaking its internet connectivity?

Thanks in advance for any insights!

Best regards,

Maarten

[meyergru]

That is a collision of interest of the purest kind.

You can block DoT/DoH, but obviously, you cannot intercept and modify that traffic, because it is encrypted and protected via certificates. Normally, such an approach would be used in conjunction with a traffic interception of normal, unencrypted DNS traffic to be able to block certain DNS domains. If anyone wants to use your network, he must fall back to standard DNS in such a scenario, i.e. abide by your imposed rules.

If you want to give a device internet access that does not play by those rules, you can, but then you cannot block DoT/DoH, as you have seen.
In that case, I would put that device into a separate VLAN (probably also a separate WLAN), such that it can do whatever it chooses, but has no possibility to access any of your own LAN ressources. Of course, you can allow specific services, like accessing a printer.

Or to put it short: You cannot have the cake and eat it, too.

BTW: If there was a canary domain, you would be able to see a DNS request (and, obviously, it would be via normal DNS).

Since Chromium deliberately chose not to implement a Firefox-style canary domain, there is no DNS-side mechanism to force such a fallback; and if the Chromebook is managed by the school, the DoH-only setting is most likely policy-locked anyway.

[Monviech (Cedrik)]

If DNS cannot be inspected the next step up is SNI for (most) TLS traffic, which is still unencrypted most of the time (though encrypted SNI is slowly coming too).

Zenarmor might be able to do that style of blocking.

[MaartenVT]

Thanks for the clear explanation! That clarifies why the Chromebook behaves this way.

Since ChromeOS indeed lacks a canary domain mechanism like Firefox and the school policy locks DoH/DoT, forcing local DNS on this device seems virtually impossible without breaking its internet connection.

Maybe I will follow your advice and put the Chromebook into a dedicated, isolated VLAN (with its own SSID) to ensure it has internet access while keeping it completely segregated from my local network devices.

Thanks again for helping me understand the limitations here!

But personally I think that this is such a weird implementation. I cannot monitor or filter what my kid is accessing on my own home network, simply because it's a school-managed Chromebook. It's just such a pain in the *** (pinky)...

[cookiemonster]

The same goes for some corporate devices. I work for government now. The laptops issued for when working away from the office like when working from home, it connects to my home wifi but it automatically connects only to an always-on vpn and local networks aren't routable. No home printing for instance.
The similarity is that they are regulated groups, and their endpoint security must be able to inspect all traffic regardless of location. That is why you can't modify DNS settings on them.

[nero355]

The same goes for some corporate devices.

I told him that more or less already @ https://forum.opnsense.org/index.php?topic=53056.msg275061#msg275061 but he wanted to check if someone happens to know any workarounds in the English part of the forum :)

My last advice would be :
- Buy a second hand/used quality laptop.
They can be pretty cheap!
- Configure it however you want so you are in control and/or can spy on the kiddo...
- Tell the kiddo it's BRAND NEW!

Aaaaand DONE! :)

[Patrick M. Hausen]

If the Chromebook is school managed I would trust them to a certain degree to put proper protection in place and just isolate the device from the rest of the network.

What would he do with that second hand laptop? My very educated bet is that the school managed device is 100% mandatory for any school related work.

[nero355]

What would he do with that second hand laptop?

It was meant as an option to be able to monitor his network traffic while using a device for 'non-school things' so to speak...

[Greg_E]

I would try putting it on it's own vlan, and then install the free Zenarmor and have it monitor that new vlan and see what you can see. ZA is supposed to monitor/filter by SNI, so you might get somewhere with that.

I'd also be asking the school where the students are allowed and not allowed to go, in theory they can make adjustments to settings based on your needs. If they don't like it, then maybe time to deliberately go to bad sites, record all of it, and pass the info off to local news agencies.

[nero355]

If they don't like it, then maybe time to deliberately go to bad sites, record all of it, and pass the info off to local news agencies.

LOL! That's seriously EVIL! LOVE IT!!! ^_^

[MaartenVT]

Lol, That is evil idd.

I will try the Zenarmor once more to try and monitor what goes on, on my network.

Thanks for all the input!

[Greg_E]

Sometimes the over the top method is required to get people in schools to move. To be fair, they may not have the staffing to handle this and may be relying on the "magic of the chromebook" to keep the students safe, or on a vendor to create the settings (HP, Dell, etc.).

Examples of places to go are pron sites and gaming torrents to steal games, sports betting and other online gambling sites would also be good examples. I would not suggest trying to go to places that could result in an investigation, you can use your imagination to figure out my reference.

Also see if you can install additional software on the chromebook, things like other browsers that haven't been forced into safe search mode.

And don't forget to record all of it and make sure the screen is clearly visible so that everyone can see the address and content that appears.

[Patrick M. Hausen]

Sometimes the over the top method is required to get people in schools to move. To be fair, they may not have the staffing to handle this and may be relying on the "magic of the chromebook" to keep the students safe, or on a vendor to create the settings (HP, Dell, etc.).

Also see if you can install additional software on the chromebook, things like other browsers that haven't been forced into safe search mode.

I can't see why you would want to do that. This is a school owned, school provided, school managed device handed to minors. It's their job to put reasonable protections (which cannot be perfect, but more or less good enough) in place.

If they fail, hold them accountable.

But why would you want to do their job by implementing additional protection via your OPNsense? That will never work for students and parents who are not that technically savvy. Or even manipulate the device ... heck no! They might even sue you. What is there to prove? You can only lose.

Monitor what your child is viewing and doing. Talk to your child. If there is anything not acceptable, turn to the school. But again, don't meddle in what is 100% their job - and their prerogative, because it is their device. I would not touch it. Isolate it in its own SSID and VLAN if you fear their device management software might spy on your network.

Kind regards,
Patrick

[Greg_E]

Installing other software proves that the restrictions are not in place. You have to catch something in order to report back to the school. And if you are really concerned, you need to be proactive and try to find issues, because the IT team will never think of everything, there is always another loop hole that needs to be closed.

[Patrick M. Hausen]

Sorry, no. Unless I am paid for it this is not my affair to meddle with and not my job. And yes, I have a son, turning 23 in a couple of days, but of course I still know how one might feel about Internet access etc. for kids.

If I did not completely miss the point The OP did not start the discussion stating he does not trust the device, only that it circumvents his local DNS filters by forcing DoH/DoT.

If I was in the position of the school I would certainly do exactly that forcing my or my contractor's DNS server with my filtering in place. Maybe even force everything through a VPN.

So I would *ask* the school how they are protecting their students before dabbling in technical measures that are (IMHO) absolutely none of my business.