School Chromebook bypasses local DNS (DoH/DoT) – how to force local DNS on OPNse

[yourfriendarmando]

I posted toward the end of this thread, which is admittedly, a bit complicated, but mainly involves the part you're asking about, the circumvention.

With a few choice aliases loaded from URLs, it will populate with CIDR blocks of servers that are known by their sources, that are known to host DNS services of classic and modern types (UDP, DoH, DoT, etc).

The easiest part is blocking port 853 UDP and TCP.
The second easy part is redirecting UDP 53 back to the Firewall or other local DNS server.
A rule using the specified aliases, will reduce the chances devices will reach a server via HTTPs or TLS.

It isn't perfect, but keeps devices (iOS, Android, ChromeOS) and browsers from reaching DNS via alternate means.

https://forum.opnsense.org/index.php?topic=9245.150

Love

A3