Re: Detecting DoH using PF

2020-02-18 Thread Tim Baumgard
On Mon, Feb 17, 2020 at 1:19 PM Erik Lauritsen wrote: > Is a DNS over HTTPS recognizable somehow so that it can be fingerprinted > and redirected or blocked using pf? > > I am thinking about the ability of PF to detect when requests are coming from > a windows machine for example. As Paul asked,

Re: Detecting DoH using PF

2020-02-18 Thread Peter Müller
Hello *, for detecting DNS over HTTPS traffic without interfering with the connection, perhaps these articles might be helpful: - https://dshield.org/forums/diary/Is+it+Possible+to+Identify+DNS+over+HTTPs+Without+Decrypting+TLS/25616 - https://dshield.org/forums/diary/More+DNS+over+HTTPS+Become

Re: Detecting DoH using PF

2020-02-17 Thread Paul de Weerd
Hi Erik, On Mon, Feb 17, 2020 at 06:07:59PM +, Erik Lauritsen wrote: | Hi, | | Is a DNS over HTTPS recognizable somehow so that it can be fingerprinted | and redirected or blocked using pf? I haven't studied this in close detail, but since it's just a "normal" (albeit generally small) HTTPS