Drawbacks of hosting SSL proxy to deny DoH for pihole filtering? reddit / selfhosted ---------------------------------------------------------------------- Boring-Wednesdays · 2023-09-27 02:01 I'm wanting to decrypt https traffic so that I can block DNS over https. What are the drawbacks of doing this other than not being able to verify CA certs? ---------------------------------------------------------------------- zfa · 2023-09-27 02:56 > What are the drawbacks of doing this other than not being able to verify CA certs? Main drawback is the amount of work you're going to have to do. How are you planning on blocking the DoH precisely? ---------------------------------------------------------------------- Boring-Wednesdays · 2023-09-27 03:13 Well my initial thought was to inspect SSL and just reject and pray it defaults to dchp configs. ---------------------------------------------------------------------- zfa · 2023-09-27 03:21 Yeah, I mean how will you determine what is and isn't a DNS request? Per spec there is a content type and a path but many servers respond regardless of content type and the path is definable on the client. Smells like a bit of an XY problem and you may be going down a suboptimal path tbh. ---------------------------------------------------------------------- Boring-Wednesdays · 2023-09-27 03:33 So that my I can redirect devices trying to avoid my Pihole. I've seen some talks here and there about SSL proxies being a possible solution but nothing on when people tried it. i couldn't find any more solutions to removing ads on YouTube and some apps so I thought I'd give it a shot and see if its effective. ---------------------------------------------------------------------- zfa · 2023-09-27 04:33 How many services are bypassing your pihole? Try the list linked above and have a look. Sure, it almost certainly won't catch everything but it may let you see if this is a thing. ---------------------------------------------------------------------- Boring-Wednesdays · 2023-09-27 04:39 Its just the notoriously hard ads to block. YouTube, Facebook, reddit. The only possibility I can think of the ad getting through is DoH. But every idea I can think of to circumvent it is either very involved or too complicated for a 5 second ad skip lol. I'll try out the DoH blocker and see how that works for a few days and probably shelf the idea for now. ---------------------------------------------------------------------- zfa · 2023-09-27 04:43 > Its just the notoriously hard ads to block. YouTube, Facebook, reddit. In most cases this isn't to do with them bypassing whatever network- wide adblocker you have, it's more that they serve ads fomr the same domain as their 'real' content so adlist makers can't easily block them. *Generally* one can remove the ads but it's by using a modified ap which doesn't have ad calls. Speaking only from personal experience on Android that would be ReVanced for YouTube and whatever Reddit client you use, on AndroidTV it wouls be SmartTubeNext, on Windows it'd be whatever the addon de jour is. But try blocking with that list and see if you start getting hits to the domains it uses. If you do then you could be onto something - although it's possible if you start getting hits then that blocklist is enough, providing it doesn't break anything for you. GL. ---------------------------------------------------------------------- mosaic_hops · 2023-09-28 10:29 Yes. Ads. The *real* reason DoH is now built-in to browsers. While you can block some well known public DoH services you can also set the canary domain on your network that browsers query to determine whether to use DoH or not. PiHole should offer this as a feature of they don’t already. (Google dns over https canary domain) TLS inspection is a huge pain in the butt. Many services pin certs and others ignore the system trust store meaning they will just refuse to work with TLS inspection enabled. You end up having to add half the internet to your bypass lists, completely defeating the purpose.