DNS bypass methods and a layered defense to catch them

Spent some time mapping out all the ways devices on a network bypass local DNS resolvers, and built a layered defense for it.

The bypass methods: hardcoded DNS (devices ignoring DHCP), DNS-over-HTTPS on port 443, DNS-over-TLS on port 853, DNS-over-QUIC on UDP 853, and apps that skip DNS entirely by connecting to hardcoded IPs.

The defense I built on OPNsense + Unbound:

• NAT redirect all port 53 traffic to the local resolver
• Block TCP/UDP 853 outbound (kills DoT and DoQ)
• Use HaGeZi's DoH/DoT blocklist in the resolver to block known DoH provider hostnames
• Firewall rules blocking known public DNS resolver IPs (Google, Cloudflare, Quad9, etc.) on all ports

The hard part: Meta bundles their DoH traffic into the same CDN infrastructure that serves Facebook and Instagram content. You can't block the DNS traffic without breaking the apps. Similar patterns are showing up with other large providers.

Wrote up the full implementation with the specific rules and order of operations: https://blog.dbuglife.com/locking-down-dns-on-your-home-network/