Locking down DNS on a Linux network - catching all the bypass methods

If you're running a Linux-based DNS filter (AdGuard Home, Pi-hole, Unbound, whatever), your devices are probably bypassing it right now.

I discovered my Google Home was ignoring DHCP and going straight to 8.8.8.8. Browsers were wrapping queries in DNS-over-HTTPS. Android apps were connecting to hardcoded DNS IPs, skipping resolution entirely. My resolver was sitting there doing nothing.

Built a 5 layer defense using OPNsense + AdGuard Home + Unbound to catch most of it:

• NAT redirect port 53 traffic to force it through the local resolver
• Block port 853 outbound to kill DoT and DoQ
• HaGeZi's blocklist to catch DoH provider hostnames at the resolver level
• IP-level firewall blocks against known public DNS resolvers on all ports
• Monitoring to catch what slips through

The one thing I couldn't fully solve: Meta bundles their DoH into their regular CDN. Blocking it breaks Facebook and Instagram entirely. That's a tradeoff you have to decide for yourself.

Full writeup with the implementation details: https://blog.dbuglife.com/locking-down-dns-on-your-home-network/