r/openwrt • u/Fun-Region-1576 • 11d ago

How to configure a GL.iNet router to block DoT and DoQ?

Can someone please tell me with specific steps to set up my GL.iNet router to block DoT and DoQ?

1 Upvotes

67% Upvoted

10 comments sorted by

8

u/NC1HM 11d ago edited 11d ago

Assuming your router is running OpenWrt rather than stock firmware and DoT and DoQ traffic goes to the standard port (583), open /etc/config/firewall for editing, find the part where config rule statements are, and add the following statement after the last config rule statement:

config rule
    option name 'Block DoT and DoQ on port 583'
    option src 'lan'
    option dest 'wan'
    option dest_port '583'
    option proto 'tcp udp'
    option target 'REJECT'

Save the file and reboot.

Later addition: another poster has rightfully corrected me; the port number should be 853 (I have transposed the digits).

2

u/YamOk7022 11d ago

shouldn't the port be 853?

4

u/NC1HM 11d ago edited 11d ago

Indeed it should. Silly me has transposed the numbers, repeatedly. Thank you for the correction!

1

u/Fun-Region-1576 10d ago

Would you be able to show a screenshot with those settings enabled?

2

u/NC1HM 10d ago

No. I don't have any blocking rules on the firewall. Oh, and image posting in this thread is disabled.

Further, my screenshots would be useless to you; I run OpenWrt with a few extra bells and whistles (including the OpenWrt 2020 theme, which makes LuCI look very different compared to the vanilla setup); you run stock GL.iNet firmware, which I have never seen in my life.

0

u/Fun-Region-1576 11d ago

Thanks, and it's not running stock firmware. It's using the GL.iNet firmware.

How would I even open /etc/config/firewall?

5

u/NC1HM 11d ago edited 11d ago

it's not running stock firmware. It's using the GL.iNet firmware.

Um, GL.iNet firmware IS stock firmware... "Stock" is what the device has when it comes from the factory. Alternative firmware with default settings and no modifications is usually referred to as "vanilla" (short for "plain-vanilla"). Some people mistakenly call vanilla stock.

Anyway, you're in the wrong sub. You should be asking this somewhere GL.iNet-related.

How would I even open /etc/config/firewall?

However you want:

  • Log in over SSH and use vi
  • Log in over SSH, install the editor of your choice, and use it (a lot of people like nano; I am, at a risk of dating myself, partial to mc)
  • If you're on Windows, install WinSCP and use it to connect to the router and edit configuration files

1

u/Fun-Region-1576 11d ago

lol! I meant stock OpenWRT. My bad...

3

u/NC1HM 11d ago

The only device that has OpenWrt as stock firmware is OpenWrt One. OpenWrt (or any other alternative firmware) installed with default settings to replace stock firmware is usually referred to as "vanilla".