01Why the router must do it
Your router gives the address of Warda to the devices, and most of them use it. But some devices write their own DNS server in their software: televisions, speakers and cameras that use 8.8.8.8 whatever the network says. A program can do the same, and so can a malware that wants to talk to its servers unseen.
Those queries never reach Warda: it cannot block them, nor even see them. Only the router, which every packet crosses on its way out, can stop them. The rule is simple: the DNS ports are open to the Warda box alone.
02The ports to close
Plain DNS uses port 53 (UDP and TCP). DNS over TLS uses port 853 over TCP, and DNS over QUIC port 853 over UDP. These are the ports a rule can close:
- allow ports 53 and 853, TCP and UDP, from the address of Warda (and its IPv6 addresses) to the Internet: Warda needs them to ask its own upstream servers, encrypted;
- refuse ports 53 and 853 from every other device of the network to the Internet;
- or, for port 53 only, redirect the queries to Warda instead of refusing them: a television with 8.8.8.8 written in it then keeps working, and is filtered.
03A generic rule
On a router running Linux (OpenWrt, a home-made router), a rule of nftables like the one below does it, with 192.168.1.53 replaced by the address of your Warda box. On pfSense, OPNsense or a router of your own, the idea is the same: a rule on the interface of the local network that lets the address of Warda through to ports 53 and 853, then a rule below it that blocks those ports for the rest of the network.
Do the same for IPv6 with the addresses of Warda: a device that asks over IPv6 goes around a rule written for IPv4 only. Many internet boxes of providers have no such firewall: a router of your own behind the box then carries the rule.
table inet warda_dns {
chain forward {
type filter hook forward priority filter; policy accept;
# 192.168.1.53: the address of Warda, the only one that may ask outside
ip saddr 192.168.1.53 accept
meta l4proto { tcp, udp } th dport { 53, 853 } reject
}
}04The limits, said plainly
A port only closes what uses it. DNS over HTTPS travels on port 443, the port of every secure site: no port rule can close it without closing the web. Warda answers this part by names: the known encrypted DNS, VPN and proxy services are blocked for the children and teenagers, and Firefox keeps the DNS of the network (it asks a test name, which Warda answers as it should).
Port 853 cannot be redirected: an encrypted query sent to Warda in place of its server would fail its certificate check. Refuse it, and most devices fall back to the DNS of the network. A VPN, last, carries everything inside its tunnel, DNS included: Warda blocks the known VPN services for minors, and with the subscription tells you about the attempts.