# Blocking External Client DNS Queries

# Blocking External Client DNS Queries

This procedure configures the firewall to block DNS requests from local clients to servers outside the local network. With no other accessible DNS servers, clients are forced to send DNS requests to the DNS Resolver or DNS Forwarder on pfSense® software for resolution.

Note

Blocking is effective but does not gracefully handle the situation. Clients must manually adjust their configuration to use the firewall for DNS. Redirecting DNS requests to the firewall is a more seamless solution. See [<span class="doc">Redirecting Client DNS Requests</span>](https://docs.netgate.com/pfsense/en/latest/recipes/dns-redirect.html) for details.

- Navigate to **Firewall &gt; Rules**, **LAN** tab
- Create the block rule as the first rule in the list:
    
    
    - Click ![fa-level-up](https://docs.netgate.com/pfsense/en/latest/_images/fa-level-up.png) **Add** to create a new rule at the top of the list
    - Fill in the following fields on the rule:
        
        <dl class="field-list simple"><dt class="field-odd">Action</dt><dd class="field-odd">*Reject*
        
        </dd><dt class="field-even">Interface</dt><dd class="field-even">*LAN*
        
        </dd><dt class="field-odd">Protocol</dt><dd class="field-odd">*TCP/UDP*
        
        </dd><dt class="field-even">Destination</dt><dd class="field-even">*Any*
        
        </dd><dt class="field-odd">Destination Port Range</dt><dd class="field-odd">*DNS (53)*
        
        </dd><dt class="field-even">Description</dt><dd class="field-even">`<span class="pre">Block</span> <span class="pre">DNS</span> <span class="pre">to</span> <span class="pre">Everything</span> <span class="pre">Else</span>`
        
        </dd></dl>
- Create the pass rule to allow DNS to the firewall, above the block rule:
    
    
    - Click ![fa-level-up](https://docs.netgate.com/pfsense/en/latest/_images/fa-level-up.png) **Add** to create a new rule at the top of the list
    - Fill in the following fields on the rule:
        
        <dl class="field-list simple"><dt class="field-odd">Action</dt><dd class="field-odd">*Pass*
        
        </dd><dt class="field-even">Interface</dt><dd class="field-even">*LAN*
        
        </dd><dt class="field-odd">Protocol</dt><dd class="field-odd">*TCP/UDP*
        
        </dd><dt class="field-even">Destination</dt><dd class="field-even">*LAN Address*
        
        </dd><dt class="field-odd">Destination Port Range</dt><dd class="field-odd">*DNS (53)*
        
        </dd><dt class="field-even">Description</dt><dd class="field-even">`<span class="pre">Pass</span> <span class="pre">DNS</span> <span class="pre">to</span> <span class="pre">the</span> <span class="pre">Firewall</span>`
        
        </dd></dl>
- Click ![fa-check](https://docs.netgate.com/pfsense/en/latest/_images/fa-check.png) **Apply Changes** to reload the ruleset

When complete, there will be two rule entries that look like the following picture:

![../_images/blockdns.png](https://docs.netgate.com/pfsense/en/latest/_images/blockdns.png)

Certain local PCs could be allowed to use other DNS servers by placing a pass rule for them above the block rule.

<div class="section" id="bkmrk--1"><span id="bkmrk--2"></span></div>## DNS over TLS

Another concern is that clients could use DNS over TLS to resolve hosts. DNS over TLS sends DNS requests over an encrypted channel on an alternate port, `<span class="pre">853</span>`.

This traffic can be blocked with a firewall rule for port `<span class="pre">853</span>` using the same procedure used for `<span class="pre">53</span>`. Though if the firewall will not be providing DNS over TLS service to clients, do not add the pass rule.

<div class="section" id="bkmrk--3"></div><div class="section" id="bkmrk--4"><span id="bkmrk--5"></span></div>## DNS over HTTPS

Similar to DNS over TLS, clients may also use DNS over HTTPS (DoH). This is harder to block as it uses port `<span class="pre">443</span>`. Blocking port `<span class="pre">443</span>` on common public DNS servers may help (e.g. `<span class="pre">1.1.1.1</span>`, `<span class="pre">8.8.8.8</span>`).

Some browsers automatically attempt to use DNS over HTTPS because they believe it to be more secure and better for privacy, though that is not always the case. Each browser may have its own methods of disabling this feature. Firefox uses a “canary” domain `<span class="pre">use-application-dns.net</span>` by default. If Firefox cannot resolve this name, Firefox disables DNS over HTTPS.

To prevent Firefox from using DNS over HTTPS, add the following to the DNS Resolver custom options:

```
server:
local-zone: "use-application-dns.net" always_nxdomain
```