Little Snitch / Lulu seem to disable DNS over HTTPS / TLS

[paulmillr]

Seems like a bug

[martafolf]

Seems like a bug

Hey, is this why every time I try to enable it, it ignores the command? That makes sense! Been trying to figure this out for weeks! 😱

[sebdanielsson]

Same for me. Anyone got a workaround?

[georgysavva]

Hi guys! I've run into the same problem.

[NightMachinery]

How do I disable Lulu so that DoH works? Do I need to remove the app completely?

[martafolf]

There is a workaround for having a DNS-Over-HTTPS implementation on a Mac device whilst at the same time running LuLu or Little Snitch which I found, this is using a project called DNSCrypt, which maintains a proxy server which can be run locally to forward the traffic to DNS-Over-HTTPS providers.

Link to project: https://github.com/DNSCrypt/dnscrypt-proxy

Unfortunately however, it looks like some of the more fancy features like domain-based rules (at least on Little Snitch) seem to rely on being able to intercept and see these DNS requests as they happen, and when such a proxy is used, all of these rules very quickly fail to match, giving you a flurry of requests to allow connections to seemingly random IP's.

So overall, so far I haven't had the best experience with running DNS-Over-HTTPS systemwide on a Mac, the best solution I found is to continue running it on the network the Mac connects to, i.e. on a router or similar.

Looking forward to seeing some compatibility between Little Snitch / LuLu and these native DNS profiles, wether by them doing something, or Apple patching this bug which prevents them from being activated when these other products are active at the same time.

[georgysavva]

@marcoslater does it mean that even after Apple fixes the bug and we will be able to run native encrypted DNS profile together with Little Snitch the domain-based filters won't work in Little Snitch and more importantly, we won't be able to see to which domain the app is making a request in the alert pop-up. I mean that situation won't change either it's a native encrypted DNS profile or third-party DNSCrypt proxy?

[martafolf]

@georgysavva Not necessarily. My above workaround has that effect, but it may not mean that the native way does.

It all depends at what point the system encrypts the queries, and if that is before or after Little Snitch/LuLu intercept them to figure out hostname/ip's. Honestly, how these products do it and at what stage is a bit of a mystery to me, I haven't found the time to dig into that subject and see the inner workings.

But anyhow, no one can really check or test until the MacOS bug preventing it from working is resolved, I guess we'll see once that happens. 😄

[georgysavva]

@marcoslater I see, thanks for explaining this to me. Let's wait for the apple fix then!

[arnaud-devops]

Is that bug been reported to Apple?

[georgysavva]

Is that bug been reported to Apple?

Yes, I've done that.

[TraderStf]

After lots of research and tests, I finally choose a simple, reliable and effective solution nextdns (link with my affiliate), it handles all, web interface to manage everything, famous block lists, White/Black user list, logs (optional), all OS, via curl... free 300.000 requests/month, can be set on router or per device.

Works perfectly well, easy to white list, just check your log on the site.
The log can also indicates which device has issue a request.

I have tried a lot but the problem is always when you need something that's blocked, here it takes one copy paste from the log into the whitelist.

https://freakoff

A small tip, check the domain which are very often requested on the logs, for example my TV check netflix every minute!
I don't even use netflix! Same for phone, computer...

Block them in the router or private/etc/host file.
In host file use 0 and ::1 to block IP4 and 6!!! too

Here is a huge list of misc. DNS providers
https://0000

[TraderStf]

Sorry, was not my intention, just tried to provide a solution which solves all the problem of other tools. Sorry again.