Lio Rega Yes you can. Or preferably with a better FQDN blocklist but the mechanism remains the same.

Lio Rega Hi, I wouldn't really know of any better non-commercial solution available. You can of yourse use something like pihole but this is only on DNS level. If you have a real IDS/IDP it's certainly a different kind of game.

Mark Thanks. The list is a bit too agressive for IP level blocking but certainly extensive and more up to date.

Mark Yeah the list might not be update anymore. If you know a better on let me know.

Because DoH uses port 443 which cannot be blocked in general for obvious reasons. I do what you suggest already - block DNS port 53.

Welcome, glad it was useful for you.

Hi, it does technically work but might be a bit overkill for just ad blocking. I personally would go with Pi Hole for that. You would have to keep in mind that you don't exceed the limit of maximum firewall table entries of OPNsense in Firewall -> Settings -> Advanced or increase it. The list format is simple, one entry per line as this one here: https://gist.githubusercontent.com/ckuethe/f71185f604be9cde370e702aa179fc2e/raw/53fe52046836ac3009e9505b7b8b8b5de42d84e3/doh-blocklist.txt Native Pi Hole lists seem to have a different format, adguard should be the same format from quickly checking it.