So I implemented a script that runs every minute (and every time a connection to a network is made) that basically checks if Cloudflare Families DoH has been set for that network and if not it sets it. Overkill, I know. But I want it to be thorough to prevent anyone bypassing the DNS somehow and I want it to be dynamic to set the DoH for any new networks so I don’t have to do it manually. It also blocks some specific sites using the hosts file.
The problem is that I noticed that when searching for websites that would be blocked by the DoH they would not show up, when I check if the DoH has been applied using ipconfig /all it would show the Cloudflare Families DNS address (1.1.1.3/ 1.0.0.3) but if I type in a specific URL of site that I KNOW should be blocked (like an adult site or torrent site), that site would actually load! On top of that I have implemented this on my laptop (Windows 11) and desktop (Windows 10). I have 3 routers in my house (2 are from one ISP, the other from another ISP). When my desktop connects to these routers this issue is not present but for my laptop the issue is present for only one router. What is going on? Why the exception?
Below is the script that sets the DoH (via a scheduled task). Would appreciate any help. I am trying to implement dnscrypt-proxy, I hope I haven’t broken anything whilst doing this.
$logPath = ""
$DoHTemplate = "https://family.cloudflare-dns.com/dns-query"
$PrimaryDNSv4 = "1.1.1.3"
$SecondaryDNSv4 = "1.0.0.3"
$PrimaryDNSv6 = "2606:4700:4700::1113"
$SecondaryDNSv6 = "2606:4700:4700::1003"
$hostsPath = ""
$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
$sitesFile = Join-Path $scriptDir "sites.txt"
if (Test-Path $sitesFile) {
# Read lines, filter out empty lines and comment lines (starting with #)
$myBlockedSites = Get-Content $sitesFile | Where-Object { $_ -match 'S' -and $_ -notmatch '^s*#' } | ForEach-Object { $_.Trim() }
} else {
$myBlockedSites = @()
}
# Target Network SSID to apply the IPv6 ban on. As this router didn't seem to be affected by the DoH so I just had the Ipv6 disabled
$targetSSID = ""
# Logging function
function Write-Log($msg) {
"$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss') - $msg" | Out-File -FilePath $logPath -Append
}
Write-Log "=================================================="
Write-Log "Starting minute-by-minute network enforcement check..."
# 1. CONTEXT EXTRACTION PHASE
# Find the primary active network adapter
$adapter = Get-NetAdapter | Where-Object {$_.Status -eq "Up"} | Select-Object -First 1
if (-not $adapter) {
Write-Log "ERROR: No active network adapter found. Exiting."
exit
}
Write-Log "Active Adapter detected: [$($adapter.Name)]"
# --- SMART SSID EXTRACTION (API FIRST -> FALLBACK TO REGEX) ---
$currentSSID = "[N/A]"
# 1. Try modern Windows API first (Does not depend on netsh text formatting/location privacy)
try {
$wlanType = Add-Type -AssemblyName PresentationCore -ErrorAction SilentlyContinue
# Query current wireless network connection profile names
$wlanProfiles = Get-NetConnectionProfile -InterfaceAlias $adapter.Name -ErrorAction SilentlyContinue
if ($wlanProfiles) {
$currentSSID = $wlanProfiles.Name
}
} catch {}
# 2. Fallback to robust Regex method if step 1 is blank or failed
if ($currentSSID -eq "[N/A]" -or [string]::IsNullOrWhiteSpace($currentSSID)) {
$wlanInfo = netsh wlan show interfaces
if ($wlanInfo -match 'SSIDs*:s*(.*)') {
$currentSSID = $Matches[1].Trim()
}
}
Write-Log "Current Connected Wireless SSID: [$currentSSID]"
# -------------------------------------------------------------
# Check if current network matches the target banned SSID
$isTargetSSID = ($currentSSID -eq $targetSSID)
# 2. ENFORCEMENT & DOH PROVISIONING PHASE
# Clear DNS cache to flush rogue entries
Clear-DnsClientCache
Set-DnsClientServerAddress -InterfaceIndex $adapter.InterfaceIndex -ResetServerAddresses
if ($isTargetSSID) {
# TARGET WI-FI MODE: Strictly disable IPv6 to prevent leakage
Write-Log "MATCH: Connected to target network [$targetSSID]. Forcing IPv6 OFF."
Disable-NetAdapterBinding -Name $adapter.Name -ComponentID ms_tcpip6 -ErrorAction SilentlyContinue
# Assign only Cloudflare Families IPv4 addresses
Set-DnsClientServerAddress -InterfaceIndex $adapter.InterfaceIndex -ServerAddresses ($PrimaryDNSv4, $SecondaryDNSv4)
Write-Log "DNS servers set to IPv4 Only: $PrimaryDNSv4, $SecondaryDNSv4"
} else {
# SAFE/OTHER NETWORK MODE: Restore full dual-stack network connectivity
Write-Log "NO MATCH: Safe network detected. Ensuring IPv6 is fully ENABLED."
Enable-NetAdapterBinding -Name $adapter.Name -ComponentID ms_tcpip6 -ErrorAction SilentlyContinue
# Assign complete IPv4 and IPv6 DNS suite
Set-DnsClientServerAddress -InterfaceIndex $adapter.InterfaceIndex -ServerAddresses ($PrimaryDNSv4, $SecondaryDNSv4, $PrimaryDNSv6, $SecondaryDNSv6)
Write-Log "DNS servers set to Dual-Stack: v4 ($PrimaryDNSv4, $SecondaryDNSv4) & v6 ($PrimaryDNSv6, $SecondaryDNSv6)"
}
# Apply system-level DoH mandatory encryption templates (Prevents router interception)
Write-Log "Locking down Windows Registry to enforce DoH mandatory encryption..."
$baseRegPath = "<PATH HERE>"
# Map both IPv4 keys (Doh) and IPv6 keys (Doh6) to enforce complete closure
foreach ($dns in @($PrimaryDNSv4, $SecondaryDNSv4)) {
$regPath = "$baseRegPathDoh$dns"
if (!(Test-Path $regPath)) { New-Item -Path $regPath -Force | Out-Null }
Set-ItemProperty -Path $regPath -Name "DohFlags" -Value 2 # Value 2 = Require DoH (Force Encryption)
}
foreach ($dns in @($PrimaryDNSv6, $SecondaryDNSv6)) {
$regPath = "$baseRegPathDoh6$dns"
if (!(Test-Path $regPath)) { New-Item -Path $regPath -Force | Out-Null }
Set-ItemProperty -Path $regPath -Name "DohFlags" -Value 2 # Value 2 = Require DoH (Force Encryption)
}
# 3. LOCAL HOSTS FILE HARDENING
Write-Log "Verifying local hosts file integrity..."
if (Test-Path $hostsPath) {
# Remove Read-Only flag temporarily to permit internal text writing
Set-ItemProperty -Path $hostsPath -Name IsReadOnly -Value $false
$hostsContent = Get-Content $hostsPath -Raw
if ($myBlockedSites.Count -gt 0) {
foreach ($site in $myBlockedSites) {
# Check if the domain is already pointing to 127.0.0.1
if ($hostsContent -notmatch "127.0.0.1s+$([regex]::Escape($site))") {
"`n127.0.0.1 $site" | Add-Content -Path $hostsPath
Write-Log "Enforced block: Added '$site' pointing to localhost loopback."
}
}
} else {
Write-Log "WARNING: sites.txt was not found or contains no valid domains to block."
}
} else {
Write-Log "CRITICAL ERROR: Windows system hosts file missing from system folder path."
}
Write-Log "Enforcement cycle finalized successfully."
Write-Log "=================================================="
