DoH Security Hardening - Firewall rules and certificate pinning for DNS-over-HTTPS

doh-cert-pinning.py

#!/usr/bin/env python3
# DoH Certificate Pinning for Self-Hosted Servers

import ssl
import hashlib
import base64

class SecureDoHClient:
    # ... (additional implementation details)

    return context

doh-firewall-rules.sh

#!/bin/bash
# DoH Security Hardening - Firewall Rules

# iptables rules to force DoH
# Block standard DNS (port 53) except from DoH proxy
iptables -A OUTPUT -p udp --dport 53 -m owner ! --uid-owner cloudflared -j DROP
iptables -A OUTPUT -p tcp --dport 53 -m owner ! --uid-owner cloudflared -j DROP

# Block DNS-over-TLS (port 853)
iptables -A OUTPUT -p tcp --dport 853 -j DROP

# Allow only DoH proxy to make HTTPS connections to DNS providers
iptables -A OUTPUT -p tcp --dport 443 -d 1.1.1.1 -m owner ! --uid-owner cloudflared -j DROP
iptables -A OUTPUT -p tcp --dport 443 -d 8.8.8.8 -m owner ! --uid-owner cloudflared -j DROP