Filtering Konten & DNS over HTTPS (DoH)

1. Keunggulan DNS over HTTPS (DoH)

Kueri DNS port 53 biasa dikirim dalam teks polos (unencrypted), sehingga rentan diintip, dibajak (*DNS Hijacking*), atau diarahkan ke internet positif ISP secara sepihak. DoH (DNS over HTTPS) mengenkripsi kueri DNS di dalam terowongan HTTPS (port 443 TCP), menjamin privasi dan keamanan penuh.

2. Konfigurasi DoH Cloudflare di RouterOS v7

# 1. Download & Import Root Certificate Resmi
/tool fetch url="https://curl.se/ca/cacert.pem" dst-path="cacert.pem"
/certificate import file-name=cacert.pem passphrase=""

# 2. Atur DoH Server Cloudflare dengan Verifikasi Sertifikat
/ip dns set use-doh-server="https://cloudflare-dns.com/dns-query" verify-doh-cert=yes doh-max-server-connections=10 allow-remote-requests=yes

# 3. Tangkal Klien Memakai DNS Eksternal (Redirect / Drop Port 53)
/ip firewall nat add chain=dstnat protocol=udp dst-port=53 in-interface=ether2-LAN-Klien action=redirect to-ports=53 comment="Force Redirect DNS to Router"
/ip firewall nat add chain=dstnat protocol=tcp dst-port=53 in-interface=ether2-LAN-Klien action=redirect to-ports=53

# 4. Blokir Kategori Situs Judi & Porno via TLS Host SNI
/ip firewall filter add chain=forward protocol=tcp dst-port=443 tls-host="*slot*" action=drop comment="Blokir Judi Slot"
/ip firewall filter add chain=forward protocol=tcp dst-port=443 tls-host="*judionline*" action=drop