3 ms·

Too bad in my country all ISPs are required by the government to intercept (or block) all dns requests except their own dns server to block any domain listed in

Too bad in my country all ISPs are required by the government to intercept (or block) all dns requests except their own dns server to block any domain listed in the national domain blocklist database. DNS on port other than 53 is still working though, so I have set up my pihole to use an upstream dns server that accept connection on a higher port and a cloudflare DoH server as a fallback (not sure why but DoH is really slow here).

sneak 6y ago
Out of curiosity, which country is that (if you're comfortable sharing)? That's a surprising policy I'd not heard of before.
- neurostimulant 6y ago
  Indonesia. The blocklist mostly contains porn sites, but the government often use it to force foreign companies to comply with their requests (e.g. putting whatsapp on the block list until they comply with the new censorship rule, etc), and also used to censor any websites that offend the government (mostly communist and anti-islamist sites). Even websites that remotely contains nsfw contents end up getting blocked. Reddit and Vimeo is still blocked, tumblr was blocked (until they banned nsfw content recently), and most surprisingly, readthedocs.org was blocked for quite a while before (I'm not even sure why it was blocked in the first place). The block list database can be accessed here, you can query a domain to see if they're blocked in Indonesia: https://trustpositif.kominfo.go.id/ https://trustpositif.kominfo.go.id/
Nextgrid 6y ago
They could've at least intercepted the requests and applied their blacklist while leaving unblacklisted requests pass through as-is (so you can still use a custom server for the non-banned domains). Not saying I'm in favour of these shenanigans at all but at least if you are forced to do it then better do it with the minimum level of interference possible.
- Kliment 6y ago
  Then you can have your client lookup blacklistedsite.com.yourdomain.com and have yourdomain.com return the record of blacklistedsite.com to bypass filtering.
  - Nextgrid 6y ago
    Just like you could register your own domain and return the record of a blacklisted website?
    - Kliment 6y ago
      Of course, but presumably the censoring dns server would never return a censored ip, regardless of domain. Whereas if you were to passthrough all non-blacklisted queries you wouldn't be able to block that, which is why no censor would ever implement it that way.
      - Firehawke 6y ago
        Which is why you'd end up implementing tunneling for your DNS requests like cloudflared provides.
Havoc 6y ago
Presumably you can just VPN through to a VPS with pihole on it?

sneak 6y ago

Out of curiosity, which country is that (if you're comfortable sharing)? That's a surprising policy I'd not heard of before.

neurostimulant 6y ago
Indonesia. The blocklist mostly contains porn sites, but the government often use it to force foreign companies to comply with their requests (e.g. putting whatsapp on the block list until they comply with the new censorship rule, etc), and also used to censor any websites that offend the government (mostly communist and anti-islamist sites). Even websites that remotely contains nsfw contents end up getting blocked. Reddit and Vimeo is still blocked, tumblr was blocked (until they banned nsfw content recently), and most surprisingly, readthedocs.org was blocked for quite a while before (I'm not even sure why it was blocked in the first place). The block list database can be accessed here, you can query a domain to see if they're blocked in Indonesia: https://trustpositif.kominfo.go.id/ https://trustpositif.kominfo.go.id/

Nextgrid 6y ago

They could've at least intercepted the requests and applied their blacklist while leaving unblacklisted requests pass through as-is (so you can still use a custom server for the non-banned domains). Not saying I'm in favour of these shenanigans at all but at least if you are forced to do it then better do it with the minimum level of interference possible.

Kliment 6y ago
Then you can have your client lookup blacklistedsite.com.yourdomain.com and have yourdomain.com return the record of blacklistedsite.com to bypass filtering.
- Nextgrid 6y ago
  Just like you could register your own domain and return the record of a blacklisted website?
  - Kliment 6y ago
    Of course, but presumably the censoring dns server would never return a censored ip, regardless of domain. Whereas if you were to passthrough all non-blacklisted queries you wouldn't be able to block that, which is why no censor would ever implement it that way.
    - Firehawke 6y ago
      Which is why you'd end up implementing tunneling for your DNS requests like cloudflared provides.

Havoc 6y ago

Presumably you can just VPN through to a VPS with pihole on it?