5 ms·
> I set up piHole to try to prevent this but nothing stops it from phoning home via a direct IP. what exactly do you mean? I tought piHole sits "between" the t
by merb 6y ago
> I set up piHole to try to prevent this but nothing stops it from phoning home via a direct IP.
what exactly do you mean? I tought piHole sits "between" the tv and your modem?
I mean it probably can easily firewall those ips.
Edit: nvm PiHole is only a dns thingy.
- paranoidrobot 6y agoPiHole is for DNS blocking. So if say your TV calls out to backdoor.example.com - then PiHole can block it. If instead it calls out to 1.2.3.4 (i.e no DNS lookup) - then PiHole won't block it for you, you'd have to instead set up controls on the firewall/router/etc to filter traffic.
- pixl97 6y agoJust wait till all the smart devices come with a preloaded DoT/DoH list.
- shagie 6y agoThat would be this thread - https://mailarchive.ietf.org/arch/msg/dnsop/WCVv57IizUSjNb2RQNP84fBclI0/ https://mailarchive.ietf.org/arch/msg/dnsop/WCVv57IizUSjNb2R... and this post https://news.ycombinator.com/item?id=19170671 https://news.ycombinator.com/item?id=19170671
- rasz 6y agorecycling my comment from Mozilla DoH story: Wanted: Firewall blocking all traffic directed at IP addresses not obtained from OS DNS resolver. aka dynamic application level FQDN Egress Filtering. Mayor Cloud providers (aws, azure) and bigger firewalls (fortinet, cisco, paloalto) already offer ~half of what I want. I want a little deamon that listens for DNS queries/replies and modifies firewall rules accordingly.
- daniellarusso 6y agoAlso, the other risk is the device not respecting what your router says to use for the DNS server. So, it could still bypass piHole and still resolve hostnames.
- tsjq 6y agoThis is more crazy. Is this achieved by hardcoding the DNS server IP address in the device?
- tbihl 6y agoMore likely the destination IP address is hard coded, so no name resolution is ever required.
- EvanAnderson 6y agoChromecast devices (some? all?) have Google's public DNS servers hard coded. Paul Vixie wrote a nice rant about catching these devices trying to bypass his local DNS servers.
- rasz 6y agoAll Chrome based browsers have 8.8.8.8 8.8.4.4 hardcoded under the guise of "helping resolve navigation errors", except its not helping anyone but Google in gathering statistics. Domains like hls.ttvnw.net (no A record) receive perfectly valid DNS reply (NOERROR, response code 0, DNS Query completed successfully) but trigger this feature and call hardcoded Google DNS resolver. Even domains that dont exist at all and browser receives valid response (NXDOMAIN, response code 3, Domain name does not exist) trigger to snitch on the user to hardcoded Google DNS resolver. No errors, google called.
- t-writescode 6y agoThere was a version of Awair devices that used 8.8.8.8 for DNS, no matter my pihole. At the router level, I then forced all 8.8.8.8 traffic to be transformed into traffic to my pihole. You can do the next step, but you need a router that supports it and the patience to handle it. You shouldn’t need to do this.