3 ms·

Some devices started to use hardcoded IPs to phone home, so purely domain name based blocklists won't work with them. Is there a similar project with upgradable

Some devices started to use hardcoded IPs to phone home, so purely domain name based blocklists won't work with them. Is there a similar project with upgradable IP lists to deal with them too? That would be technically a firewall, but then ideally it should also implement DNS based blocking since we're protecting also from the inside. It would be a nice product to build around any of those ARM small boards with dual Ethernet and WiFi such as the NanoPi R1 and similar ones.

varenc 6y ago
Not exactly what you’re asking but dnscrypt-proxy has IP based block lists. You list IPs and then any domain that resolves to one of those IPs is blocked. Works when companies setup domains that actually resolve to some 3rd party data tracker. Actually blocking IPs as you’ve said is a harder problem sadly.
- vladvasiliu 6y ago
  Why? If the devices use hardcoded IPs, then those should be fairly static so fairly easy to maintain in some list. I'd think that the best workaround for doing these kinds of shenanigans will be using some form of DoH, in which case the countermeasure would be to set up an HTTP proxy which wouldn't allow http connections to "naked" IP addresses.
  - buran77 6y ago
    Blocking the IP means having something in the traffic flow. This would likely be a firewall if your aim is to block any "weird" connection from your network. But both firewalls and proxies are substantially more challenging than your run of the mill RaspberryPi Zero and PiHole.
    - squarefoot 6y ago
      That would be the goal. Malicious actors aren't going away anytime soon, so I would expect more and more devices in the future to use either encrypted or off standard DNS queries to different ports, if not downloading ads and uploading telemetry disguised as system upgrades. We'll likely get to a point in which we'll need to block connections address by address, in the hope they won't set up their malware on addresses and ports we can't block to keep the device functionality.
  - varenc 6y ago
    DNS based block lists are incredibly easy to implement and maintain and require very little resources. All of the complaints from corporate IT admins about DoH demonstrate this. (I believe Chrome still won't default to DoH for corporate managed browsers) Any normal home users can setup dnscrypt-proxy or PiHole and have it 'protect' their whole home network, but actually filtering your whole network's traffic based on IP is out of reach for most.
pkulak 6y ago
Some routers (DD-WRT I think?) now can hijack any non-encrypted DNS queries and send them where you want. That will be my next step.
- mcspiff 6y ago
  Yup, with the Adblock package on openwrt this was a one click option in the GUI. Doesn’t help with DoH unfortunately, but it definitely helps in general.
- deagle50 6y ago
  You can DNAT outbound port 53 connections to an internal server. Any router/firewall with configurable NAT can do this. This is a must with some smart TVs for example.
- pdimitar 6y ago
  My Mikrotik router does this easily. You can tell it (with a Firewall NAT rule) "any outbound connection to port 53 is to be redirected to this internal IP and port" -- and this internal IP and port is where my PiHole is.

varenc 6y ago

Not exactly what you’re asking but dnscrypt-proxy has IP based block lists. You list IPs and then any domain that resolves to one of those IPs is blocked. Works when companies setup domains that actually resolve to some 3rd party data tracker. Actually blocking IPs as you’ve said is a harder problem sadly.

vladvasiliu 6y ago
Why? If the devices use hardcoded IPs, then those should be fairly static so fairly easy to maintain in some list. I'd think that the best workaround for doing these kinds of shenanigans will be using some form of DoH, in which case the countermeasure would be to set up an HTTP proxy which wouldn't allow http connections to "naked" IP addresses.
- buran77 6y ago
  Blocking the IP means having something in the traffic flow. This would likely be a firewall if your aim is to block any "weird" connection from your network. But both firewalls and proxies are substantially more challenging than your run of the mill RaspberryPi Zero and PiHole.
  - squarefoot 6y ago
    That would be the goal. Malicious actors aren't going away anytime soon, so I would expect more and more devices in the future to use either encrypted or off standard DNS queries to different ports, if not downloading ads and uploading telemetry disguised as system upgrades. We'll likely get to a point in which we'll need to block connections address by address, in the hope they won't set up their malware on addresses and ports we can't block to keep the device functionality.
- varenc 6y ago
  DNS based block lists are incredibly easy to implement and maintain and require very little resources. All of the complaints from corporate IT admins about DoH demonstrate this. (I believe Chrome still won't default to DoH for corporate managed browsers) Any normal home users can setup dnscrypt-proxy or PiHole and have it 'protect' their whole home network, but actually filtering your whole network's traffic based on IP is out of reach for most.

pkulak 6y ago

Some routers (DD-WRT I think?) now can hijack any non-encrypted DNS queries and send them where you want. That will be my next step.

mcspiff 6y ago
Yup, with the Adblock package on openwrt this was a one click option in the GUI. Doesn’t help with DoH unfortunately, but it definitely helps in general.
deagle50 6y ago
You can DNAT outbound port 53 connections to an internal server. Any router/firewall with configurable NAT can do this. This is a must with some smart TVs for example.
pdimitar 6y ago
My Mikrotik router does this easily. You can tell it (with a Firewall NAT rule) "any outbound connection to port 53 is to be redirected to this internal IP and port" -- and this internal IP and port is where my PiHole is.