4 ms·

Not exactly what you’re asking but dnscrypt-proxy has IP based block lists. You list IPs and then any domain that resolves to one of those IPs is blocked. Works

by varenc 6y ago

Not exactly what you’re asking but dnscrypt-proxy has IP based block lists. You list IPs and then any domain that resolves to one of those IPs is blocked. Works when companies setup domains that actually resolve to some 3rd party data tracker. Actually blocking IPs as you’ve said is a harder problem sadly.

vladvasiliu 6y ago
Why? If the devices use hardcoded IPs, then those should be fairly static so fairly easy to maintain in some list. I'd think that the best workaround for doing these kinds of shenanigans will be using some form of DoH, in which case the countermeasure would be to set up an HTTP proxy which wouldn't allow http connections to "naked" IP addresses.
- buran77 6y ago
  Blocking the IP means having something in the traffic flow. This would likely be a firewall if your aim is to block any "weird" connection from your network. But both firewalls and proxies are substantially more challenging than your run of the mill RaspberryPi Zero and PiHole.
  - squarefoot 6y ago
    That would be the goal. Malicious actors aren't going away anytime soon, so I would expect more and more devices in the future to use either encrypted or off standard DNS queries to different ports, if not downloading ads and uploading telemetry disguised as system upgrades. We'll likely get to a point in which we'll need to block connections address by address, in the hope they won't set up their malware on addresses and ports we can't block to keep the device functionality.
- varenc 6y ago
  DNS based block lists are incredibly easy to implement and maintain and require very little resources. All of the complaints from corporate IT admins about DoH demonstrate this. (I believe Chrome still won't default to DoH for corporate managed browsers) Any normal home users can setup dnscrypt-proxy or PiHole and have it 'protect' their whole home network, but actually filtering your whole network's traffic based on IP is out of reach for most.

by varenc 6y ago

vladvasiliu 6y ago

Why? If the devices use hardcoded IPs, then those should be fairly static so fairly easy to maintain in some list. I'd think that the best workaround for doing these kinds of shenanigans will be using some form of DoH, in which case the countermeasure would be to set up an HTTP proxy which wouldn't allow http connections to "naked" IP addresses.

buran77 6y ago
Blocking the IP means having something in the traffic flow. This would likely be a firewall if your aim is to block any "weird" connection from your network. But both firewalls and proxies are substantially more challenging than your run of the mill RaspberryPi Zero and PiHole.
- squarefoot 6y ago
  That would be the goal. Malicious actors aren't going away anytime soon, so I would expect more and more devices in the future to use either encrypted or off standard DNS queries to different ports, if not downloading ads and uploading telemetry disguised as system upgrades. We'll likely get to a point in which we'll need to block connections address by address, in the hope they won't set up their malware on addresses and ports we can't block to keep the device functionality.
varenc 6y ago
DNS based block lists are incredibly easy to implement and maintain and require very little resources. All of the complaints from corporate IT admins about DoH demonstrate this. (I believe Chrome still won't default to DoH for corporate managed browsers) Any normal home users can setup dnscrypt-proxy or PiHole and have it 'protect' their whole home network, but actually filtering your whole network's traffic based on IP is out of reach for most.