4 ms·

So am I supposed now to do DPI in my home router? Will it ever be enough to block unwanted content in my network?

simcop2387 4y ago
In this case blocking outgoing traffic to port 853 would be enough, but it won't stop DNS over HTTP. I've not found a good way to deal with that one if you want to control things, other than requiring all devices support your CA and you inspect for it.
- dsr_ 4y ago
  Things that do DNS over HTTP are asked to respect the use-application-dns.net canary. If use-application-dns.net queries are blocked by the local resolver, the thing should use the local resolver, unless there is a manual override by the human user.
  - ghotli 4y ago
    First I've heard of this. Is this in a spec somewhere you happen to be aware of?
    - yagibear 4y ago
      It's mentioned in an expired Internet Draft https://www.ietf.org/archive/id/draft-schwartz-add-ddr-forwarders-01.txt https://www.ietf.org/archive/id/draft-schwartz-add-ddr-forwa... which refers to https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...
  - codedokode 4y ago
    This is a bad idea. ISPs will use this to force users to send queries in plain text. There is no need for this feature. One might say that a corporation might need this. But why should we care about corporations? Let them use Internet Explorer that sends everything in plain text. Or they could configure using unencrypted DNS in group policy. Encrypted DNS should be indistinguishable from any other HTTPS traffic.
    - dsr_ 4y ago
      Let's suppose that I have a home network, from which I make certain things available to the Internet. Those have public DNS records and appropriate ports are passed through the firewall. I also have a bunch of machines that I like to have names for, but I don't want the Internet as a whole to enumerate them. Why? Because I like my privacy. So I run my DNS in a split-horizon mode: everyone sees www and mail and blog, but only IPs inside my house get to see the A, AAAA and CNAME records for spike and splorch and sporty, den-tv and lr-tv, music and video. But then Firefox and Chrome enable DoH. I can provide DoH, no problem, though I prefer DoTLS. The problem is that they don't ask my local DNS servers via DoH, they ask 1.1.1.1 and 8.8.8.8 or such. And those servers, nice as they are, aren't allowed to see the record for den-tv. So I tell my DNS server to return an error for use-application-dns.net, and everything continues to work. Meanwhile, my friend comes over and sits in my living room, using my wifi, but my friend is paranoid. They don't trust me at all. So they use a VPN back home. Oh, sorry: they trust me enough to be their next hop, but not enough to use my DNS. So they tell their browser affirmatively that it should use DoH to somebody off in The Cloud That Is Certainly Trustworthy, and that works too.
    - noptd 4y ago
      I couldn't disagree more. I'm far more concerned about device vendors leveraging encrypted DNS in order to remove my ability to intercept and filter DNS resolution on my own network. For example, I'm sure Google and pretty much every Smart TV vendor would love it if we could no longer easily block traffic for streaming ads, sending telemetry, etc.
walrus01 4y ago
1. don't put devices with untrusted operating systems on your home network in the first place 2. if you must, put them in a quarantine vlan a better question is why you have things in your home network that might be sending encrypted dns queries outside of your control, what software or OS is doing that?
- solarist 4y ago
  I’m a naive person and believe any form of advertisement is intrusive. So by definition anything that wants to show me and my kids ads will eventually try to circumvent any filters in place.
ocdtrekkie 4y ago
So enterprise-class firewalls can presently identify and block the QUIC protocol entirely. (If you have such a firewall, I recommend this! Nothing supporting QUIC has no fallback.) Hopefully that level of intelligence will eventually make it down to at least prosumer-grade firewalls, but the folks who buy D-Link and Linksys stuff are probably out of luck.
tick_tock_tick 4y ago
That has always and will continue to be the only way. Well that and only allowing whitelist traffic.

In this case blocking outgoing traffic to port 853 would be enough, but it won't stop DNS over HTTP. I've not found a good way to deal with that one if you want to control things, other than requiring all devices support your CA and you inspect for it.

dsr_ 4y ago
Things that do DNS over HTTP are asked to respect the use-application-dns.net canary. If use-application-dns.net queries are blocked by the local resolver, the thing should use the local resolver, unless there is a manual override by the human user.
- ghotli 4y ago
  First I've heard of this. Is this in a spec somewhere you happen to be aware of?
  - yagibear 4y ago
    It's mentioned in an expired Internet Draft https://www.ietf.org/archive/id/draft-schwartz-add-ddr-forwarders-01.txt https://www.ietf.org/archive/id/draft-schwartz-add-ddr-forwa... which refers to https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...
- codedokode 4y ago
  This is a bad idea. ISPs will use this to force users to send queries in plain text. There is no need for this feature. One might say that a corporation might need this. But why should we care about corporations? Let them use Internet Explorer that sends everything in plain text. Or they could configure using unencrypted DNS in group policy. Encrypted DNS should be indistinguishable from any other HTTPS traffic.
  - dsr_ 4y ago
    Let's suppose that I have a home network, from which I make certain things available to the Internet. Those have public DNS records and appropriate ports are passed through the firewall. I also have a bunch of machines that I like to have names for, but I don't want the Internet as a whole to enumerate them. Why? Because I like my privacy. So I run my DNS in a split-horizon mode: everyone sees www and mail and blog, but only IPs inside my house get to see the A, AAAA and CNAME records for spike and splorch and sporty, den-tv and lr-tv, music and video. But then Firefox and Chrome enable DoH. I can provide DoH, no problem, though I prefer DoTLS. The problem is that they don't ask my local DNS servers via DoH, they ask 1.1.1.1 and 8.8.8.8 or such. And those servers, nice as they are, aren't allowed to see the record for den-tv. So I tell my DNS server to return an error for use-application-dns.net, and everything continues to work. Meanwhile, my friend comes over and sits in my living room, using my wifi, but my friend is paranoid. They don't trust me at all. So they use a VPN back home. Oh, sorry: they trust me enough to be their next hop, but not enough to use my DNS. So they tell their browser affirmatively that it should use DoH to somebody off in The Cloud That Is Certainly Trustworthy, and that works too.
  - noptd 4y ago
    I couldn't disagree more. I'm far more concerned about device vendors leveraging encrypted DNS in order to remove my ability to intercept and filter DNS resolution on my own network. For example, I'm sure Google and pretty much every Smart TV vendor would love it if we could no longer easily block traffic for streaming ads, sending telemetry, etc.

walrus01 4y ago

1. don't put devices with untrusted operating systems on your home network in the first place 2. if you must, put them in a quarantine vlan a better question is why you have things in your home network that might be sending encrypted dns queries outside of your control, what software or OS is doing that?

solarist 4y ago
I’m a naive person and believe any form of advertisement is intrusive. So by definition anything that wants to show me and my kids ads will eventually try to circumvent any filters in place.

ocdtrekkie 4y ago

So enterprise-class firewalls can presently identify and block the QUIC protocol entirely. (If you have such a firewall, I recommend this! Nothing supporting QUIC has no fallback.) Hopefully that level of intelligence will eventually make it down to at least prosumer-grade firewalls, but the folks who buy D-Link and Linksys stuff are probably out of luck.

tick_tock_tick 4y ago

That has always and will continue to be the only way. Well that and only allowing whitelist traffic.