4 ms·

> but at the DNS level Isn't this a bit like taking the phone numbers out of the phone book? Sure, people can't easily look them up, but if you know the right

by mabbo 4y ago

> but at the DNS level Isn't this a bit like taking the phone numbers out of the phone book? Sure, people can't easily look them up, but if you know the right numbers, you don't need that. Or is there more than that?

Yujf 4y ago
Dns blocking is exactly like that. I don't live australia, but if I go to the piratebay for example with my isp dns I get a message it's blocked. If I change to google or cloudflare dns it works just fine
lormayna 4y ago
Several ISP have appliances that can inspect DNS traffic and redirect to a the ISP DNS. Then, even if you change DNS servers, you will be not able to reach blocked sites. The only way to bypass that, at the moment is to use DoH. Source: I have been worked for an ISP and I was in charge of that.
- politelemon 4y ago
  > Then, even if you change DNS servers, you will be not able to reach blocked sites. Is this done simply by intercepting UDP port 53 requests somehow? I've only ever had to intercept https as part of development, but have no idea how this would work for UDP. Any details you can share?
  - NavinF 4y ago
    Yep that’s exactly how it works. Not all ISPs actively intercept and reply to your queries, but the rest still monitor all port 53 traffic and log your queries. Naturally, a lot of HNers hate encrypted DoH which solves both the active MITM and passive monitoring problems. Example: https://news.ycombinator.com/item?id=25344358 https://news.ycombinator.com/item?id=25344358
    - topranks 4y ago
      It’s 100% not true that all ISPs monitor DNS packets. I’ve worked for several who didn’t. Of course all have the ability to do just that so as a user you can’t tell. If you’re in the EU they can’t sell that data at least.
    - folmar 4y ago
      We just prefer the small local ISP monitoring our queries to Google and Cloudflare doing so, as the ISP does not learn a lot more than already at hand - they know the IPs I connect to anyway.
  - derkades 4y ago
    Simply direct all outbound DNS traffic to your own DNS server. You could do the same for your LAN by adding a port forward rule in your router (for LAN, not for WAN like you usually would to get incoming traffic around NAT)
- eknkc 4y ago
  Dns over TLS has been a life saver due to this shit. I’ve my modem exposing its own dns server but using a dns over tls upstream instead of my ISP. Works perfectly.
- brian_cunnie 4y ago
  My mother's cable provider, Optimum Cable, routes DNS traffic to their own DNS servers. To make matters worse, they engage in gratuitous blocking; for example, they won't resolve addresses of private networks (192.168.x.y, 10.x.y.z, etc...). For example, 192.168.1.1.nip.io won't resolve on my mom's network, but will almost everywhere else. The solution, as another poster pointed out, was to use DNS-over-TLS.
  - cesarb 4y ago
    > for example, they won't resolve addresses of private networks (192.168.x.y, 10.x.y.z, etc...) That's called "DNS rebinding protection", and it's meant to protect against DNS rebind attacks (https://en.wikipedia.org/wiki/DNS_rebinding https://en.wikipedia.org/wiki/DNS_rebinding).
- Ayesh 4y ago
  There was some real shit going on with some Indonesian ISPs downright blocking connections to known public DNS resolvers (8.8.8.8, 1.1.1.1, etc). Dangerously close to the China-level firewalls that block known VPNs as well.
- mabbo 4y ago
  Could I not just put the IP address in my url bar? Or do browsers go through DNS with that anyway?
  - cortesoft 4y ago
    That usually won't work. If a site uses SNI and has many sites behind a single IP (like cloudflare, for example), the server won't know which host's content to respond with. If it isn't a shared IP, your own browser will block it because of a cert mismatch. The best way to do this is to update your own /etc/hosts file to point the domain at the correct IP.
- dinom 4y ago
  I found the following article to be very helpful when troubleshooting and bypassing that practice: https://help.dnsfilter.com/hc/en-us/articles/1500008110182-transparent-proxying It's also good to know that many newer browsers aren't affected since they've started to enable DoH out of the box (at least that's what firefox has done). Anyway, other programs on your system may be affected too so addressing the issue at the system level is also important.
gsich 4y ago
It's supposed to be a measure against technically non-savy people. It might work since a lot of people are not aware of DNS.
twelvedogs 4y ago
Yeah no one really cares that it's not super effective in Australia though. the courts order blocks, the ISPs block it at dns because it's cheap and easy and pirates are either scared off by the warning message or just use Google dns It's good enough and mostly non disruptive

by mabbo 4y ago

Yujf 4y ago

Dns blocking is exactly like that. I don't live australia, but if I go to the piratebay for example with my isp dns I get a message it's blocked. If I change to google or cloudflare dns it works just fine

lormayna 4y ago

Several ISP have appliances that can inspect DNS traffic and redirect to a the ISP DNS. Then, even if you change DNS servers, you will be not able to reach blocked sites. The only way to bypass that, at the moment is to use DoH. Source: I have been worked for an ISP and I was in charge of that.

politelemon 4y ago
> Then, even if you change DNS servers, you will be not able to reach blocked sites. Is this done simply by intercepting UDP port 53 requests somehow? I've only ever had to intercept https as part of development, but have no idea how this would work for UDP. Any details you can share?
- NavinF 4y ago
  Yep that’s exactly how it works. Not all ISPs actively intercept and reply to your queries, but the rest still monitor all port 53 traffic and log your queries. Naturally, a lot of HNers hate encrypted DoH which solves both the active MITM and passive monitoring problems. Example: https://news.ycombinator.com/item?id=25344358 https://news.ycombinator.com/item?id=25344358
  - topranks 4y ago
    It’s 100% not true that all ISPs monitor DNS packets. I’ve worked for several who didn’t. Of course all have the ability to do just that so as a user you can’t tell. If you’re in the EU they can’t sell that data at least.
  - folmar 4y ago
    We just prefer the small local ISP monitoring our queries to Google and Cloudflare doing so, as the ISP does not learn a lot more than already at hand - they know the IPs I connect to anyway.
- derkades 4y ago
  Simply direct all outbound DNS traffic to your own DNS server. You could do the same for your LAN by adding a port forward rule in your router (for LAN, not for WAN like you usually would to get incoming traffic around NAT)
eknkc 4y ago
Dns over TLS has been a life saver due to this shit. I’ve my modem exposing its own dns server but using a dns over tls upstream instead of my ISP. Works perfectly.
brian_cunnie 4y ago
My mother's cable provider, Optimum Cable, routes DNS traffic to their own DNS servers. To make matters worse, they engage in gratuitous blocking; for example, they won't resolve addresses of private networks (192.168.x.y, 10.x.y.z, etc...). For example, 192.168.1.1.nip.io won't resolve on my mom's network, but will almost everywhere else. The solution, as another poster pointed out, was to use DNS-over-TLS.
- cesarb 4y ago
  > for example, they won't resolve addresses of private networks (192.168.x.y, 10.x.y.z, etc...) That's called "DNS rebinding protection", and it's meant to protect against DNS rebind attacks (https://en.wikipedia.org/wiki/DNS_rebinding https://en.wikipedia.org/wiki/DNS_rebinding).
Ayesh 4y ago
There was some real shit going on with some Indonesian ISPs downright blocking connections to known public DNS resolvers (8.8.8.8, 1.1.1.1, etc). Dangerously close to the China-level firewalls that block known VPNs as well.
mabbo 4y ago
Could I not just put the IP address in my url bar? Or do browsers go through DNS with that anyway?
- cortesoft 4y ago
  That usually won't work. If a site uses SNI and has many sites behind a single IP (like cloudflare, for example), the server won't know which host's content to respond with. If it isn't a shared IP, your own browser will block it because of a cert mismatch. The best way to do this is to update your own /etc/hosts file to point the domain at the correct IP.
dinom 4y ago
I found the following article to be very helpful when troubleshooting and bypassing that practice: https://help.dnsfilter.com/hc/en-us/articles/1500008110182-transparent-proxying It's also good to know that many newer browsers aren't affected since they've started to enable DoH out of the box (at least that's what firefox has done). Anyway, other programs on your system may be affected too so addressing the issue at the system level is also important.

gsich 4y ago

It's supposed to be a measure against technically non-savy people. It might work since a lot of people are not aware of DNS.

twelvedogs 4y ago

Yeah no one really cares that it's not super effective in Australia though. the courts order blocks, the ISPs block it at dns because it's cheap and easy and pirates are either scared off by the warning message or just use Google dns It's good enough and mostly non disruptive