5 ms·

Several ISP have appliances that can inspect DNS traffic and redirect to a the ISP DNS. Then, even if you change DNS servers, you will be not able to reach blo

Several ISP have appliances that can inspect DNS traffic and redirect to a the ISP DNS. Then, even if you change DNS servers, you will be not able to reach blocked sites. The only way to bypass that, at the moment is to use DoH. Source: I have been worked for an ISP and I was in charge of that.

politelemon 4y ago
> Then, even if you change DNS servers, you will be not able to reach blocked sites. Is this done simply by intercepting UDP port 53 requests somehow? I've only ever had to intercept https as part of development, but have no idea how this would work for UDP. Any details you can share?
- NavinF 4y ago
  Yep that’s exactly how it works. Not all ISPs actively intercept and reply to your queries, but the rest still monitor all port 53 traffic and log your queries. Naturally, a lot of HNers hate encrypted DoH which solves both the active MITM and passive monitoring problems. Example: https://news.ycombinator.com/item?id=25344358 https://news.ycombinator.com/item?id=25344358
  - topranks 4y ago
    It’s 100% not true that all ISPs monitor DNS packets. I’ve worked for several who didn’t. Of course all have the ability to do just that so as a user you can’t tell. If you’re in the EU they can’t sell that data at least.
  - folmar 4y ago
    We just prefer the small local ISP monitoring our queries to Google and Cloudflare doing so, as the ISP does not learn a lot more than already at hand - they know the IPs I connect to anyway.
- derkades 4y ago
  Simply direct all outbound DNS traffic to your own DNS server. You could do the same for your LAN by adding a port forward rule in your router (for LAN, not for WAN like you usually would to get incoming traffic around NAT)
eknkc 4y ago
Dns over TLS has been a life saver due to this shit. I’ve my modem exposing its own dns server but using a dns over tls upstream instead of my ISP. Works perfectly.
brian_cunnie 4y ago
My mother's cable provider, Optimum Cable, routes DNS traffic to their own DNS servers. To make matters worse, they engage in gratuitous blocking; for example, they won't resolve addresses of private networks (192.168.x.y, 10.x.y.z, etc...). For example, 192.168.1.1.nip.io won't resolve on my mom's network, but will almost everywhere else. The solution, as another poster pointed out, was to use DNS-over-TLS.
- cesarb 4y ago
  > for example, they won't resolve addresses of private networks (192.168.x.y, 10.x.y.z, etc...) That's called "DNS rebinding protection", and it's meant to protect against DNS rebind attacks (https://en.wikipedia.org/wiki/DNS_rebinding https://en.wikipedia.org/wiki/DNS_rebinding).
Ayesh 4y ago
There was some real shit going on with some Indonesian ISPs downright blocking connections to known public DNS resolvers (8.8.8.8, 1.1.1.1, etc). Dangerously close to the China-level firewalls that block known VPNs as well.
mabbo 4y ago
Could I not just put the IP address in my url bar? Or do browsers go through DNS with that anyway?
- cortesoft 4y ago
  That usually won't work. If a site uses SNI and has many sites behind a single IP (like cloudflare, for example), the server won't know which host's content to respond with. If it isn't a shared IP, your own browser will block it because of a cert mismatch. The best way to do this is to update your own /etc/hosts file to point the domain at the correct IP.
dinom 4y ago
I found the following article to be very helpful when troubleshooting and bypassing that practice: https://help.dnsfilter.com/hc/en-us/articles/1500008110182-transparent-proxying It's also good to know that many newer browsers aren't affected since they've started to enable DoH out of the box (at least that's what firefox has done). Anyway, other programs on your system may be affected too so addressing the issue at the system level is also important.

politelemon 4y ago

> Then, even if you change DNS servers, you will be not able to reach blocked sites. Is this done simply by intercepting UDP port 53 requests somehow? I've only ever had to intercept https as part of development, but have no idea how this would work for UDP. Any details you can share?

NavinF 4y ago
Yep that’s exactly how it works. Not all ISPs actively intercept and reply to your queries, but the rest still monitor all port 53 traffic and log your queries. Naturally, a lot of HNers hate encrypted DoH which solves both the active MITM and passive monitoring problems. Example: https://news.ycombinator.com/item?id=25344358 https://news.ycombinator.com/item?id=25344358
- topranks 4y ago
  It’s 100% not true that all ISPs monitor DNS packets. I’ve worked for several who didn’t. Of course all have the ability to do just that so as a user you can’t tell. If you’re in the EU they can’t sell that data at least.
- folmar 4y ago
  We just prefer the small local ISP monitoring our queries to Google and Cloudflare doing so, as the ISP does not learn a lot more than already at hand - they know the IPs I connect to anyway.
derkades 4y ago
Simply direct all outbound DNS traffic to your own DNS server. You could do the same for your LAN by adding a port forward rule in your router (for LAN, not for WAN like you usually would to get incoming traffic around NAT)

eknkc 4y ago

Dns over TLS has been a life saver due to this shit. I’ve my modem exposing its own dns server but using a dns over tls upstream instead of my ISP. Works perfectly.

brian_cunnie 4y ago

My mother's cable provider, Optimum Cable, routes DNS traffic to their own DNS servers. To make matters worse, they engage in gratuitous blocking; for example, they won't resolve addresses of private networks (192.168.x.y, 10.x.y.z, etc...). For example, 192.168.1.1.nip.io won't resolve on my mom's network, but will almost everywhere else. The solution, as another poster pointed out, was to use DNS-over-TLS.

cesarb 4y ago
> for example, they won't resolve addresses of private networks (192.168.x.y, 10.x.y.z, etc...) That's called "DNS rebinding protection", and it's meant to protect against DNS rebind attacks (https://en.wikipedia.org/wiki/DNS_rebinding https://en.wikipedia.org/wiki/DNS_rebinding).

Ayesh 4y ago

There was some real shit going on with some Indonesian ISPs downright blocking connections to known public DNS resolvers (8.8.8.8, 1.1.1.1, etc). Dangerously close to the China-level firewalls that block known VPNs as well.

mabbo 4y ago

Could I not just put the IP address in my url bar? Or do browsers go through DNS with that anyway?

cortesoft 4y ago
That usually won't work. If a site uses SNI and has many sites behind a single IP (like cloudflare, for example), the server won't know which host's content to respond with. If it isn't a shared IP, your own browser will block it because of a cert mismatch. The best way to do this is to update your own /etc/hosts file to point the domain at the correct IP.

dinom 4y ago

I found the following article to be very helpful when troubleshooting and bypassing that practice: https://help.dnsfilter.com/hc/en-us/articles/1500008110182-transparent-proxying It's also good to know that many newer browsers aren't affected since they've started to enable DoH out of the box (at least that's what firefox has done). Anyway, other programs on your system may be affected too so addressing the issue at the system level is also important.