3 ms·
> Then, even if you change DNS servers, you will be not able to reach blocked sites. Is this done simply by intercepting UDP port 53 requests somehow? I've on
by politelemon 4y ago
> Then, even if you change DNS servers, you will be not able to reach blocked sites.
Is this done simply by intercepting UDP port 53 requests somehow? I've only ever had to intercept https as part of development, but have no idea how this would work for UDP. Any details you can share?
- NavinF 4y agoYep that’s exactly how it works. Not all ISPs actively intercept and reply to your queries, but the rest still monitor all port 53 traffic and log your queries. Naturally, a lot of HNers hate encrypted DoH which solves both the active MITM and passive monitoring problems. Example: https://news.ycombinator.com/item?id=25344358 https://news.ycombinator.com/item?id=25344358
- topranks 4y agoIt’s 100% not true that all ISPs monitor DNS packets. I’ve worked for several who didn’t. Of course all have the ability to do just that so as a user you can’t tell. If you’re in the EU they can’t sell that data at least.
- folmar 4y agoWe just prefer the small local ISP monitoring our queries to Google and Cloudflare doing so, as the ISP does not learn a lot more than already at hand - they know the IPs I connect to anyway.
- derkades 4y agoSimply direct all outbound DNS traffic to your own DNS server. You could do the same for your LAN by adding a port forward rule in your router (for LAN, not for WAN like you usually would to get incoming traffic around NAT)