3 ms·
"All blacklisted domains resolve to 10.0.34.35" I guess this would require everyone to use a government-sanctioned DNS and that would require traffic on udp 53
by ghostpepper 4y ago
"All blacklisted domains resolve to 10.0.34.35"
I guess this would require everyone to use a government-sanctioned DNS and that would require traffic on udp 53 to non-gov-dns servers blocked? I felt like this was glossed over a bit too quickly in the article
- tenebrisalietum 4y agoMore like the whole country is behind a giant CGNAT. NAT is good for security, eh?
- justsomehnguy 4y agoDNS is running on udp/53. It's beyond trivial to absolutely transparently NAT it to anything you want. Block tcp/853 and most common public DNS servers and you can control resolving on 98% of devices.
- vel0city 4y agoProbably more like all the local ISPs DNS servers resolve that, or that there's potentially some DNS rewriting going on. Its not too hard to rewrite basic DNS traffic. DNS is not encrypted, its payloads are very structured, and quite small.