6 ms·

Does anyone know of a solution that would let me slow down access to certain websites, ideally just for certain devices? I feel like I wouldn't just default to

by mabbo 4y ago

Does anyone know of a solution that would let me slow down access to certain websites, ideally just for certain devices? I feel like I wouldn't just default to opening HN and reddit all the time on my phone if I knew it was bandwidth capped to dial-up speeds. But if there was something critical there, I would still have access.

hunter2_ 4y ago
A traffic shaper can do that, but it would most likely be making decisions based on layer 4 (assuming it's not an SSL decrypting proxy) so it would affect any sites which have the IP addresses you specify. As long as HN and Reddit don't share edge servers with things you want unshaped, it should be straightforward. The "only for certain devices" part would probably mean putting those devices in a VLAN and only shaping that VLAN's uplink. A router like pfsense should be able to do all of that. But I am far from a network engineer, so don't quote me...
- Sohcahtoa82 4y ago
  > but it would most likely be making decisions based on layer 4 (assuming it's not an SSL decrypting proxy) so it would affect any sites which have the IP addresses you specify Not necessarily...if you're not using ESNI, then the traffic shaper could sniff the server name from the client hello message, then use the TCP sequence numbers to track the individual TCP connection.
  - hunter2_ 4y ago
    Oh nice. I knew about SNI but didn't realize there would be a perfectly persistent trail from that packet onward. If a site being shaped and a site not being shaped shared an edge server (say they both use Cloudflare or something) there's no chance that the TCP connection gets shared for both? Not disagreeing, just thinking out loud naively.
    - Sohcahtoa82 4y ago
      > there's no chance that the TCP connection gets shared for both Not a chance. There is a possibility that the TCP sequence numbers between the two connections overlap, but it's so unlikely as to be negligible.
      - hunter2_ 4y ago
        Oh right... different local port number, too. It's been a while since I thought about sockets and stuff, living fully inside HTTP for so long!
  - 1vuio0pswjnm7 4y ago
    Who is currently using ESNI. Cloudflare disabled it.
    - mavhc 4y ago
      Where has cloudflare disabled it? Can't see anything
      - 1vuio0pswjnm7 4y ago
        They have moved to from ESNI to ECH. ECH is being rolled out in stages. Maybe the rollout is complete by now. I don't know. ESNI was available worldwide. I used ESNI for years outside the browser with a custom openssl binary. Although both encrypt SNI, ESNI was less complex and is not compatible with the latest versions of ECH. https://defo.ie/ech-check.php https://defo.ie/ech-check.php
- robohoe 4y ago
  In addition, pfsense can run pfblockerng which can be used to block ads. It uses the same block lists as pi-hole and others.
revolvingocelot 4y ago
A linux box running squid between you and the open internet? Tailscale (or whatever) on your mobile devices to force them in, too? I'm just spitballing. My bona fides are nothing more than memories of reading about the upside-down-ternet and fiddling with primitive QoS features on elderly routers, but I'm sure this is the right post on the right forum to get a real solution.
alar44 4y ago
You'll need something that can do traffic shaping and you'll also have to segment your network somehow. This will cost you roughly $1000 at least in hardware. Unless you really really want to learn about networking, it's likely not worth the effort.
- hunter2_ 4y ago
  Pfsense is free (if you already have a server to run it on) and a switch with vlan support (not a managed switch, just a smart switch) can be had in the $100 range. Probably need an AP/SSID per vlan though, assuming the vlan awareness stops at the switch. But you're spot on regarding effort/learning.
  - alar44 4y ago
    Yeah it all depends. They may need to buy access points and a switch and a device to run the shaping. Depending on how many ports they need on the switch, it's really easy to hit $1k if you don't buy the cheapest no name stuff you can find.
    - pxx 4y ago
      lol what? Are you buying 10GBASE-T equipment or something?
      - alar44 4y ago
        No, just not shitty Netgear or home equipment. I have a Fortigate, 2 Cisco APs, and a 48 port Juniper PoE switch. Obviously it depends on how many devices you have and what kind of quality you're looking for.
        hunter2_ 4y ago
        Oh I was talking about home. Ambiguous context I suppose...
- planb 4y ago
dylan604 4y ago
How slow of a connection would you need to emulate to get HN to be painful to use? It's just text. I've never done that most evil hacker thing of View Source, but can't imagine it being shockingly bloated. HN looks like it would do well back in the 14.4 dial-up days. Hell, it would probably be okay using an I/O port on an arduino at 9600baud

by mabbo 4y ago

hunter2_ 4y ago

A traffic shaper can do that, but it would most likely be making decisions based on layer 4 (assuming it's not an SSL decrypting proxy) so it would affect any sites which have the IP addresses you specify. As long as HN and Reddit don't share edge servers with things you want unshaped, it should be straightforward. The "only for certain devices" part would probably mean putting those devices in a VLAN and only shaping that VLAN's uplink. A router like pfsense should be able to do all of that. But I am far from a network engineer, so don't quote me...

Sohcahtoa82 4y ago
> but it would most likely be making decisions based on layer 4 (assuming it's not an SSL decrypting proxy) so it would affect any sites which have the IP addresses you specify Not necessarily...if you're not using ESNI, then the traffic shaper could sniff the server name from the client hello message, then use the TCP sequence numbers to track the individual TCP connection.
- hunter2_ 4y ago
  Oh nice. I knew about SNI but didn't realize there would be a perfectly persistent trail from that packet onward. If a site being shaped and a site not being shaped shared an edge server (say they both use Cloudflare or something) there's no chance that the TCP connection gets shared for both? Not disagreeing, just thinking out loud naively.
  - Sohcahtoa82 4y ago
    > there's no chance that the TCP connection gets shared for both Not a chance. There is a possibility that the TCP sequence numbers between the two connections overlap, but it's so unlikely as to be negligible.
    - hunter2_ 4y ago
      Oh right... different local port number, too. It's been a while since I thought about sockets and stuff, living fully inside HTTP for so long!
- 1vuio0pswjnm7 4y ago
  Who is currently using ESNI. Cloudflare disabled it.
  - mavhc 4y ago
    Where has cloudflare disabled it? Can't see anything
    - 1vuio0pswjnm7 4y ago
      They have moved to from ESNI to ECH. ECH is being rolled out in stages. Maybe the rollout is complete by now. I don't know. ESNI was available worldwide. I used ESNI for years outside the browser with a custom openssl binary. Although both encrypt SNI, ESNI was less complex and is not compatible with the latest versions of ECH. https://defo.ie/ech-check.php https://defo.ie/ech-check.php
robohoe 4y ago
In addition, pfsense can run pfblockerng which can be used to block ads. It uses the same block lists as pi-hole and others.

revolvingocelot 4y ago

A linux box running squid between you and the open internet? Tailscale (or whatever) on your mobile devices to force them in, too? I'm just spitballing. My bona fides are nothing more than memories of reading about the upside-down-ternet and fiddling with primitive QoS features on elderly routers, but I'm sure this is the right post on the right forum to get a real solution.

alar44 4y ago

You'll need something that can do traffic shaping and you'll also have to segment your network somehow. This will cost you roughly $1000 at least in hardware. Unless you really really want to learn about networking, it's likely not worth the effort.

hunter2_ 4y ago
Pfsense is free (if you already have a server to run it on) and a switch with vlan support (not a managed switch, just a smart switch) can be had in the $100 range. Probably need an AP/SSID per vlan though, assuming the vlan awareness stops at the switch. But you're spot on regarding effort/learning.
- alar44 4y ago
  Yeah it all depends. They may need to buy access points and a switch and a device to run the shaping. Depending on how many ports they need on the switch, it's really easy to hit $1k if you don't buy the cheapest no name stuff you can find.
  - pxx 4y ago
    lol what? Are you buying 10GBASE-T equipment or something?
    - alar44 4y ago
      No, just not shitty Netgear or home equipment. I have a Fortigate, 2 Cisco APs, and a 48 port Juniper PoE switch. Obviously it depends on how many devices you have and what kind of quality you're looking for.
      - hunter2_ 4y ago
        Oh I was talking about home. Ambiguous context I suppose...
planb 4y ago

dylan604 4y ago

How slow of a connection would you need to emulate to get HN to be painful to use? It's just text. I've never done that most evil hacker thing of View Source, but can't imagine it being shockingly bloated. HN looks like it would do well back in the 14.4 dial-up days. Hell, it would probably be okay using an I/O port on an arduino at 9600baud