5 ms·
It depends, but DNS lists are by far the most common, and you can indeed circumvent it by using another DNS server.
by Semaphor 4y ago
It depends, but DNS lists are by far the most common, and you can indeed circumvent it by using another DNS server.
- Reason077 4y agoChanging DNS servers will not get around the UK ISP “adult content blocks” in my experience, but using a VPN will. Generally it’s a good idea to disable ISP content blocking if you can, because they can cause all kinds of problems (slowdowns, false positives).
- Semaphor 4y agoHow do they do that? IP Lists?
- AntoniusBlock 4y agoI can get around Sky Broadband's block on Libgen by just using Libgen's IP, for example.
- Varloom 4y agoEven with secure DNS, the SNI part is passed as plain text for the ISP to intercept and block.
- sidewndr46 4y agoWouldn't they just block outside DNS?
- denton-scratch 4y agoThey can't block a customer-premises recursive resolver. But the SNI is on the TCP connection, not the DNS request; if you have that sort of ISP, they can filter based on SNI.
- sidewndr46 4y agoWhy would the location of the DNS resolver matter? If I am running a local DNS resolver, presumably it recurses to an outside DNs server. If my ISP blocks that, I can't use it.
- denton-scratch 4y agoIt recurses to the root, and then down the tree. So yes - the final query is a lookup for the name you are targeting, and yes, it goes through your ISP, like all your other traffic. But it doesn't go through your ISPs DNS infrastructure, it goes direct to the nameserver for the parent domain. And even that doesn't happen if your local resolver has the result cached. The easiest way to block DNS lookups is at the DNS server; using DPI to block DNS lookups is straying into sledgehammer/nut territory.
- sidewndr46 4y agoYeah, but isn't that laughably easy to block such a scheme? If a packet is destined for port 53 that isn't the ISPs DNS server, poof it's gone!
- Nextgrid 4y agoOr just redirect any outbound port-53 traffic to the ISP's DNS which will pretend to be the server you're talking to while silently applying the filtering.
- denton-scratch 4y agoYou're right; that's a very simple firewall rule. But if I can't access a working DNS server over the internet, then I don't have internet service, and whatever kind of provider I have, it's not an "internet service provider".