6 ms·

I can confirm, they are banned but VPN or Tor can access them without any issues. So it's only to prevent normies from accessing them.

johannes1234321 2y ago
It's even simpler: Those blocks are implemented in DNS. Pick 8.8.8.8 or some other public DNS server and blocks are bypassed. (And pick another ISP - it's their job to provide neutral net access, not mess with it, especially not mess with it without court order or something just by request of some private companies)
- SoftTalker 2y ago
  Some ISPs prevent you from using other DNS. Comcast/Xfinity modem/routers for example.
  - haswell 2y ago
    This can still be overridden on each client system behind those routers, but this is also another good reason to avoid renting your modem/router. Products like NextDNS also provide a client app to simplify the process of overriding DNS.
  - hobofan 2y ago
    Most stock ISP routers in Germany I've seen allow you to set custom DNS in a straightforward manner. And even if they don't, for a few years now there is a law that guarantees you the right to choose your own router (because previously we had quite bad bundling that forced you to rent the ISPs router), so ISPs can't lock you in like that.
    - Asmod4n 2y ago
      There are two types of routers consumers get here. Those where you can nearly change everything regarding DHCP and such and those given you by cable companies where you can’t even change the IP address of said router. The latter usually allows you to disable its IPv4 DHCP sever though but enforce itself as the IPv6 DNS server across your network, which can’t be disabled on your own.
  - Systemmanic 2y ago
    Looks as though this Comcast “security feature” can be disabled via your account settings. Also, DNSSec?
    - vladvasiliu 2y ago
      I'm not an expert on DNS, but I don't think DNSSec can actually help here, and by help I mean "unblock". Sure, their NXDOMAIN (or whatever) response will appear bogus, but your client won't be able to rebuild the missing response.
  - chii 2y ago
    how does that work? You can just set your operating system to not use the ISP provided DNS server, even if the ISP provided router/modem is locked and cannot be changed.
    - cortesoft 2y ago
      They could block all outgoing traffic to port 53, although you could work around that by setting up a DNS server on a different port outside the network
      - SoftTalker 2y ago
        Yes I'm pretty sure this is what they do. The DHCP from the router gives 75.75.75.75 and 75.75.76.76. I've tried overriding that with different resolvers in my /etc/resolv.conf and it doesn't work. And logging in to the modem/router config does not offer any option to change DNS settings.
        chii 2y ago
        i wonder if this will circumvent that sort of blocking: https://support.mozilla.org/en-US/kb/firefox-dns-over-https https://support.mozilla.org/en-US/kb/firefox-dns-over-https
        SoftTalker 2y ago
        I just tried it. I enabled it at the "Max Protection" level, used the default provider setting (Cloudflare) and it works. So it seems the answer is yes. So that's a pretty simple workaround that covers most cases. I'm guessing that most of the DNS lookups that people would want to be private are happening via a web browser.
        INGSOCIALITE 2y ago
        edit the /etc/resolv.conf with your chosen nameservers then chattr +i /etc/resolv.conf
      - 2y ago
  - lasr_velocirptr 2y ago
    I am sure if you use DoT or DoH it's going to be very hard for ISP to block using your own DNS even if you rented a modem/router from them. It does need client-side support though.
    - pxc 2y ago
      > It does need client-side support though. Not really! You can buy a router that ships with OpenWrt out-of-the-box and just toggle a little checkbox. Plug that into your ISP's router (or use a wireless bridge in client mode, that's supported, too) and connect all of your devices through that. Now all your devices use DoH and don't even know it.
    - Asmod4n 2y ago
      No need for client support, you could just deploy it on a Linux vm running somewhere on your network and let that be the dns server served via dhcp. For extra points you could deploy a firewall which intercepts all DNS requests and forwards them to that machine. Some apps have hardcoded DNS servers and ignore what you have configured.
    - codedokode 2y ago
      ISP can simply compile a blacklist of publicly available encrypted DNS resolvers and block them.
      - lasr_velocirptr 2y ago
        not really feasible for non technical folks but at that point you start to run a dns proxy in cloud with static ip and proxy all your dns requests using DoH to that IP. That would be really hard to block without blocking all outbound https connections
  - saghm 2y ago
    Is it possible to use your own router/modem for Comcast? Between my last two apartments and my current one I've had Spectrum, Optimum, and RCN as ISPs in the past decade or so, and with all three of them I was able to use my own router and modem (doing a quick google ahead of setup to make sure that I found instances of people online saying the hardware I had worked for them). It definitely _shouldn't_ be something people have to do in order to be able to have unrestricted internet, but sadly it's far from the only thing that sucks about ISPs. In my current apartment, I have no other option for ISP other than Spectrum, and they seem to get outages far more often than they should (and don't "notify" me until around 20 minutes after I check their website for outages in my area and it says there aren't any).
    - pxc 2y ago
      You can always plug your own router into the LAN port of a shitty ISP's combo modem/router device, too, even if they won't give a connection to any other device than their own and they defeat all your spoofing attempts. I haven't used a proprietary router in my entire adult life, except as a WAN connection for my 'real' router with some shitty ISPs.
      - SoftTalker 2y ago
        Yes, you can use your own modem, but they give you incentives to use theirs. You can also put their combo modem/router into bridge mode and use your own router. But that's a bit more of a reach for the average person, vs. just changing the DNS addresses in a config page (which is already more than 95% of people will do).
      - 0xffff2 2y ago
        > even if they won't give a connection to any other device than their own AFAIK they are legally required to maintain a list of compatible devices and accept any modem that is on that list.
        pxc 2y ago
        My cellular ISP doesn't seem to be bound by that, even though every cable ISP I've been with has. :( If there's some US law I can cite at them like a magic invocation to make their dumb combo device go away in favor of my own cellular modem, though, I'd like to.
  - pxc 2y ago
    Do they block DNS-over-HTTPS? I bet not.
  - matheusmoreira 2y ago
    ISP equipment should be considered compromised. They even have remote access. We should buy our own routers and bridge them to the networks of ISPs.
  - loeg 2y ago
    I was a Comcast customer for 10+ years prior to 2017 and at the time they did not block foreign DNS servers.
    - SoftTalker 2y ago
      They don't block them generally, but their newer consumer modem/router/WAP "appliances" do. If you use your own, you can set whatever DNS you want, but you will have lower data caps and lose some incentive pricing that you can get if you use theirs. I'd guess if you get business tier service you have more options also, but I've never had that.
      - loeg 2y ago
        I was on ordinary residential service. At the time, using their device cost more money than BYO, and the data caps were identical (or rather, there mostly weren't data caps).
  - redprince 2y ago
    As this particular issue of DNS blocking pertains to Germany: By law (EU Commission Directive 2008/63/EC and national law TKG § 73 Abs 1) the ISP must allow the free choice of routers and has to provide all access codes. So even if an ISP provided router would be uncooperative, there is always the choice of just not using it.
  - baby_souffle 2y ago
    > Comcast/Xfinity modem/routers for example. In that they DNAT traffic to _their_ DNS or they just don't expose a configuration flow to the user?
  - EasyMark 2y ago
    How do that do that? The dns-over-https ones run on 443?
marci 2y ago
I imagine a lot of the normies that got blocked trying to get to sci-hub didn't remain normies for long.
- cocok 2y ago
  "We all began as something else."
sulandor 2y ago
true it's an annoying precedent besides the tech-support labor of folks like us trying to fix it.

johannes1234321 2y ago

It's even simpler: Those blocks are implemented in DNS. Pick 8.8.8.8 or some other public DNS server and blocks are bypassed. (And pick another ISP - it's their job to provide neutral net access, not mess with it, especially not mess with it without court order or something just by request of some private companies)

SoftTalker 2y ago
Some ISPs prevent you from using other DNS. Comcast/Xfinity modem/routers for example.
- haswell 2y ago
  This can still be overridden on each client system behind those routers, but this is also another good reason to avoid renting your modem/router. Products like NextDNS also provide a client app to simplify the process of overriding DNS.
- hobofan 2y ago
  Most stock ISP routers in Germany I've seen allow you to set custom DNS in a straightforward manner. And even if they don't, for a few years now there is a law that guarantees you the right to choose your own router (because previously we had quite bad bundling that forced you to rent the ISPs router), so ISPs can't lock you in like that.
  - Asmod4n 2y ago
    There are two types of routers consumers get here. Those where you can nearly change everything regarding DHCP and such and those given you by cable companies where you can’t even change the IP address of said router. The latter usually allows you to disable its IPv4 DHCP sever though but enforce itself as the IPv6 DNS server across your network, which can’t be disabled on your own.
- Systemmanic 2y ago
  Looks as though this Comcast “security feature” can be disabled via your account settings. Also, DNSSec?
  - vladvasiliu 2y ago
    I'm not an expert on DNS, but I don't think DNSSec can actually help here, and by help I mean "unblock". Sure, their NXDOMAIN (or whatever) response will appear bogus, but your client won't be able to rebuild the missing response.
- chii 2y ago
  how does that work? You can just set your operating system to not use the ISP provided DNS server, even if the ISP provided router/modem is locked and cannot be changed.
  - cortesoft 2y ago
    They could block all outgoing traffic to port 53, although you could work around that by setting up a DNS server on a different port outside the network
    - SoftTalker 2y ago
      Yes I'm pretty sure this is what they do. The DHCP from the router gives 75.75.75.75 and 75.75.76.76. I've tried overriding that with different resolvers in my /etc/resolv.conf and it doesn't work. And logging in to the modem/router config does not offer any option to change DNS settings.
      - chii 2y ago
        i wonder if this will circumvent that sort of blocking: https://support.mozilla.org/en-US/kb/firefox-dns-over-https https://support.mozilla.org/en-US/kb/firefox-dns-over-https
        SoftTalker 2y ago
        I just tried it. I enabled it at the "Max Protection" level, used the default provider setting (Cloudflare) and it works. So it seems the answer is yes. So that's a pretty simple workaround that covers most cases. I'm guessing that most of the DNS lookups that people would want to be private are happening via a web browser.
      - INGSOCIALITE 2y ago
        edit the /etc/resolv.conf with your chosen nameservers then chattr +i /etc/resolv.conf
    - 2y ago
- lasr_velocirptr 2y ago
  I am sure if you use DoT or DoH it's going to be very hard for ISP to block using your own DNS even if you rented a modem/router from them. It does need client-side support though.
  - pxc 2y ago
    > It does need client-side support though. Not really! You can buy a router that ships with OpenWrt out-of-the-box and just toggle a little checkbox. Plug that into your ISP's router (or use a wireless bridge in client mode, that's supported, too) and connect all of your devices through that. Now all your devices use DoH and don't even know it.
  - Asmod4n 2y ago
    No need for client support, you could just deploy it on a Linux vm running somewhere on your network and let that be the dns server served via dhcp. For extra points you could deploy a firewall which intercepts all DNS requests and forwards them to that machine. Some apps have hardcoded DNS servers and ignore what you have configured.
  - codedokode 2y ago
    ISP can simply compile a blacklist of publicly available encrypted DNS resolvers and block them.
    - lasr_velocirptr 2y ago
      not really feasible for non technical folks but at that point you start to run a dns proxy in cloud with static ip and proxy all your dns requests using DoH to that IP. That would be really hard to block without blocking all outbound https connections
- saghm 2y ago
  Is it possible to use your own router/modem for Comcast? Between my last two apartments and my current one I've had Spectrum, Optimum, and RCN as ISPs in the past decade or so, and with all three of them I was able to use my own router and modem (doing a quick google ahead of setup to make sure that I found instances of people online saying the hardware I had worked for them). It definitely _shouldn't_ be something people have to do in order to be able to have unrestricted internet, but sadly it's far from the only thing that sucks about ISPs. In my current apartment, I have no other option for ISP other than Spectrum, and they seem to get outages far more often than they should (and don't "notify" me until around 20 minutes after I check their website for outages in my area and it says there aren't any).
  - pxc 2y ago
    You can always plug your own router into the LAN port of a shitty ISP's combo modem/router device, too, even if they won't give a connection to any other device than their own and they defeat all your spoofing attempts. I haven't used a proprietary router in my entire adult life, except as a WAN connection for my 'real' router with some shitty ISPs.
    - SoftTalker 2y ago
      Yes, you can use your own modem, but they give you incentives to use theirs. You can also put their combo modem/router into bridge mode and use your own router. But that's a bit more of a reach for the average person, vs. just changing the DNS addresses in a config page (which is already more than 95% of people will do).
    - 0xffff2 2y ago
      > even if they won't give a connection to any other device than their own AFAIK they are legally required to maintain a list of compatible devices and accept any modem that is on that list.
      - pxc 2y ago
        My cellular ISP doesn't seem to be bound by that, even though every cable ISP I've been with has. :( If there's some US law I can cite at them like a magic invocation to make their dumb combo device go away in favor of my own cellular modem, though, I'd like to.
- pxc 2y ago
  Do they block DNS-over-HTTPS? I bet not.
- matheusmoreira 2y ago
  ISP equipment should be considered compromised. They even have remote access. We should buy our own routers and bridge them to the networks of ISPs.
- loeg 2y ago
  I was a Comcast customer for 10+ years prior to 2017 and at the time they did not block foreign DNS servers.
  - SoftTalker 2y ago
    They don't block them generally, but their newer consumer modem/router/WAP "appliances" do. If you use your own, you can set whatever DNS you want, but you will have lower data caps and lose some incentive pricing that you can get if you use theirs. I'd guess if you get business tier service you have more options also, but I've never had that.
    - loeg 2y ago
      I was on ordinary residential service. At the time, using their device cost more money than BYO, and the data caps were identical (or rather, there mostly weren't data caps).
- redprince 2y ago
  As this particular issue of DNS blocking pertains to Germany: By law (EU Commission Directive 2008/63/EC and national law TKG § 73 Abs 1) the ISP must allow the free choice of routers and has to provide all access codes. So even if an ISP provided router would be uncooperative, there is always the choice of just not using it.
- baby_souffle 2y ago
  > Comcast/Xfinity modem/routers for example. In that they DNAT traffic to _their_ DNS or they just don't expose a configuration flow to the user?
- EasyMark 2y ago
  How do that do that? The dns-over-https ones run on 443?

marci 2y ago

I imagine a lot of the normies that got blocked trying to get to sci-hub didn't remain normies for long.

cocok 2y ago
"We all began as something else."

sulandor 2y ago

true it's an annoying precedent besides the tech-support labor of folks like us trying to fix it.