4 ms·

They could block all outgoing traffic to port 53, although you could work around that by setting up a DNS server on a different port outside the network

SoftTalker 2y ago
Yes I'm pretty sure this is what they do. The DHCP from the router gives 75.75.75.75 and 75.75.76.76. I've tried overriding that with different resolvers in my /etc/resolv.conf and it doesn't work. And logging in to the modem/router config does not offer any option to change DNS settings.
- chii 2y ago
  i wonder if this will circumvent that sort of blocking: https://support.mozilla.org/en-US/kb/firefox-dns-over-https https://support.mozilla.org/en-US/kb/firefox-dns-over-https
  - SoftTalker 2y ago
    I just tried it. I enabled it at the "Max Protection" level, used the default provider setting (Cloudflare) and it works. So it seems the answer is yes. So that's a pretty simple workaround that covers most cases. I'm guessing that most of the DNS lookups that people would want to be private are happening via a web browser.
- INGSOCIALITE 2y ago
  edit the /etc/resolv.conf with your chosen nameservers then chattr +i /etc/resolv.conf
pimeys 2y ago
I'm in Germany, and running my custom opnsense router with adblocker DNS connected to one of the big DoH providers. Never had any issues, not even with using plain old DNS in port 53. Vodafone Kable, so YMMV. Always a bit scared to switch providers of course, you never know if you get cgnat and blocked DNS servers. They are building a Deutsche Telekom fiber to our street this summer. It's tempting for the 200 Mbps uplink, But I have no idea is it then CGNAT and do they even provide real IPv6. It's never mentioned in the advertisement.
- iggldiggl 2y ago
  Telekom DSL and fibre should normally be full IPv4 + v6 dual stack – they're the former state operator and have a relatively generous IPv4 address allocation.
iggldiggl 2y ago
I've run into a different problem: Akamai apparently uses DNS in order to steer you to the correct portion of their CDN, and the set of servers returned by third-party DNS servers turns out to have abysmal peering with my ISP. So third party DNS isn't really useable for me unless I'd run my own custom resolver in order to special-case Akamai.

SoftTalker 2y ago

Yes I'm pretty sure this is what they do. The DHCP from the router gives 75.75.75.75 and 75.75.76.76. I've tried overriding that with different resolvers in my /etc/resolv.conf and it doesn't work. And logging in to the modem/router config does not offer any option to change DNS settings.

chii 2y ago
i wonder if this will circumvent that sort of blocking: https://support.mozilla.org/en-US/kb/firefox-dns-over-https https://support.mozilla.org/en-US/kb/firefox-dns-over-https
- SoftTalker 2y ago
  I just tried it. I enabled it at the "Max Protection" level, used the default provider setting (Cloudflare) and it works. So it seems the answer is yes. So that's a pretty simple workaround that covers most cases. I'm guessing that most of the DNS lookups that people would want to be private are happening via a web browser.
INGSOCIALITE 2y ago
edit the /etc/resolv.conf with your chosen nameservers then chattr +i /etc/resolv.conf

pimeys 2y ago

I'm in Germany, and running my custom opnsense router with adblocker DNS connected to one of the big DoH providers. Never had any issues, not even with using plain old DNS in port 53. Vodafone Kable, so YMMV. Always a bit scared to switch providers of course, you never know if you get cgnat and blocked DNS servers. They are building a Deutsche Telekom fiber to our street this summer. It's tempting for the 200 Mbps uplink, But I have no idea is it then CGNAT and do they even provide real IPv6. It's never mentioned in the advertisement.

iggldiggl 2y ago
Telekom DSL and fibre should normally be full IPv4 + v6 dual stack – they're the former state operator and have a relatively generous IPv4 address allocation.

iggldiggl 2y ago

I've run into a different problem: Akamai apparently uses DNS in order to steer you to the correct portion of their CDN, and the set of servers returned by third-party DNS servers turns out to have abysmal peering with my ISP. So third party DNS isn't really useable for me unless I'd run my own custom resolver in order to special-case Akamai.