4 ms·

Unfortunately there is no way to block websites at the network level (that I know of) as browsers and mobile phones have started using hardcoded DNS resolvers,

Unfortunately there is no way to block websites at the network level (that I know of) as browsers and mobile phones have started using hardcoded DNS resolvers, so the utility of this is limited.

AdieuToLogic 1y ago
> Unfortunately there is no way to block websites at the network level (that I know of) as browsers and mobile phones have started using hardcoded DNS resolvers, so the utility of this is limited. Any network traffic which goes through a gateway under your control can be controlled. DNSSEC[0] can make this more difficult, true, but not impossible as content ultimately originates from an IPv4/IPv6 address and can be dropped by upstream network devices. 0 - https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions https://en.wikipedia.org/wiki/Domain_Name_System_Security_Ex...
remuskaos 1y ago
I thought I commented on this from my phone, but it seems it didn't go through, so I'll try again. Most apps I've tried (and browsers too) can be blocked just fine via DNS. The gli.net interface allows "Override DNS Settings of All Clients" and "DNS Rebinding Attack Protection". This way, the router itself is the only resolver actually reachable. Even if I try some manual `dig google.com @1.1.1.1`, I still get the routers result. The only thing it can't block is DNS over Https. I think that's by design, it seems it's impossible to block that.
elric 1y ago
> browsers and mobile phones have started using hardcoded DNS resolvers, so the utility of this is limited Got a source for that? No phone or browser that I'm aware of uses "hardcoded DNS resolvers". They all use the OS DNS servers which the OS gets from DHCP.
- brynx97 1y ago
  https://support.mozilla.org/en-US/kb/firefox-dns-over-https https://support.mozilla.org/en-US/kb/firefox-dns-over-https By extension, any application or device could rely on DoH instead of OS-provided or network-provider DNS servers. It is controversial, since it both helps individuals combat ISP or government censorship and also helps bad actors do bad things [1]. [1]https://en.wikipedia.org/wiki/DNS_over_HTTPS#Analysis_of_DNS_traffic_for_security_purposes https://en.wikipedia.org/wiki/DNS_over_HTTPS#Analysis_of_DNS...
  - elric 1y ago
    DoH in Firefox is off by default (at least in every FF I've ever installed). And it's not hardcoded to any specific DNS server, you can use whichever provider you like.
ethan_smith 1y ago
You can still block at network level by configuring your router to intercept all port 53 traffic, redirect DNS-over-HTTPS using firewall rules for known DoH providers, and employ TLS inspection on your gateway for complete control.

Unfortunately there is no way to block websites at the network level (that I know of) as browsers and mobile phones have started using hardcoded DNS resolvers, so the utility of this is limited.

AdieuToLogic 1y ago

> Unfortunately there is no way to block websites at the network level (that I know of) as browsers and mobile phones have started using hardcoded DNS resolvers, so the utility of this is limited. Any network traffic which goes through a gateway under your control can be controlled. DNSSEC[0] can make this more difficult, true, but not impossible as content ultimately originates from an IPv4/IPv6 address and can be dropped by upstream network devices. 0 - https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions https://en.wikipedia.org/wiki/Domain_Name_System_Security_Ex...

remuskaos 1y ago

I thought I commented on this from my phone, but it seems it didn't go through, so I'll try again. Most apps I've tried (and browsers too) can be blocked just fine via DNS. The gli.net interface allows "Override DNS Settings of All Clients" and "DNS Rebinding Attack Protection". This way, the router itself is the only resolver actually reachable. Even if I try some manual `dig google.com @1.1.1.1`, I still get the routers result. The only thing it can't block is DNS over Https. I think that's by design, it seems it's impossible to block that.

elric 1y ago

> browsers and mobile phones have started using hardcoded DNS resolvers, so the utility of this is limited Got a source for that? No phone or browser that I'm aware of uses "hardcoded DNS resolvers". They all use the OS DNS servers which the OS gets from DHCP.

brynx97 1y ago
https://support.mozilla.org/en-US/kb/firefox-dns-over-https https://support.mozilla.org/en-US/kb/firefox-dns-over-https By extension, any application or device could rely on DoH instead of OS-provided or network-provider DNS servers. It is controversial, since it both helps individuals combat ISP or government censorship and also helps bad actors do bad things [1]. [1]https://en.wikipedia.org/wiki/DNS_over_HTTPS#Analysis_of_DNS_traffic_for_security_purposes https://en.wikipedia.org/wiki/DNS_over_HTTPS#Analysis_of_DNS...
- elric 1y ago
  DoH in Firefox is off by default (at least in every FF I've ever installed). And it's not hardcoded to any specific DNS server, you can use whichever provider you like.

ethan_smith 1y ago

You can still block at network level by configuring your router to intercept all port 53 traffic, redirect DNS-over-HTTPS using firewall rules for known DoH providers, and employ TLS inspection on your gateway for complete control.