5 ms·

Here's an idea/concern -- for those of us NOT using our ISP's recursive DNS what will this notification plan look like? My ISPs notifications (as in an inters

Here's an idea/concern -- for those of us NOT using our ISP's recursive DNS what will this notification plan look like? My ISPs notifications (as in an interstitial page) won't show if I'm not using their DNS. Presumably if I'm using OpenDNS or Google DNS for my recursive DNS it's going to be impossible to browse my interwebs if this ever happens. I'd need to assume this might be the case, and then switch back to the ISP's recursive DNS just to proceed through their acknowledgement page. Derp.

smtddr 14y ago
Well, it is possible to capture and redirect DNS requests such that they can send you to their "captive-portal" page even if you've changed your DNS settings. On linux for example, something like: iptables -t nat -A PREROUTING -i eth0 -p udp --dport 53 -j DNAT --to 10.2.2.1 will send all your DNS requests to 10.2.2.1 no matter what your actual destination IP was. If Comcast did something like this at their level, it wouldn't matter what your router/modem DNS setting was. This is assuming you're destination port is still 53.
- xxdesmus 14y ago
  That's a great point. Thanks for mentioning this.
- wtallis 14y ago
  Does DNSSEC interfere with this? Comcast claims to have deployed DNSSEC on their DNS servers. Can they deliver their redirect even if your resolver is configured to validate DNSSEC records?
  - icebraining 14y ago
    Sure. They can't serve you wrong DNS results, but they can just redirect your IP packets directed at some server to theirs. Or to paraphrase the Matrix, what good is knowing the right IP of a server, if you're unable to reach it?
    - tssva 14y ago
      DNSSEC doesn't prevent them from serving you false DNS results. DNSSEC doesn't protect the communication between your resolver and the DNS server. DNSSEC allows for signing DNS entries with keys. Since a large portion of DNS isn't signed in order to function on the Internet most resolvers with DNSSEC enabled will still allow results from domains which aren't signed for instance google.com. The easiest thing for Comcast to do is to return their false result indicating that the domain is not signed. Since they can intercept all DNS traffic you send they could actually emulate all the way up to the root servers and sign with keys they generated themselves. This is probably overly complex but is possible and would allow a false dns entry to be accepted even by resolvers configured to only accept responses for domains which are signed.
      - throwaway2048 14y ago
        >Since they can intercept all DNS traffic you send they could actually emulate all the way up to the root servers and sign with keys they generated themselves. This is probably overly complex but is possible and would allow a false dns entry to be accepted even by resolvers configured to only accept responses for domains which are signed. this is not how DNSSEC works, if it did work this way it would be trivial for anyone to mitm it, thus render its entire purpose null and void. Resolvers are preloaded with the dns root public key, that key signs the tld root keys, which sign your registrars key, which sign your domain. There is no effective way for comcast to spoof replies in this setup, as they have no access to any of these private keys.
tssva 14y ago
Your ISP could block all traffic except DNS and port 80. They can then redirect your port 80 traffic to their servers using one of several methods such as WCCP, inline transparent cache,switch with transparent cache redirection, policy routing or a device which NATs your outbound traffic to external IPs to the IP of their internal server.

smtddr 14y ago

Well, it is possible to capture and redirect DNS requests such that they can send you to their "captive-portal" page even if you've changed your DNS settings. On linux for example, something like: iptables -t nat -A PREROUTING -i eth0 -p udp --dport 53 -j DNAT --to 10.2.2.1 will send all your DNS requests to 10.2.2.1 no matter what your actual destination IP was. If Comcast did something like this at their level, it wouldn't matter what your router/modem DNS setting was. This is assuming you're destination port is still 53.

xxdesmus 14y ago
That's a great point. Thanks for mentioning this.
wtallis 14y ago
Does DNSSEC interfere with this? Comcast claims to have deployed DNSSEC on their DNS servers. Can they deliver their redirect even if your resolver is configured to validate DNSSEC records?
- icebraining 14y ago
  Sure. They can't serve you wrong DNS results, but they can just redirect your IP packets directed at some server to theirs. Or to paraphrase the Matrix, what good is knowing the right IP of a server, if you're unable to reach it?
  - tssva 14y ago
    DNSSEC doesn't prevent them from serving you false DNS results. DNSSEC doesn't protect the communication between your resolver and the DNS server. DNSSEC allows for signing DNS entries with keys. Since a large portion of DNS isn't signed in order to function on the Internet most resolvers with DNSSEC enabled will still allow results from domains which aren't signed for instance google.com. The easiest thing for Comcast to do is to return their false result indicating that the domain is not signed. Since they can intercept all DNS traffic you send they could actually emulate all the way up to the root servers and sign with keys they generated themselves. This is probably overly complex but is possible and would allow a false dns entry to be accepted even by resolvers configured to only accept responses for domains which are signed.
    - throwaway2048 14y ago
      >Since they can intercept all DNS traffic you send they could actually emulate all the way up to the root servers and sign with keys they generated themselves. This is probably overly complex but is possible and would allow a false dns entry to be accepted even by resolvers configured to only accept responses for domains which are signed. this is not how DNSSEC works, if it did work this way it would be trivial for anyone to mitm it, thus render its entire purpose null and void. Resolvers are preloaded with the dns root public key, that key signs the tld root keys, which sign your registrars key, which sign your domain. There is no effective way for comcast to spoof replies in this setup, as they have no access to any of these private keys.

tssva 14y ago

Your ISP could block all traffic except DNS and port 80. They can then redirect your port 80 traffic to their servers using one of several methods such as WCCP, inline transparent cache,switch with transparent cache redirection, policy routing or a device which NATs your outbound traffic to external IPs to the IP of their internal server.