5 ms·

Actually this very rarely happens. I a DNS server on my router which has zone that routes all ad hosting & other wanted stuff to an IP which is then rejected b

Actually this very rarely happens. I a DNS server on my router which has zone that routes all ad hosting & other wanted stuff to an IP which is then rejected by the firewall. I also have a transparent proxy rewriting all web pages removing IFRAMEs - this does ocassionally break things, but it's extremely rare to find a site that actually has a use for them other than serving ads.

verisimilitude 12y ago
Both the DNS and the transparent proxy sound like an interesting way to improve the web at home (I'm thinking specifically of an iPhone on my WiFi) -- do you have more information about how you did these things?
- Nanzikambe 12y ago
  I use a chrooted instance of Bind as it's a LAN only dns server, /etc/bind/named.conf includes: include "/etc/bind/adblock.conf"; That file is generated by a script that uses a hosts file maintained on http://someonewhocares.org/hosts/ http://someonewhocares.org/hosts/ the script is something like: #!/bin/bash cat /etc/bind/adblock.conf | xz -z - > /etc/bind/adblock.conf-$(date "+%Y%m%d-%H%M%S").xz echo "" > /etc/bind/adblock.conf curl -o - http://someonewhocares.org/hosts/ | sed -rn 's:^127\.0\.0\.1 ([^ #\t]+).*$:\1:p' > /tmp/addrs.txt cat /tmp/addrs.txt | while read line; do ! egrep -i $line /etc/bind/whitelist.txt >/dev/null \ && echo 'zone "'${line}'" IN { type master;notify no; file "/etc/bind/pri/adblock.zone";};' >> /etc/bind/adblock.conf done which can be called from cron or similar (if you do you need to reload/SIGHUP bind to reload its condiguration) you can whitelist stuff by adding a FQDN to /etc/bind/whitelist.txt The file /etc/bind/pri/adblock.zone contains something like: @ 1 IN SOA localhost. root.localhost. (1000 7200 120 1209600 3600) @ 259200 IN NS localhost. * 259200 IN A X.X.X.X @ 2 IN A X.X.X.X where X.X.X.X is an IP on different (but private and not internet routable) subnet, and iptables rules something like: iptables -N DNSBLACKHOLE iptables -A DNSBLACKHOLE -j LOG --log-prefix "DNSBLACKHOLE ::" iptables -A DNSBLACKHOLE -j REJECT iptables -A OUTPUT -p all -d X.X.X.X -j DNSBLACKHOLE iptables -A FORWARD -p all -d X.X.X.X -j DNSBLACKHOLE Transparent proxying is accomplished by iptables rules redirecting port 80 and 443 through SQUID which essentially performs a MITM, you can find out how to do this here: http://blog.davidvassallo.me/2011/03/22/squid-transparent-ssl-interception/ http://blog.davidvassallo.me/2011/03/22/squid-transparent-ss... Edit: it's also worth mentioning I transparently redirect all DNS traffic the router sees to my own bind instance, so untrusted devices are unable to use an alternative dns server.
  - verisimilitude 12y ago
    Thank you very very much for taking the time to write this up!

verisimilitude 12y ago

Both the DNS and the transparent proxy sound like an interesting way to improve the web at home (I'm thinking specifically of an iPhone on my WiFi) -- do you have more information about how you did these things?

Nanzikambe 12y ago
I use a chrooted instance of Bind as it's a LAN only dns server, /etc/bind/named.conf includes: include "/etc/bind/adblock.conf"; That file is generated by a script that uses a hosts file maintained on http://someonewhocares.org/hosts/ http://someonewhocares.org/hosts/ the script is something like: #!/bin/bash cat /etc/bind/adblock.conf | xz -z - > /etc/bind/adblock.conf-$(date "+%Y%m%d-%H%M%S").xz echo "" > /etc/bind/adblock.conf curl -o - http://someonewhocares.org/hosts/ | sed -rn 's:^127\.0\.0\.1 ([^ #\t]+).*$:\1:p' > /tmp/addrs.txt cat /tmp/addrs.txt | while read line; do ! egrep -i $line /etc/bind/whitelist.txt >/dev/null \ && echo 'zone "'${line}'" IN { type master;notify no; file "/etc/bind/pri/adblock.zone";};' >> /etc/bind/adblock.conf done which can be called from cron or similar (if you do you need to reload/SIGHUP bind to reload its condiguration) you can whitelist stuff by adding a FQDN to /etc/bind/whitelist.txt The file /etc/bind/pri/adblock.zone contains something like: @ 1 IN SOA localhost. root.localhost. (1000 7200 120 1209600 3600) @ 259200 IN NS localhost. * 259200 IN A X.X.X.X @ 2 IN A X.X.X.X where X.X.X.X is an IP on different (but private and not internet routable) subnet, and iptables rules something like: iptables -N DNSBLACKHOLE iptables -A DNSBLACKHOLE -j LOG --log-prefix "DNSBLACKHOLE ::" iptables -A DNSBLACKHOLE -j REJECT iptables -A OUTPUT -p all -d X.X.X.X -j DNSBLACKHOLE iptables -A FORWARD -p all -d X.X.X.X -j DNSBLACKHOLE Transparent proxying is accomplished by iptables rules redirecting port 80 and 443 through SQUID which essentially performs a MITM, you can find out how to do this here: http://blog.davidvassallo.me/2011/03/22/squid-transparent-ssl-interception/ http://blog.davidvassallo.me/2011/03/22/squid-transparent-ss... Edit: it's also worth mentioning I transparently redirect all DNS traffic the router sees to my own bind instance, so untrusted devices are unable to use an alternative dns server.
- verisimilitude 12y ago
  Thank you very very much for taking the time to write this up!