3 ms·

Both the DNS and the transparent proxy sound like an interesting way to improve the web at home (I'm thinking specifically of an iPhone on my WiFi) -- do you ha

Both the DNS and the transparent proxy sound like an interesting way to improve the web at home (I'm thinking specifically of an iPhone on my WiFi) -- do you have more information about how you did these things?

Nanzikambe 12y ago
I use a chrooted instance of Bind as it's a LAN only dns server, /etc/bind/named.conf includes: include "/etc/bind/adblock.conf"; That file is generated by a script that uses a hosts file maintained on http://someonewhocares.org/hosts/ http://someonewhocares.org/hosts/ the script is something like: #!/bin/bash cat /etc/bind/adblock.conf | xz -z - > /etc/bind/adblock.conf-$(date "+%Y%m%d-%H%M%S").xz echo "" > /etc/bind/adblock.conf curl -o - http://someonewhocares.org/hosts/ | sed -rn 's:^127\.0\.0\.1 ([^ #\t]+).*$:\1:p' > /tmp/addrs.txt cat /tmp/addrs.txt | while read line; do ! egrep -i $line /etc/bind/whitelist.txt >/dev/null \ && echo 'zone "'${line}'" IN { type master;notify no; file "/etc/bind/pri/adblock.zone";};' >> /etc/bind/adblock.conf done which can be called from cron or similar (if you do you need to reload/SIGHUP bind to reload its condiguration) you can whitelist stuff by adding a FQDN to /etc/bind/whitelist.txt The file /etc/bind/pri/adblock.zone contains something like: @ 1 IN SOA localhost. root.localhost. (1000 7200 120 1209600 3600) @ 259200 IN NS localhost. * 259200 IN A X.X.X.X @ 2 IN A X.X.X.X where X.X.X.X is an IP on different (but private and not internet routable) subnet, and iptables rules something like: iptables -N DNSBLACKHOLE iptables -A DNSBLACKHOLE -j LOG --log-prefix "DNSBLACKHOLE ::" iptables -A DNSBLACKHOLE -j REJECT iptables -A OUTPUT -p all -d X.X.X.X -j DNSBLACKHOLE iptables -A FORWARD -p all -d X.X.X.X -j DNSBLACKHOLE Transparent proxying is accomplished by iptables rules redirecting port 80 and 443 through SQUID which essentially performs a MITM, you can find out how to do this here: http://blog.davidvassallo.me/2011/03/22/squid-transparent-ssl-interception/ http://blog.davidvassallo.me/2011/03/22/squid-transparent-ss... Edit: it's also worth mentioning I transparently redirect all DNS traffic the router sees to my own bind instance, so untrusted devices are unable to use an alternative dns server.
- verisimilitude 12y ago
  Thank you very very much for taking the time to write this up!

Nanzikambe 12y ago

I use a chrooted instance of Bind as it's a LAN only dns server, /etc/bind/named.conf includes: include "/etc/bind/adblock.conf"; That file is generated by a script that uses a hosts file maintained on http://someonewhocares.org/hosts/ http://someonewhocares.org/hosts/ the script is something like: #!/bin/bash cat /etc/bind/adblock.conf | xz -z - > /etc/bind/adblock.conf-$(date "+%Y%m%d-%H%M%S").xz echo "" > /etc/bind/adblock.conf curl -o - http://someonewhocares.org/hosts/ | sed -rn 's:^127\.0\.0\.1 ([^ #\t]+).*$:\1:p' > /tmp/addrs.txt cat /tmp/addrs.txt | while read line; do ! egrep -i $line /etc/bind/whitelist.txt >/dev/null \ && echo 'zone "'${line}'" IN { type master;notify no; file "/etc/bind/pri/adblock.zone";};' >> /etc/bind/adblock.conf done which can be called from cron or similar (if you do you need to reload/SIGHUP bind to reload its condiguration) you can whitelist stuff by adding a FQDN to /etc/bind/whitelist.txt The file /etc/bind/pri/adblock.zone contains something like: @ 1 IN SOA localhost. root.localhost. (1000 7200 120 1209600 3600) @ 259200 IN NS localhost. * 259200 IN A X.X.X.X @ 2 IN A X.X.X.X where X.X.X.X is an IP on different (but private and not internet routable) subnet, and iptables rules something like: iptables -N DNSBLACKHOLE iptables -A DNSBLACKHOLE -j LOG --log-prefix "DNSBLACKHOLE ::" iptables -A DNSBLACKHOLE -j REJECT iptables -A OUTPUT -p all -d X.X.X.X -j DNSBLACKHOLE iptables -A FORWARD -p all -d X.X.X.X -j DNSBLACKHOLE Transparent proxying is accomplished by iptables rules redirecting port 80 and 443 through SQUID which essentially performs a MITM, you can find out how to do this here: http://blog.davidvassallo.me/2011/03/22/squid-transparent-ssl-interception/ http://blog.davidvassallo.me/2011/03/22/squid-transparent-ss... Edit: it's also worth mentioning I transparently redirect all DNS traffic the router sees to my own bind instance, so untrusted devices are unable to use an alternative dns server.

verisimilitude 12y ago
Thank you very very much for taking the time to write this up!