3 ms·

From what I've read it is speculated that NetFlix is now doing nslookups within the actual client with a internal whitelist of DNS servers; ie the client no lon

From what I've read it is speculated that NetFlix is now doing nslookups within the actual client with a internal whitelist of DNS servers; ie the client no loner trusts the results from the system configured resolvers and does spot checks. Workaround is simple really; null route the DNS servers at your router. I have to do this anyway to get chromecast working with UnblockUS as the chromecast is configured explictitly from the factory in a attempt to prevent these things. * create static route at router for 8.8.8.8/255.255.255.255 to your routers IP with metric of 2. Then do the same with 8.8.4.4. Note this disables querying googles DNS infrastructure on all devices connected on the network.

diminoten 12y ago
I'm not fully sure I understand this, so what this will do is the client will attempt and fail to check DNS, so it'll fall back to the DNS you're providing again?
- ghuntley 12y ago
  Configure your router with DHCP and instead of using the upstream DNS server from your ISP configure in the servers from UnblockUS. Additionally create a firewall rule or null static route that denies all network connectivity to 8.8.8.8 and 8.8.4.4. Under the above configuration the chromecast will obtain a IP address and the DNS resolver from the router. Chromecast devices provide no way to configure DNS servers and by default does not trust the responses from your router, instead it trusts and uses Google DNS servers, it's only when network connectivity is blocked does the chromecast "degrade" to using the DNS server provided by the router. If your router is good enough I highly suggest creating two networks by aliasing your uplink, then applying a firewall rule to the uplink that blocks the DNS servers and then tagging by MAC address all devices such as TV/Consoles etc. That way for day to day computering you can use your standard resolvers but traffic is from entertainment network/devices is forced to go out via your tagged uplink - which blocks google DNS and uses UnblockUS for resolution. Better security practice as it means you can be very specific as to what devices should be allowed to be man in the middled/traffic rewritten by UnblockUS. MITM your TV? who cares, MITM your workstation - yeah not a good idea.
deleted 12y ago
[deleted]

diminoten 12y ago

I'm not fully sure I understand this, so what this will do is the client will attempt and fail to check DNS, so it'll fall back to the DNS you're providing again?

ghuntley 12y ago
Configure your router with DHCP and instead of using the upstream DNS server from your ISP configure in the servers from UnblockUS. Additionally create a firewall rule or null static route that denies all network connectivity to 8.8.8.8 and 8.8.4.4. Under the above configuration the chromecast will obtain a IP address and the DNS resolver from the router. Chromecast devices provide no way to configure DNS servers and by default does not trust the responses from your router, instead it trusts and uses Google DNS servers, it's only when network connectivity is blocked does the chromecast "degrade" to using the DNS server provided by the router. If your router is good enough I highly suggest creating two networks by aliasing your uplink, then applying a firewall rule to the uplink that blocks the DNS servers and then tagging by MAC address all devices such as TV/Consoles etc. That way for day to day computering you can use your standard resolvers but traffic is from entertainment network/devices is forced to go out via your tagged uplink - which blocks google DNS and uses UnblockUS for resolution. Better security practice as it means you can be very specific as to what devices should be allowed to be man in the middled/traffic rewritten by UnblockUS. MITM your TV? who cares, MITM your workstation - yeah not a good idea.

deleted 12y ago

[deleted]