Hacker News Reader

Comment by Semaphor | Hacker News Reader

It depends, but DNS lists are by far the most common, and you can indeed circumvent it by using another DNS server.

Changing DNS servers will not get around the UK ISP “adult content blocks” in my experience, but using a VPN will.

Generally it’s a good idea to disable ISP content blocking if you can, because they can cause all kinds of problems (slowdowns, false positives).

I can get around Sky Broadband's block on Libgen by just using Libgen's IP, for example.

How do they do that? IP Lists?

Probably TLS SNI inspection

Huh. I thought that was encrypted, but apparently we aren’t ESNI yet.

Even with secure DNS, the SNI part is passed as plain text for the ISP to intercept and block.

Wouldn't they just block outside DNS?

They can't block a customer-premises recursive resolver. But the SNI is on the TCP connection, not the DNS request; if you have that sort of ISP, they can filter based on SNI.

Why would the location of the DNS resolver matter? If I am running a local DNS resolver, presumably it recurses to an outside DNs server. If my ISP blocks that, I can't use it.

It recurses to the root, and then down the tree. So yes - the final query is a lookup for the name you are targeting, and yes, it goes through your ISP, like all your other traffic.

But it doesn't go through your ISPs DNS infrastructure, it goes direct to the nameserver for the parent domain. And even that doesn't happen if your local resolver has the result cached. The easiest way to block DNS lookups is at the DNS server; using DPI to block DNS lookups is straying into sledgehammer/nut territory.

Yeah, but isn't that laughably easy to block such a scheme? If a packet is destined for port 53 that isn't the ISPs DNS server, poof it's gone!

You're right; that's a very simple firewall rule. But if I can't access a working DNS server over the internet, then I don't have internet service, and whatever kind of provider I have, it's not an "internet service provider".

Each ISP get's to make its own rules, but its the norm where I've lived to have some services blocked. For example, my ISP blocks GRE. At least one in the past I had blocked inbound SMTP & DNS.

Fine. I just don't call that "internet service". That's some kind of walled-garden internet-lite, conceptually the same as the old AOL.

Or just redirect any outbound port-53 traffic to the ISP's DNS which will pretend to be the server you're talking to while silently applying the filtering.

Reply on news.ycombinator.com