Hacker News Reader

Comment by h4kunamata | Hacker News Reader

Australia isn't different, but homelab is my jam so solutions were implemented :)

1. Nginx Proxmox LXC container with domains that require digital ID such as X. I can easily add or remove domains to it via Ansible.

2. Mullvad VPN server/client setup on OPNSense

3. OPNSense Firewall rules with aliases from the local lists from step 1

4. Every time I access X or whatever, OPNSense firewall rule redirects that traffic via the Mullvad VPN Gateway bypassing the digital ID enforcement

5. I host Pihole + Unbound recursive DNS so I have full control over my DNS. Recursive DNS uses the 13 root nameserver, I do not use public DNS such as Google or whatever, in fact, they are all blocked.

My data under my control.

View on HN

>I do not use public DNS such as Google or whatever, in fact, they are all blocked.

Honestly surprised that works given Google loves to hardcode DNS queries using their DNS Resolver into many things (Google TV, Android, etc).

I'm assuming you are using NAT Redirection (Port 53), blocking DNS over TLS - DoT (TCP Port 853), using SNI FIltering to block DNS Over HTTP (DoH). Not sure how you handle Encrypted Client Hello.

>Honestly surprised that works given Google loves to hardcode DNS queries using their DNS Resolver into many things (Google TV, Android, etc).

My Samsung smartTV has Google DNS hardcoded in it, that is why I do what I do.

No matter if I set my phone DNS to Google, OPNSense NAT redirects any DNS to Piholes only, and since public DNS, DNS-over-TLS and DNS-over-HTTPS are blocked, only Piholes forward it to Unbound. Only Unbound can request DNS and OPNSense enforces that.

Unbound is recursive DNS with is own caching so everything happens localy, surfing the internet is insane fast.

As for the digital ID, the DNS happens locally but the traffic is forward to Mullvad VPN Gateway.

I don't wanna hide my traffic, I just don't wanna this mass survilance on my personal information. My social media accounts are burner, no real name, no photos, minimal apps installed on my GrapheneOS phone and I have a complete normal digital life without sharing my shit haha

> ..., DNS-over-HTTPS are blocked

Not trying to be facetious, but how do you know you are blocking them all? I thought one of the reasons for using DNS-over-HTTPS was to be able to avoid detection.

You aer mixing two things together, and popular misundertanding: You cant never truly hide your DNS requests, your ISP can still see the traffic.

There are plenty of videos showing how you can use WireShark within your network to identify packages flagged as DNS, no matter if DNS, DOT, DOH, they have identifiers making it easier to identify them by analysing the packages. You just need to know how.

If your ISP really wanna know what you are accessing, they can, DOH isn't VPN.

1. Icannot just block 443, I have an aliases with every known public DOT and DOH on OPNSense

2. The firewall blocks any requests to those IPs on port 443-DOH and 853-DOT

If I type on my browser 8.8.8.8:443, it does not work and OPNSense firewall log shows the block message, so DOT:853 and DOH:443 are fully blocked.

Side note, I do agree with under 16 being denied access to social media.

Spend 5 minutes on X, Instagram or even worse Snapchat for you to see what these minors are doing. A lot generation, all for likes.

GenZ is so cooked, by the time they reach their 30s, damn.

Gen Alpha being born within the digital and AI world is even more cooked.

I don't think social media is any healthier just because people are older, I'd rather just ban them outright.

And from what I remember of the coverage of the scientists presenting their case in the UK there wasn't enough evidence to say whether it had an impact on children.

Personally I think ipad as babysitter is more to blame, but until the proper studies are done it's all just speculation.

>Personally I think ipad as babysitter is more to blame, but until the proper studies are done it's all just speculation.

Proper study??

Look around us, kids are talking to ChatGPT instead of running, playing, instead of being kids.

Kids cannot speak and yet have a tablet to interact with, by adulthood those kids are cooked.

Teens at school can't read, they have been using ChatGPT to cheat exams. If somebody tells me that more study is required to prove what is right there in from of our eyes, that somebody is part of the problem, full stop!!

>Look around us, kids are talking to ChatGPT instead of running, playing, instead of being kids

Isn't that a symptom of other things? I'm an elder 'millenial' playing out was already decreasing when all we had was a nes and 4 channels on TV.

Unfortunately now we have to 'protect' kids from the dangers outside. Which necessarily means them spending time inside.

Millennials never spent like >6-8 hours a day on phones doing nothing productive.

Yes, as adults we now spend loads of time in our places of work on devices but generally in the pursuits of doing productive things.

And while I haven't looked up the stats, I don't feel like it's exceedingly more dangerous for kids to play outside today than it was back in the 00's, 90's, 90's etc. I just feel as though we're more aware of the dangers of what _could_ happen to kids - all of which is a facet of the media/social media pressure and scaremongering.

Plus there are still loads of feral kids allowed to roam around and be little shits anyway.

>Unfortunately now we have to 'protect' kids from the dangers outside. Which necessarily means them spending time inside.

That is the biggest bullsh1t of today's society, we aren't protecting the kids, it is the governments starting mass surveillance and before you call me a conspiracy theorist, looks what is happening world wide.

This is how it all started:

1. Australian activist group Collective Shout went after Steam +18 games to protect the kids

2. Steam ignored them so they used their political influence to go after Master/Visa/Paypal

3. Master/Visa/Paypal went after Steam which removed thousands of games bankrupting developers worldwide

4. UK pushed digital ID the following week, Collective Shout was the opportunity they all needed.

5. Countries worldwide followed suit

Mind you that same Collective Shout group supported a movie on Netflix showing kids being s*xual1zed.

People do not understand how serious this is, these services are now getting breached, your passport, photo, address, phone, etc, is all over the network.

Being victim of identity theft is the easiest thing in 2026, you trying to prove that you are you while somebody else being you is pulling your life apart.

When I tried implementing something like this at some point, I found it impossible to actually implement reliably because DNS resolution changes all the time.

Unless you dynamically add rules as you resolve DNS requests and before responding to them, which seems painful to pull off.

Or do you point DNS records for the relevant domains at a proxy server, and have that server inspect SNI, look up the actual DNS records, and then tunnel the traffic? But this would rely on SNI which isn't a requirement (although it's probably always there...).

Reply on news.ycombinator.com