Hacker News Reader

Comment by adamrezich | Hacker News Reader

It's not mentioned in this article but from what I understand (and someone please correct me if I'm wrong), "blocking" is happening at the ISP DNS level, and anyone living in these affected areas can simply use a different DNS service to continue using these websites unimpeded.

View on HN

That is correct. A decent method of side-stepping ISP DNS is to run Unbound DNS on your home router or a server in your home, if you can.

An example snippet from the configuration in Unbound DNS would look like this:

    forward-zone:
      name: "."
      forward-addr: 1.1.1.1         # CloudFlare
      forward-addr: 1.0.0.1         # CloudFlare
      forward-addr: 8.8.8.8         # Google
      forward-addr: 8.8.4.4         # Google
      forward-addr: 208.67.222.222  # OpenDNS
      forward-first: no

And you can view it's status with unbound-control:

    unbound-control dump_infra | grep 1\.1\.1
    1.1.1.1 . ttl 1745 ping 0 var 71 rtt 284 rto 284 tA 0 tAAAA 0 tother 0 ednsknown 1 edns 0 delay 0 lame dnssec 0 rec 0 A 0 other 0

This method of caching can also slightly improve the privacy of the people using your network. You get the bonus of a local low latency cache, and requests are distributed among multiple destinations, slightly reducing the marketing benefits of running those public DNS servers.

You can also enable TCP and TLS for recursive servers that support DoT (DNS over TLS). I prefer this over DoH, as everything in your home can benefit from it, not just your browser. Some of the servers mentioned above listen on TCP 853 for TLS. Just google "Unbound DNS TLS" There are some examples on Calomel as well. [1]

[1] - https://calomel.org/unbound_dns.html

Here is an example using TLS:

    forward-zone:
      name: "."
      forward-ssl-upstream: yes
      forward-addr: 208.67.222.222@853
      forward-addr: 1.1.1.1@853
      forward-addr: 8.8.4.4@853
      forward-addr: 9.9.9.9@853
      forward-first: no

    unbound-control dump_infra|cut -c 1-60|column -t
      9.9.9.9@853         .  ttl  851  ping  6    var  84    rtt  342   rto  342  tA  0  tAA
      8.8.4.4@853         .  ttl  851  ping  13   var  79    rtt  329   rto  329  tA  0  tA
      208.67.222.222@853  .  ttl  844  ping  876  var  1823  rtt  8168  rto

And here [1] [2] are a small list of public servers that support DoT

[1] - https://en.wikipedia.org/wiki/Public_recursive_name_server

[2] - https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Public+Re...

Is it so simple?

I stare at my iphone and start to wonder where I get to change my dns settings...? So I've just spent five minutes poking around and I haven't found it yet. So I've just googled it, and apparently you need 3rd-party apps to do it...

Now, interestingly, I could imagine kids doing it rote if someone just tells them how to install the an access-4chan app etc. For example, a couple of years ago I watched in horror as a 10yo friend of my kids demonstrated how to download an app (not from the app store) that would create a vpn to stop the app-store from being able to connect and discovering and uninstalling all the pirated games this kid then proceeded to install for my grateful kids! And her hands flew over the screen, tapping away and typing in English, which is a language she didn't speak let alone write in! Amazing rote. And very scary to tidy up after her!

So yeah, kids will probably circumvent this kind of thing even if parents can't.

>I stare at my iphone and start to wonder where I get to change my dns settings...? So I've just spent five minutes poking around and I haven't found it yet. So I've just googled it, and apparently you need 3rd-party apps to do it...

Took me about 30 seconds. Settings -> Wifi -> Tap the info icon for the network you're on -> Configure DNS.

WiFi - yes. For cellular net it wa completely impossible for last 10 years, until Apple finally came to its senses hence Cloudflare’s app.

And that's sort of the thing about these bans. They aren't about expunging content from the Internet---that's basically impossible---they're about increasing the activation energy of seeking it out (and, perhaps, making the behavior of the devices used to seek it out different enough from "common traffic" that it's a lot easier for state intelligence agencies to zero in on the participants).

These sites are blocked by IP. To circumvent you need TOR, proxy, or VPN.

Reply on news.ycombinator.com