Hacker News Reader

Comment by squarefoot | Hacker News Reader

Some devices started to use hardcoded IPs to phone home, so purely domain name based blocklists won't work with them. Is there a similar project with upgradable IP lists to deal with them too? That would be technically a firewall, but then ideally it should also implement DNS based blocking since we're protecting also from the inside. It would be a nice product to build around any of those ARM small boards with dual Ethernet and WiFi such as the NanoPi R1 and similar ones.

View on HN

Not exactly what you’re asking but dnscrypt-proxy has IP based block lists. You list IPs and then any domain that resolves to one of those IPs is blocked. Works when companies setup domains that actually resolve to some 3rd party data tracker.

Actually blocking IPs as you’ve said is a harder problem sadly.

Why? If the devices use hardcoded IPs, then those should be fairly static so fairly easy to maintain in some list.

I'd think that the best workaround for doing these kinds of shenanigans will be using some form of DoH, in which case the countermeasure would be to set up an HTTP proxy which wouldn't allow http connections to "naked" IP addresses.

Blocking the IP means having something in the traffic flow. This would likely be a firewall if your aim is to block any "weird" connection from your network. But both firewalls and proxies are substantially more challenging than your run of the mill RaspberryPi Zero and PiHole.

That would be the goal. Malicious actors aren't going away anytime soon, so I would expect more and more devices in the future to use either encrypted or off standard DNS queries to different ports, if not downloading ads and uploading telemetry disguised as system upgrades. We'll likely get to a point in which we'll need to block connections address by address, in the hope they won't set up their malware on addresses and ports we can't block to keep the device functionality.

DNS based block lists are incredibly easy to implement and maintain and require very little resources. All of the complaints from corporate IT admins about DoH demonstrate this. (I believe Chrome still won't default to DoH for corporate managed browsers)

Any normal home users can setup dnscrypt-proxy or PiHole and have it 'protect' their whole home network, but actually filtering your whole network's traffic based on IP is out of reach for most.

Some routers (DD-WRT I think?) now can hijack any non-encrypted DNS queries and send them where you want. That will be my next step.

Yup, with the Adblock package on openwrt this was a one click option in the GUI. Doesn’t help with DoH unfortunately, but it definitely helps in general.

You can DNAT outbound port 53 connections to an internal server. Any router/firewall with configurable NAT can do this. This is a must with some smart TVs for example.

My Mikrotik router does this easily. You can tell it (with a Firewall NAT rule) "any outbound connection to port 53 is to be redirected to this internal IP and port" -- and this internal IP and port is where my PiHole is.

Reply on news.ycombinator.com