Blocking your ISP DNS
-
I am guessing this is a stupid question but I was just thinking out loud.
I wonder If you could block your own ISP's DNS IP's ???
I got 2 like 192.168.9.100 and 192.168.3.100
We all know that the ISP is watching everything we do online so I was wondering if it was possible to block them 2 server IP's and just use other DNS's like Comodo DNS and so on.
Or do you have to have your ISP's DNS to use say Comodo free DNS IP's ???
Just a thought ;)
-
Unless your ISP is "redirecting" all DNS queries to his own DNS, you can use/set whatever DNS you like/want.
-
@ptt:
Unless your ISP is "redirecting" all DNS queries to his own DNS, you can use/set whatever DNS you like/want.
Interesting I think ill do some testing ;)
Many thanks
-
And the ISP, if they are so inclined, can pcap everything you query there too.
-
You understand out of the box pfsense doesn't use your ISP dns, unless they are authoritative for some domain your wanting to lookup.
Out of the box pfsense uses unbound in as resolver. It walks down from roots to talk to the authoritative NS for the domain your asking about. It does not ask your ISP dns anything.. So unless you changed it to forwarder mode or are using dnsmasq (forwarder) vs unbound your ISP dns would never get asked anything.
-
If you're paranoid (like I am), just make firewall rules that only allows DNS from Pfsense.
Here:
https://doc.pfsense.org/index.php/Blocking_DNS_queries_to_external_resolvers
-
Many thanks for your excellent replies :)
I have done it and I am still online lol
I am using the Comodo DNS ips and started doing it in PfBocker but then reading the posts done it correctly I think and it all seems ok so far.It don't really matter as I have always used Nord VPN but I will never forget my ISP telling me something that made me angry, the guy on the phone boasted saying he can see everything, this was many years ago but still privacy is now a nightmare online so thank god for PfSense and packages like PfBlocker.
Im in the UK on Virgin Media btw just encase there are any uk guys reading this ;)
cheers guys thank for the link and your input.
all the best.
Check out my website as I am building a page for all the links you may want for PfBlocker im going to be doing my own UK ones as well like the BBC, government and so on ;) ant-techs.is
Thank you all
-
Who is to say the other DNS providers don't track you? The whole business thing these days is big data, once you have to interact with the world, bye-bye privacy.
-
Who is to say the other DNS providers don't track you? The whole business thing these days is big data, once you have to interact with the world, bye-bye privacy.
100% True !! I totally agree, I bet even all free DNS's are in it to.
You can say the same thing about VPN's now and I don't trust any of them but NordVPN's policy is not to keep logs of their users and IPvanish say the same But they could be lying to.Even Tor can be compromised with the nodes.
The great thing about PfSense and PfBlocker is at least you can block as much as possible and more of a chance of privacy than the general public.
Sadly its only going to get worse.
Cheers ;)
-
"100% True !! I totally agree, I bet even all free DNS's are in it to. "
Then why don't you just resolve.. Are the root servers in in on too? When you resolve you ask the roots for the NS of the domain your looking for, then you directly act the authoritative ns for that domain.. You do not forward all your queries to some specific name servers..
And you can limit your queries to the roots for only the specifics.. Ie you don't ask root for www.domain.com you ask for .com ns, then you ask .com ns for domain.com - but I found this to be very problematic with many domains that do delegation, etc.. microsoft technet had all kinds of problems if I recall.
there was a whole thread about turning this feature on..
qname-minimisation
If your interested in such a thing.