Top
Best
New

Posted by frostbyte7 1 day ago

So my ISP was hijacking my DNS(www.karthihegde.dev)
163 points | 117 commentspage 3
ck2 4 hours ago|
ISP can still see exit IP unless you VPN

Cloudflare Warp is handy, complete tunnel even if not as private as real VPN

since 80% of the web is on cloudflare it accidentally makes it faster anyway

and you don't have to use the cloudflare client, you can use Wireguard

Tepix 11 hours ago||
Why not start by

1. contact the ISP and ask wtf they are doing

2. switch ISPs

esskay 11 hours ago||
How do you think that conversation will go? You phone them, get put through to the call center and surprise surprise its not covered by their script.
asdff 11 hours ago|||
Switching too is funny. You are at the mercy of what isp ran a line to you. Starlink will fully cooperate with government too. They are a military contractor after all and also at the mercy of musk deciding dumb stuff.
mgoetzke 9 hours ago|||
well after going down a few levels of tech support you do get to someone that 'does nothing' while it the magically works
fg137 2 hours ago||
You make it sound like switching ISP is an option in every part of the world.
netsharc 11 hours ago||
Yum, screenshots of terminal windows, which is just text...

Edit: oh wait, it finally loaded, 3x3MB images of text with scenery in the background!

bradknowles 13 hours ago||
Another reason to use a VPN you can trust, across your entire network and at all times.
thesuitonym 3 hours ago||
A VPN just moves the attack vector from the ISP to the VPN provider, it doesn't protect you from this in any way at all. Better to use an ISP you trust, though that's difficult to find.

I don't trust any public VPN provider because they all start off by lying about what their product does.

asdff 11 hours ago|||
But the isp sits between that no?
throwawayffffas 10 hours ago||
All traffic to the VPN is encrypted, including DNS queries.

All your ISP can tell is you are using a VPN.

asdff 9 hours ago||
What about TLS inspection?
Geezus_42 3 hours ago|||
Not unless they can break your VPN's encryption. Which, if your ISP can do that, you have bigger problems.
pjc50 8 hours ago|||
What about it? Unless they've hijacked your local cert store somehow (which corporate machines do), they can't see inside the TLS. They can detect that you're connecting to somewhere and probably infer that it's some VPN, but only the most repressive countries actually block VPNs altogether.
ozim 12 hours ago||
So a VPN you set up and run yourself.
asdff 11 hours ago||
Isn’t that the same as no vpn with extra steps? You are tunneling traffic from a computer you own to a computer you also still own. Third party vpn the whole point is I don’t run it.
khafra 10 hours ago||
If you set up a VPN endpoint on a Hetzner box, you're trusting Hetzner not to MITM your DNS queries. They're likely more trustworthy than your local ISP (although that leaves you more identifiable to folks running the servers or snooping on server-side traffic, and Cloudflare will hate you). That threat model tradeoff is good for many people.
throwawayffffas 10 hours ago|||
Given the OP use case, you are going to get a letter from Hetzner at some point.
dspillett 7 hours ago|||
Not if they are only using it to route the DNS traffic (though in that case a cheaper VPS might be better), which will work if the ISP is only poisoning DNS replies and not (which is often the case) blocking traffic to the target servers entirely.

The problem with this is you are adding a moving part to your DNS lookups. It might be worth adding two on separate VPS hosts and have your resolver fall back to the second if the first goes down.

Another, usually more minor, problem is that some services (like CDNs) use the source of your DNS query to modify the response so you get sent to a topologically near-by end-point. This means you might notice such services being slower as you are sent to a PoP near your VPN host not one closer to your actual location.

ozim 8 hours ago|||
Oh well OP was doing shady stuff ... then yeah they should continue with using VPN provider. VPN providers are shady AF, I don't think there is VPN provider I would trust more than my local internet provider.
asdff 10 hours ago|||
Well that wouldn’t be running your own vpn. Hetzner is. They’d let you do this? Seedbox is against their tos hard to imagine they’d be a good choice to run a vpn for your linux isos.
konart 8 hours ago||
> They’d let you do this?

Can't speak for Hetzner, but considering VPN use in Russia and China - I'd imagine most EU\US vps providers have someone's 3x-ui, remnawave or naked v2ray installed.

Plus - how are they going to detect your remnawave node sitting on 443 port? For them it's just some traffict.

And if you are worried about the amount (torrents) - you don't really need to torrent though them. You just need an access to a torrect tracker to get your magnet link and meta info.

Most default configs for 'ray have torrents locks for this very reason - you communicate with other people (seeds\peers) directly.

gruez 8 hours ago||
>Plus - how are they going to detect your remnawave node sitting on 443 port? For them it's just some traffict.

What about all the outgoing traffic? That's going to be hard to mask unless you have another VPN for outbound

konart 6 hours ago||
But what's wrong with my VPN talking to, say, youtube (blocked in Russia) or some torrent site (for example to fetch RSS feed of new releases).

Fedora, for example, provides torrent access (including RSS feed) for its releases: https://fedoraproject.org/torrents/45/

z3t4 12 hours ago|
The story ended before it even started... What are the machine with the wrong IP doing? Is it just forwarding the request, or what is happening?