A German ISP tampered with their DNS - specifically to sabotage my website
lina.sh
One of Germany's biggest ISPs changed how their DNS works, right after I exposed an organization that they’re part of.

a year old, but interesting to read

  • Phoenixz@lemmy.caEnglish
    0·
    2 days ago

    So why isn’t this an article in regional and national newspapers, showing the rather sinister behavior of an organization that works to silence the free flow of information?

  • fdnomad@programming.devEnglish
    0·
    3 days ago

    Ey, du hast Linux installiert, du weißt ganz genau was du machen musst. Ändere einfach deine DNS Einstellungen, sodass du nicht mehr das DNS durch den Router beziehst.

    okay but I still need detailed instructions to follow step by step :(

      • diaphragmwp@discuss.tchncs.deEnglish
        0·
        2 days ago

        No. Not enough, still often overridden by router or whatever.

        Edit /etc/NetworkManager/NetworkManager.conf:

        [main]
dns=0
rc-manager=unmanaged
        Full file I suggest 
        # Configuration file for NetworkManager.
# See "man 5 NetworkManager.conf" for details.
[main]
hostname-mode=none
dns=0
rc-manager=unmanaged

[device]
wifi.scan-rand-mac-address=yes

[connection]
ethernet.cloned-mac-address=random
wifi.cloned-mac-address=random
connection.mdns=0
connection.llmnr=0

[ipv6]
addr-gen-mode=1
ip6-privacy=2

        And disable/delete “Avahi”.

        Restart NetworkManager twice. If you don’t know how, restart the computer twice. No, I don’t know why twice. Now, edit /etc/resolv.conf:

        nameserver 2001:470:1f15:b80::53
nameserver 91.190.185.43

        Servers grabbed from here: https://servers.opennic.org/ (OpenNIC itself is kinda barely holding but the servers are pretty good).

        Note that your browser will ignore this. Open up Firefox (or derivative), Settings, Privacy and security, DNS over HTTPS, Own settings, Own, and paste something like https://dns1.slowb.ro/dns-query into it. Again, you can grab a server from opennic (look into description for URL). No, you cannot use opennic.glue addresses here.

        Now, note that this may still be tampered with, if your ISP/government cares enough. Not in the browser, but system wide yes. In this case, you will have to use dnssec-proxy, route your DNS over I2P/Tor OR run your own resolver. In all of these scenarios, you will have to make sure the program providing it is listening on port 53 (and nothing else is taking it) then just make /etc/resolv.conf this instead:

        nameserver ::1
nameserver 127.0.0.1

        Obviously, all of this only affects DNS tampering and nothing else.

      • ScoffingLizard@lemmy.dbzer0.comEnglish
        0·
        2 days ago

        I use NextDNS. I’d pay but don’t exceed the limit of queries. Who has a paid option that are not assholes. (Love that sweet domain filtering)

        • glitch1985@lemmy.worldEnglish
          0·
          2 days ago

          If you have a spare raspberry pi and don’t mind an afternoon to get everything setup you could do what I have which is adguard home using the OISD block list and any other dns requests get resolved by unbound running on the same hardware so you’re your own dns server.

      • Captain_Stupid@lemmy.worldEnglish
        0·
        2 days ago

        I would more recommend Quad9 instead of google. It also has some Addblock and anti tracker functionality, it also supports dns sec and dns over https. https://quad9.net/ Here the default dns resolver 9.9.9.9

        • Victor@lemmy.worldEnglish
          0·
          1 day ago

          I’m happily using dnsforge.de. Free ad blocking at the DNS level. Makes silly mobile games incapable of showing their ads as well, as a bonus. Much better environment for my kids, because these ads be TRIPPIN yo.

        • glitch1985@lemmy.worldEnglish
          0·
          2 days ago

          I’ll have to remember 9.9.9.9 instead of 8.8.8.8 The only reason I remember is someone said 8.x was owned by Amazon the other day and I had to look it up to make sure I wasn’t crazy.

  • thisNotMyName@lemmy.worldEnglish
    0·
    3 days ago

    CUII provides a great list of sites you’d definitely want to avoid these days. Especially if you use another DNS than the one of the ISP, which renders the blocks useless! Stay safe and make sure to regularly check their list of highly illegal sources for all kind of stuff so you are always up to date and know what to avoid as the law abiding citizen you are!

    • black0ut@pawb.socialEnglish
      0·
      2 days ago

      I don’t usually pirate content in spanish, but whenever someone asks me for it, I always go to the latest blocked domain list from the govt to find piracy sites. It’s such a nice and convenient list with all the latest sites.

      I don’t even need to use a VPN, since most of the blocks are just DNS. I have my own DNS resolver using unbound at home, so none of those blocks affect me.

    • muelltonne@feddit.orgEnglish
      0·
      3 days ago

      It’s a mixed bag - they are blocking some awesome piracy sites, but they are also blocking some scammy sites you really do not want to visit. Those FMHY lists floating around in the fediverse are a better starting point.