16 ms·

You can mitigate the speed issue by adding your own DNS local caches and then start blocking ads, trackers and malware sites and whomever you want (FB is added

by 411mrc 8y ago

You can mitigate the speed issue by adding your own DNS local caches and then start blocking ads, trackers and malware sites and whomever you want (FB is added to the spyware list) using publicly available lists. All of this speeds browsing considerably. A personalized router is very powerful.

Diederich 8y ago
> your own DNS local caches Doesn't that mean your ISP will now see what domains you are looking up?
- ktta 8y ago
  Not if you use DNS-over-HTTPS with cloudflare or google. https://github.com/aarond10/https_dns_proxy https://github.com/aarond10/https_dns_proxy
  - cwingrav 8y ago
    Just clarifying your comment for others: Your ISP would still see the IPs of the sites your packets visit unless you are using an encrypted VPN connection. The DNS-over-HTTPS is a great addition to a VPN. (the VPN comment was several levels up so some might miss it)
  - Diederich 8y ago
    Righto!
ktta 8y ago
Openwrt by default caches using dnsmasq, but the blocklist is a good idea. The problem is, even the blocklist is sometimes too big for the tiny flashes of some routers.
- danharaj 8y ago
  I use a Qotom mini pc as a router. I configure it with NixOS. It's amazing.
- 411mrc 8y ago
  As another poster said, go with a mini-pc like Qotom. Uses little power, configure however you want (memory, SSD). Most web pages load instantly, and it handles a massive blocklist (Bind9). I'm slowly adding a list of always on packages like sync tools. Also, you can use an AP instead of router attached wifi. Move the Power-over Ethernet AP where you want. Ubiquiti Unifi is far better coverage than my previous consumer grade wifi. Do it all in your favorite Linux flavor.
  - ktta 8y ago
    The average user doesn't want to buy more hardware, and flashing an existing router can be done in an evening. Also, why Bind9? I don't see what's wrong with dnsmasq, and changing hosts file for blocklist. Also, I often advise against network wide blocklists unless you're the only one using the network, since subtle things break. Here's what I do: https://news.ycombinator.com/item?id=14780738 https://news.ycombinator.com/item?id=14780738 The only thing different is that I use wireguard and dnsmasq now.
    - 411mrc 8y ago
      I find having one piece of low-power hardware that is always on a handy tool. A homeserver+router, basically. I can decloud a lot of things. Having a beefier piece of hardware makes it a non-issue. I try to run things in Docker for modularity. Total hardware cost is competitive with a high-end router, but I think I get more. Bind9 seems to be better for blocking. RPZ is made for it. I don't think dnsmasq supports RPZ though projects like Pi-Hole use dnsmasq. I'm not positive, but I think RPZ is more flexible. Bind9 seems to do anything you like. I may want to resolve DNS myself and not just forward. I'm starting to look into configuring Bind9 to have different blocking per user using "views." Some want Facebook, some don't, so I can block accordingly. I'm not sure you can do that in dnsmasq. I did discover subtle things break, like you can't block Facebook and still access Instagram, thus the "views" approach. I don't want to change hosts file on every device, especially mobiles, and can even provide some protection for guests this way. I might do a captive page for a blocked domain and let people bypass in their view if they like, then I can have a "block-first" approach. I do like network-wide blocking for the malware lists - if anyone acquires malware, it can't phone home (if it's on the list) and I can detect via logs. DNS as firewall seems to be a trend. I'm looking into blocking IPs via iptables as well using public lists. Maybe I'll even setup Snort or Bro. The possibilities are endless.

by 411mrc 8y ago

Diederich 8y ago

> your own DNS local caches Doesn't that mean your ISP will now see what domains you are looking up?

ktta 8y ago
Not if you use DNS-over-HTTPS with cloudflare or google. https://github.com/aarond10/https_dns_proxy https://github.com/aarond10/https_dns_proxy
- cwingrav 8y ago
  Just clarifying your comment for others: Your ISP would still see the IPs of the sites your packets visit unless you are using an encrypted VPN connection. The DNS-over-HTTPS is a great addition to a VPN. (the VPN comment was several levels up so some might miss it)
- Diederich 8y ago
  Righto!

ktta 8y ago

Openwrt by default caches using dnsmasq, but the blocklist is a good idea. The problem is, even the blocklist is sometimes too big for the tiny flashes of some routers.

danharaj 8y ago
I use a Qotom mini pc as a router. I configure it with NixOS. It's amazing.
411mrc 8y ago
As another poster said, go with a mini-pc like Qotom. Uses little power, configure however you want (memory, SSD). Most web pages load instantly, and it handles a massive blocklist (Bind9). I'm slowly adding a list of always on packages like sync tools. Also, you can use an AP instead of router attached wifi. Move the Power-over Ethernet AP where you want. Ubiquiti Unifi is far better coverage than my previous consumer grade wifi. Do it all in your favorite Linux flavor.
- ktta 8y ago
  The average user doesn't want to buy more hardware, and flashing an existing router can be done in an evening. Also, why Bind9? I don't see what's wrong with dnsmasq, and changing hosts file for blocklist. Also, I often advise against network wide blocklists unless you're the only one using the network, since subtle things break. Here's what I do: https://news.ycombinator.com/item?id=14780738 https://news.ycombinator.com/item?id=14780738 The only thing different is that I use wireguard and dnsmasq now.
  - 411mrc 8y ago
    I find having one piece of low-power hardware that is always on a handy tool. A homeserver+router, basically. I can decloud a lot of things. Having a beefier piece of hardware makes it a non-issue. I try to run things in Docker for modularity. Total hardware cost is competitive with a high-end router, but I think I get more. Bind9 seems to be better for blocking. RPZ is made for it. I don't think dnsmasq supports RPZ though projects like Pi-Hole use dnsmasq. I'm not positive, but I think RPZ is more flexible. Bind9 seems to do anything you like. I may want to resolve DNS myself and not just forward. I'm starting to look into configuring Bind9 to have different blocking per user using "views." Some want Facebook, some don't, so I can block accordingly. I'm not sure you can do that in dnsmasq. I did discover subtle things break, like you can't block Facebook and still access Instagram, thus the "views" approach. I don't want to change hosts file on every device, especially mobiles, and can even provide some protection for guests this way. I might do a captive page for a blocked domain and let people bypass in their view if they like, then I can have a "block-first" approach. I do like network-wide blocking for the malware lists - if anyone acquires malware, it can't phone home (if it's on the list) and I can detect via logs. DNS as firewall seems to be a trend. I'm looking into blocking IPs via iptables as well using public lists. Maybe I'll even setup Snort or Bro. The possibilities are endless.