Blocked that hard-coded google dns garbage.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters DNS Domain Name Service/System IP Internet Protocol IoT Internet of Things for device controllers NAT Network Address Translation PiHole Network-wide ad-blocker (DNS sinkhole) SSL Secure Sockets Layer, for transparent encryption TCP Transmission Control Protocol, most often over IP UDP User Datagram Protocol, for real-time communications VPN Virtual Private Network
[Thread #267 for this sub, first seen 8th Nov 2023, 04:10] [FAQ] [Full list] [Contact] [Source code]
Good bot
Hey man, can you share some resources that you followed to configure Opnsense as VM. I am in the same situation, bought a firewall, that I want to use as a hypervisor but didn’t configure yet the Opnsense and would love to educate myself more on the matter.
I’m currently using this guide to setup a OPNsense VM on proxmox. Home Network Guy also has an OPNsense guide, but for a full router.
Thanks for the link but in the series I can only find information about Pfsense and not Opnsense.
It’s pretty similar, but I combined those two guides and that worked pretty well.
+1 for dst nat on googles dns servers back to my piholes
I do a DNS redirect on my Mikrotik router.
It’s going to suck when DoH and DoT becomes more prevalent.
I think the solution is to avoid tech that you don’t control. Its a hard pill to swallow for some but at the end of the day there are tons of ways a device could bypass networking restrictions
Best you can do is maintain a list of public DoH IPs and block them. Redirect all port 53 traffic to your own DNS server.
Is this to block ads?
No, you can block ads with a pihole. This is because Roku hard codes its dns server as 8.8.8.8. Pihole doesn’t handle IP addresses, only DNS.
Interesting. I set an adblocking dns via DHCP and, as far as I know, the Roku respects it. Ads are blocked and I can see it failing to delivery telemetry in my dns logs (most persistent thing on the network).
I set a rule to catch outside dns to see if anything, the roku included, has been misbehaving.
Pihole blocks the basics for Roku. Things like logs ads etc. but there’s a lot more telemetry that they’re collecting. Here’s a hackernews thread about the topic and the associated article it references.
Well, I’m back and can confirm the sneaky DNS resolver. I have two roku devices and they both were making requests to 8.8.8.8.
Thanks for this post! TIL.
I doubt it but could this help my tv randomly crashing
It’s genuinely so annoying and is such a 2023 problem
Tv crashing? Add an external device and don’t use TVs for their smart features as they tend to be pretty bad.
Not familiar with Rokus, but it depends on what your filtering. Mostly it’s to block needless analytics tracking. I use a pair of PiHoles for much the same purpose.
One reason used to be to switch to a different region for Netflix, etc but I’m not sure if that still works, I haven’t had to use a Roku in a long time.
How would you switch regions using a firewall?
Using the firewall to force dns because the services were stupid enough to rely on dns to determine location. You would use a (usually paid) dns service hosted out of the wherever the content you want was and get access to region locked stuff like the US netflix library from abroad. This worked because vpns were being detected and rokus dns was hard coded so assumed to be trusted.
I don’t know if this still works because I no longer own anything Roku and Netflix’s service hasn’t been worth that kind of shenanigans for a long time. It likely doesn’t work anymore.
Edit: Unblock-US used to be such a service
I setup a NAT rule that redirects anything going to the Google DNS IP’s send sends it to my own DNS server.
I did that for anything on port 53.
I can’t recall if I limited to Google’s IP’s or not actually. Just that I wanted to prevent their devices from ignoring the DHCP provided hosts
TIL that dns uses udp instead of tcp
https://www.geeksforgeeks.org/why-does-dns-use-udp-and-not-tcp/
One more confusion: If DNSSEC is enabled it actually switches to TCP, since DNSSEC requires messages that are much bigger than what UDP can transfer.
I configured my Asus router with asuswrt-merlin firmware to route all DNS traffics to my Adguard instance to catch those apps and devices with hard-coded DNS. Those routed DNS queries appear in adguard as originating from my router’s IP address, so I can easily see what apps and devices trying to bypass my dns. Turns out the main offender is Netflix.
That’s interesting. What IP address is netflix hardcoding?
My router doesn’t log the target dns server ip address, but according to many forum threads, netflix apps seems to hardcode the dns to
8.8.8.8and8.8.4.4.
I have a firewall rule to dst-nat any outgoing DNS requests not coming from piHole back to the piHole server. That way all devices on the LAN are forced to use piHole for DNS and can’t bypass it. I don’t have an OPNSense firewall but I would think it should be able to do that as well.
