ISP DNS HIJACKING

[TechTinkerer]

Hi Guys,
I'm needing some help, just found out that my isp EE is dns hijacking, which means media sresming becomes difficult and have read dnsmasq can be used to prevent them doing it something about using nxdomains, anyway i need some genius's @thelonelycoder @Adamm
@Martineau @ColinTaylor @RMerlin @Xentrk @peepsnet

Thanks

 

[distilled]

You could enable DNSSEC, and use a set of public servers that you trust. Enable DoT too.

Or you could install Unbound from amtm, and rely on root servers.

 

[TechTinkerer]

You could enable DNSSEC, and use a set of public servers that you trust. Enable DoT too.

Or you could install Unbound from amtm, and rely on root servers.

Thanks for the help, its more a test as i have in use a smartdns service for streaming, but it doesnt work fully due to my isp hijacking the dns...

 

[ColinTaylor]

Explain in detail what you mean by "hijacking the dns".

 

[TechTinkerer]

Explain in detail what you mean by "hijacking the dns".

Hi Colin,

See here https://www.expressvpn.com/blog/dns...yxUaQOhW-rAf21bFG6DwZL42Ki83C788aAtgDEALw_wcB

or here https://www.google.com/url?sa=t&sou...FjADegQIBRAB&usg=AOvVaw1f3iNg5RbD9OLhzCLpe-EL

 

[distilled]

Does your VPN or SmartDNS provider support DNSSEC? If so, you might be able to just enable it.

Is it possible to set up the DNS on your streaming device(s) and use DoT or Unbound on the router itself? You could also make an exception for the streaming devices.

Just a thought, you know best what you have going on...

 

[ColinTaylor]

Hi Colin,

See here https://www.expressvpn.com/blog/dns...yxUaQOhW-rAf21bFG6DwZL42Ki83C788aAtgDEALw_wcB

or here https://www.google.com/url?sa=t&sou...FjADegQIBRAB&usg=AOvVaw1f3iNg5RbD9OLhzCLpe-EL

I know what DNS Hijacking is. I was really trying to find out what the specific problem with EE was that you were having.

 

[TechTinkerer]

Does your VPN or SmartDNS provider support DNSSEC? If so, you might be able to just enable it.

Is it possible to set up the DNS on your streaming device(s) and use DoT or Unbound on the router itself? You could also make an exception for the streaming devices.

Just a thought, you know best what you have going on...

It's unblocked-us (smartdns) trying to get hulu to work, i've used vpn etc but instable and sluggish

 

[TechTinkerer]

I know what DNS Hijacking is. I was really trying to find out what the specific problem with EE was that you were having.

they are intercepting dns quieries and forcing their own dns server, so traffic then gets detected by hulu to then not work

 

[distilled]

they are intercepting dns quieries and forcing their own dns server, so traffic then gets detected by hulu to then not work

Ohhhh, you use a "SmartDNS" your VPN provides to escape geographic restriction, but EE are forcing you through their servers which Hulu then detects. Is the VPN DNS set to Exclusive?

 

[TechTinkerer]

Ohhhh, you use a "SmartDNS" your VPN provides to escape geographic restriction, but EE are forcing you through their servers which Hulu then detects. Is the VPN DNS set to Exclusive?

yes, exclusive - vpn works, but slow on hulu so thought i'd try a smart dns service really is the best method for getting max out of the internet connection for watching any geobocked service, so i really want to try and get it working

 

[distilled]

Maybe I misunderstand. Your VPN works, but it is too slow, so instead of the VPN, you are trying a "SmartDNS" service? Does this smart DNS also mask your outgoing IP with some sort of proxy? What specifically is telling you that DNS hijacking is responsible for Hulu blocking?

 

[Xentrk]

TorGuard has the Private or dedicated IP to get around services that block known VPN servers. Doesn't matter what DNS you use. IP leak? No problem.

If VPN is sluggish, change to GCM ciphers. Use the built in DoT function or install unbound as secure DNS alternatives.

 

[Zonkd]

Thanks for the help, its more a test as i have in use a smartdns service for streaming, but it doesnt work fully due to my isp hijacking the dns...

If you absolutely must use the unblock-is Smart DNS service (eg . For Netflix region switching) then one way or another those DNS queries will need a layer of encryption either by tunnelling them through a VPN (slower) or by your Smart DNS provider supporting DoH or DoT. Ask them if they can offer it.

Ofcourse if you don’t need the Smart DNS for region switching then just use DoT with a regular DNS server like Cloudflare 1.1.1.1

 

[TechTinkerer]

Maybe I misunderstand. Your VPN works, but it is too slow, so instead of the VPN, you are trying a "SmartDNS" service? Does this smart DNS also mask your outgoing IP with some sort of proxy? What specifically is telling you that DNS hijacking is responsible for Hulu blocking?

Yes, traffic gets masked just like vpn, its my isp hijacking with their transparent dns even though i have the smart dns servers seton router nt completely sure how hulu detects it though as netflix,disney+ bbc work

 

[muffintastic]

@TechTinkerer Anyway you can't just put the SmartDNS IP in the WAN section, and where it says "Connect to DNS Server automatically" click no. Seems that is to Yes. Sky do the same and to overcome this i just don't use Connect to DNS Server automatically option and using "DoT" and my DNS Server1 is 192.168.1.1 and works like a charm.

 

[TechTinkerer]

@TechTinkerer Anyway you can't just put the SmartDNS IP in the WAN section, and where it says "Connect to DNS Server automatically" click no. Seems that is to Yes. Sky do the same and to overcome this i just don't use Connect to DNS Server automatically option and using "DoT" and my DNS Server1 is 192.168.1.1 and works like a charm.

Thanks, i have the smartdns servers in wan dns entries set with not to connect automatically....just checked the smartdns don't support dot or doh

 

[muffintastic]

Thanks, i have the smartdns servers in wan dns entries set with not to connect automatically....just checked the smartdns don't support dot or doh

Just run as is without DoT.

Then Google dns leak test and do standard and extended and should just be the custom dns

 

[TechTinkerer]

Just run as is without DoT.

Then Google dns leak test and do standard and extended and should just be the custom dns

Keep getting dns detected as 84.200.69.80 and not as dns servers of the smartdns

 

[AndreiV]

Keep getting dns detected as 84.200.69.80 and not as dns servers of the smartdns

84.200.69.80 is https://dns.watch