Comment on Self Hosting for Privacy - Importance of Owning your own Modem/Router?
SirHaxalot@nord.pub 11 hours ago
It’s extremely unlikely that they are going to do any kind of deep traffic inspection in the router/modem itself. Inspecting network traffic is very intensive though and gives very little value since almost all traffic is encrypted/HTTPS today, with all major browsers even showing scare warnings if’s regular unencrypted HTTP. Potentially they could track DNS queries, but you can mitigate this with DNS over TLS or DNS over HTTPS (For best privacy I would recommend Mullvad: https://mullvad.net/en/help/dns-over-https-and-dns-over-tls)
And of course, make sure that anything you are self-hosting is encrypted and using proper HTTPS certificates. I would recommend setting up a reverse proxy like Nginx or Traefik that you expose. Then you can route to different internal services over the same port based on hostname. Also make sure you have a good certificate from Letsencrypt
comrade_twisty@feddit.org 11 hours ago
Many German providers have hardcoded DNS servers in their rental routers though and they block everything from torrent directories to iptv sites.
Ooops@feddit.org 9 hours ago
The only thing they can realistically harcode is the DNS server their router’s DHCP provides.
Just configure devices to not use that setting, also use DoH or DoT (which you should do anyway, not just to circumvent your router’s settings).
comrade_twisty@feddit.org 9 hours ago
I haven’t used such a router in decades, I just know from doing IT support at friends homes. These people have no clue how to get around these DNS filters.
Ooops@feddit.org 8 hours ago
But not thanks to the virtue of some effective blocking but just a lack of knowledge of the average user…
I have used several of those cheap routers over the years. And they simply can’t block you from using encrypted DNS (unless they want to create giant blocklists and want to play wack-a-mole with DNS servers…).
So all they usually do is very low tech like ignoring the DNS you set in the router configuration and reroute it (or not providing such configuration in the first place). But they can effectively ony do so with unencrypted DNS.
With encrypted DNS they could at best try to block the default port used by DNSoverTLS but that still leaves DoH. And they can’t block that because it’s just regular encrypted HTTPS traffic (with the DNS quesry inside).
Iirc even Windows nowdays allows easy configuration of DoH nowadays (and for much longer if you were ready to edit the registry) where you can simply chose between unencrypted, DoH only or encryption preferred if available.