Gambling and Adult content DNS blocking using Mullvad VPN(mullvad.net)
mullvad.net
Gambling and Adult content DNS blocking using Mullvad VPN
https://mullvad.net/en/blog/2022/7/11/aiding-to-break-habits-gambling-and-adult-content-dns-blocking/
70 comments
Someone else posted that this isn't a feature they would look for in a VPN, and I'd mostly agree except for one big problem: VPNs are the only way to effectively block things in iOS and (un-rooted) Android, and you can only have one VPN active at a time. This means that you have to choose between either having a proper VPN connected or a fake one to block content you don't like. Mullvad's ads, trackers and malware blocking DNS has been awesome when I'm on my iPhone and don't want to deal with ads in apps. I'm sure some other people who have dependence issues with gambling or adult content would appreciate being able to use their preferred VPN while also blocking content.
On iOS you can install a configuration profile that setup a DNS-over-HTTPS endpoint without touching the VPN settings. NextDNS does this when you install their app from what I remember. For other examples, see the profiles offered by AhaDNS.com[0].
On Android there is a Private DNS option where you can also setup a DNS-over-HTTPS endpoint of your choice.
These options may be also a better choice for battery life than a fake VPN connection.
[0]: https://github.com/AhaDNS/setup-guides/blob/master/Apple/iOS...
On Android there is a Private DNS option where you can also setup a DNS-over-HTTPS endpoint of your choice.
These options may be also a better choice for battery life than a fake VPN connection.
[0]: https://github.com/AhaDNS/setup-guides/blob/master/Apple/iOS...
Just did this last week, and it’s been life changing over mobile:
https://news.ycombinator.com/item?id=32041238#32041742
https://news.ycombinator.com/item?id=32041238#32041742
The android setting wherein you can input a standard DNS-over-HTTPS endpoint is sensible and sane.
Is it, in fact, correct that there is no such setting in iOS and has to be app-enabled ? Or are you saying I can either manage the device with configurator2 and put that setting in or I can install an app (like nextdns) that does it for me ?
Really frustrating that simple config options like DNS server and setting the name of your hotspot SSID are nonexistent in iOS ...
Is it, in fact, correct that there is no such setting in iOS and has to be app-enabled ? Or are you saying I can either manage the device with configurator2 and put that setting in or I can install an app (like nextdns) that does it for me ?
Really frustrating that simple config options like DNS server and setting the name of your hotspot SSID are nonexistent in iOS ...
In iOS from what I know you need a configuration profile for that, I don't think it needs to be signed.
Yes, you can make one with Apple Configurator 2, but there is also some tooling/app that may help, like:
https://dns.notjakob.com/
https://github.com/kkk669/DNSecure
Yes, you can make one with Apple Configurator 2, but there is also some tooling/app that may help, like:
https://dns.notjakob.com/
https://github.com/kkk669/DNSecure
Is this really true? Because on macOS exactly this "workaround" does not work:
https://github.com/AdguardTeam/AdGuardDNS/issues/214
Sorry, I can't tell for macOS, but on iOS i have a few DNS profiles and they all seems to work.
In addition to running a VPN? That's what the main comment was about, wasn't it? The profiles alone do work.
As I understood it was about blocking content (via DNS) *even without a fake VPN connection*. Once you run a VPN connection, most likely its DNS takes over, profile or not profile.
The very thing you're linking to is because of running conflicting software on MacOS.
Yes I know but that's what the parent comment(s) are about? Using a profile for DNS settings instead of a fake VPN because you can't run more than one active VPN at a time.
Without disagreeing that folks would want an all-in-one solution, a potential alternative is to use a service like https://nextdns.io/ in addition to your VPN.
On Android, the NextDNS app registers itself as a VPN, so you can't use it simultaneously with, say, Mullvad.
The custom DNS option in Android's network settings rarely seems to work in my experience, but I haven't tried in a couple years.
The custom DNS option in Android's network settings rarely seems to work in my experience, but I haven't tried in a couple years.
>On Android, the NextDNS app registers itself as a VPN
It does this for macOS and iOS too, which has caused issues when both were trying to set the DNS on the machines.
It does this for macOS and iOS too, which has caused issues when both were trying to set the DNS on the machines.
This is particularly unlucky for macOS if you want to use a application-firewall like "Little Snitch" - since Apple removed kernelextensions on macOS (which LittleSnitch and others used before) they now have to also fake a VPN. Because of this, you cannot use a custom DNS and Little Snitch. [1]
[1]:https://github.com/AdguardTeam/AdGuardDNS/issues/214
[1]:https://github.com/AdguardTeam/AdGuardDNS/issues/214
It has almost always worked on my devices though.
If you're only using Pixels, don't underestimate how bad OEMs can screw up their version of Android.
Upvote for NextDNS. Their platform has been a game changer for me on all devices/computers and really enjoy the granularity of filtering. Happy customer here!
As I've recently been made aware here on HN, on Android system applications can bind to an arbitrary interface so they can effectively bypass the VPN system. I don't think it happens often in practice, but it's something to keep in mind.
on paper (Android 8 and up) has the always-on type VPN that blocks any network connection not using the vpn (disallows bypass). Didn't poke it yet how it works if multiple apps create VPNs, I assume only one VPN of this type can be active
The single app restriction is a consequence of how the API works, but the always on VPN doesn't prohibit system apps from binding to an interface and bypassing the VPN configuration.
This kind of makes sense, you probably want a modem manager to talk to the modem interface directly, but it can be abused by data hungry manufacturers and perhaps Google.
This kind of makes sense, you probably want a modem manager to talk to the modem interface directly, but it can be abused by data hungry manufacturers and perhaps Google.
thanks for your clarification. With custom roms there is at least user control on system apps and their permissions.
By using a WireGuard VPN you could actually be connected to multiple endpoints at a time, if you are able to set the same tunnel IP for all endpoints.
That would enable you to have that one connection open routing to different servers (Mullvad / Homelab / Offsite Lab / Work / etc ...) hence also using your own DNS resolver with a commercial VPN.
Android, since Pie, supports DNS over TLS, and I personally use it for ad blocking.
If you only need Safari, AdGuard does a surprisingly good job, far superior than what you can get on Android.
On Android you can have Firefox with uBlock origin
Wait, Mullvad acts as an adblocker for iOS? That’s wonderful. I didn’t know such a thing existed.
[deleted]
I'm Steven Black and they cite my repo as their source for adult content domains.
Mullvad VPN seems unclear on the concept, at least in regard to my resource.
Using my porn hosts variant directly, they are presently pulling-in 188,735 domains, of which only 43,108 are porn domains. The other domains are adware, malware, etc.
I also notice the mullvad/dns-adblock repository been in existence since June 7 2022, the date of its first commit. So this is a very new thing.
Mullvad VPN seems unclear on the concept, at least in regard to my resource.
Using my porn hosts variant directly, they are presently pulling-in 188,735 domains, of which only 43,108 are porn domains. The other domains are adware, malware, etc.
I also notice the mullvad/dns-adblock repository been in existence since June 7 2022, the date of its first commit. So this is a very new thing.
Why did you include adware and malware domains in a list named to suggest it only contains pornography domains then? Seems like a fair mistake on Mullvad's part.
Here is the readme: https://github.com/StevenBlack/hosts
If that could be more clear, please tell me how?
If that could be more clear, please tell me how?
PiHole lists to achieve the same thing:
https://oisd.nl/downloads
https://github.com/blocklistproject/Lists/
https://oisd.nl/downloads
https://github.com/blocklistproject/Lists/
The issue there is pihole is only useful on your local network. You could expose it to the internet but that's a horrible idea. You could also VPN into your home network I guess but that's often not feasible.
> You could also VPN into your home network I guess.
It works beautifully. I think it hurts battery life on phones, but that hasn't been tested by me in any meaningful way.
It works beautifully. I think it hurts battery life on phones, but that hasn't been tested by me in any meaningful way.
I run Pi-hole and pi-vpn on a VM at home, and have my mobile phone set to always-on VPN. I have occasionally had to disable the VPN on public wifi that blocks the high UDP port, but I think that could be gotten around with udp/443 which is used by QUIC/Google a lot. udp/53 inbound is blocked on my ATT home network.
As others say, use a VPN like wireguard. If bandwidth or latency over the VPN is a concern, you can setup your VPN to only route DNS requests over the VPN.
There are PiHole-as-a-Service... services out there
I do exactly this. I have WireGuard running on my pihole server. All my devices are set to connect automatically when off my home network.
> You could expose it to the internet but that's a horrible idea.
Been there, done that. It was a mistake. Not sure which attacks my public PiHole was part of, but I surely was part of some.
It's a shame, I'd really like to offer this as a service to friends, because I think they would be able to change the DNS settings of their routers and enjoy a safer surfing experience.
I don't want to get started with distributing key pairs to connect to a VPN and whatnot. PiHole really has a sweet spot there with its ease-of-use but it fails in regards of security/protection against becoming part of DNS-based attacks.
Been there, done that. It was a mistake. Not sure which attacks my public PiHole was part of, but I surely was part of some.
It's a shame, I'd really like to offer this as a service to friends, because I think they would be able to change the DNS settings of their routers and enjoy a safer surfing experience.
I don't want to get started with distributing key pairs to connect to a VPN and whatnot. PiHole really has a sweet spot there with its ease-of-use but it fails in regards of security/protection against becoming part of DNS-based attacks.
> Been there, done that. It was a mistake. Not sure which attacks my public PiHole was part of, but I surely was part of some.
How did you come to this conclusion? How did you come to know?
How did you come to this conclusion? How did you come to know?
The PiHole has some integrated logging where you can see the requests that were made. I had several IPs which were doing queries for the same domains dozens of times per second. That wasn't a poweruser but some kind of automated system, probably doing reflection attacks or sth. alike.
I think PiHole has improved since that time, you can now set throttling, but I'm not sure I'd run a public PiHole anymore.
I think PiHole has improved since that time, you can now set throttling, but I'm not sure I'd run a public PiHole anymore.
My pihole listens only on my server's TailScale interface, and have MagicDNS set to use the server's tailnet IP. Phone and laptops get it using the app, LAN gets it with subnet routing.
[deleted]
Unfortunately some apps[0] are already resistant to DNS-based blocking, which is why I'm creating SocialsDetox (DoH & VPN). It allows blocking of social media (+others, e.g. Gambling) across all your devices with a single click, scheduled and/or API call.
[0] https://www.tigerdroppings.com/rant/tech/facebook-app-and-un...
[0] https://www.tigerdroppings.com/rant/tech/facebook-app-and-un...
Can you build one that blocks all non-adult and non-gambling content? Asking for a friend…
"Vices DNS", that's what I'd call it.
[deleted]
Does the Adult content filter trigger Restricted Mode on YouTube like CloudFlare's 1.1.1.3?
That was the one reason I had to give up using adult filters like that.
That was the one reason I had to give up using adult filters like that.
I use SafeDNS which filters adult content (plus many more categories), without forcing YouTube Restricted Mode. But, you can opt into YouTube Restricted Mode if you choose.
Sorry for the tangent, but does anyone have a solution for mdns/ssdp (Sonos, in my case) while running Mullvad with wireguard?
edit: nvm, was trivial to just route it manually. For anyone interested, just something like
edit: nvm, was trivial to just route it manually. For anyone interested, just something like
ip route add 239.255.255.250 dev <whichever interface>
I wish there was the option to use both Mullvad + NextDNS.
[deleted]
What irks me about this is the disingenuous concern trolling in the title:
> Aiding to break habits
If mullvad's intention with these blocklists is to help break habits, then why is the focus solely on gambling and adult content? Alcohol and nicotine 'habits' far surpass porn and gambling habits, so why is there no option to break habits by blocking, for example, smoking and drinking related content?
> Aiding to break habits
If mullvad's intention with these blocklists is to help break habits, then why is the focus solely on gambling and adult content? Alcohol and nicotine 'habits' far surpass porn and gambling habits, so why is there no option to break habits by blocking, for example, smoking and drinking related content?
I'd actually argue that adult content is way more prevalent than nicotine, and likely moreso than alcohol.
Researchers trying to study the effects of porn use (in college males if I remember right) struggled to get a control group because they couldn't find anyone who didn't use porn
Researchers trying to study the effects of porn use (in college males if I remember right) struggled to get a control group because they couldn't find anyone who didn't use porn
Because you can gamble and see porn online, but you can't smoke or drink a website?
You can't "gamble or porn a website" either. But alcohol and nicotine companies have an online footprint, and you can buy alcohol and nicotine online.
Or in other words, there is web content that directly facilitates other 'habits' that are way more prevalent than gambling or adult content, so it stands to reason that if the intention is to break habits, the initial focus should be on the most prevalent habits.
Or in other words, there is web content that directly facilitates other 'habits' that are way more prevalent than gambling or adult content, so it stands to reason that if the intention is to break habits, the initial focus should be on the most prevalent habits.
[deleted]
[deleted]