Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is it safe that sometimes my Anti-filtering program does not change the DNS address?

share|improve this question

1 Answer 1

If your DNS queries are being resolved by your ISP, then yes, you should change your system DNS server to 8.8.8.8 or 8.8.4.4 (Google's public DNS resolvers).

DNS filtering is performed by the ISP, typically under instruction by a governing body. In this case, the actual DNS server queried is irrelevant, the ISP will drop any DNS queries for a particular domain name, preventing users from resolving it. This occurs irrespective of the target DNS server. However, if you are actually using your ISP's DNS server, then you are giving them a second opportunity to filter your lookups.

Your antifiltering software can work in one of two primary ways;

  • Out-of-band DNS Queries The anti-filtering software performs DNS queries by dialing out to a C&C server, which performs the actual DNS lookups on your behalf and returns the results to you via an encrypted (SSL) tunnel. This method requires a browser plugin and is rarely used, because it is a terrible hack.

  • Full Connection Tunneling This is by far the most common approach, your connection is tethered to a remote server via an encrypted (SSL, PPTP, IPSec etc) tunnel, also known as a VPN gateway. All traffic is passed through this tunnel, including DNS queries. Your ISP cannot see what you are doing, instead the ISP of the VPN gateway sees all the traffic, which is why you put the gateway in a country with less strict filtering laws than your own.

share|improve this answer
    
Thank you, I forgot to mention that I am from Iran and filterring is very irritating here. By your answer I got that they can use the opportunity to filter by DNS, but about the security risk I did not get it. Is it less safe when I use ISP DNS Server or does not make any differences? Can they get my place If that happen(Using ISP DNS server)? –  Peyman Tehrany Apr 5 '13 at 13:40
    
If you are using a VPN, then no - your ISP cannot determine that you are making the queries even if you are using the ISP DNS. However, if you are using the ISP DNS, you might find that your queries go unanswered all the same. The best thing to do is use a VPN outside your country, and to configure your machine to use the 8.8.8.8 DNS server. –  lynks Apr 7 '13 at 21:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.