Transcription
Unfortunately, all your fancy encrypted DNS options are not going to stop ISPs from seeing the traffic that you send onto the network and even blocking websites that you go to. Now, there are exceptions to this, but in a lot of cases, this is going to be true.
And I'm going to demonstrate this by simply using a Raspberry Pi and some Python scripts to log the websites that this laptop goes to. And then I'll show you how I can use a Python script to block the laptop from going to whichever website I decide.
In the real world, as an example, here in the UK, many websites are blocked by ISPs. They are sanctioned websites. So, the government could decide that you're not allowed to read the news on certain websites, as an example. Or they could decide that all ISPs in a country need to block websites. So, here are examples of very large ISPs in the UK. And as you can see here, they have a list of websites that they need to block, such as the pirate bay.
Now, I'm not going to get into the politics of whether it's right or wrong that an ISP blocks certain websites. This is happening in the states as well. 23 states and France, as an example, are blocking certain websites.
Some people seem to believe that if they use encrypted DNS, or they use a Pi Hole on a Raspberry Pi, as an example, or they use Unbound, that this will not apply to them. But it does, because what ISPs can do is not just look at the DNS traffic that you're sending for logging and blocking purposes, but they can also look at the SNI information, so server name information, when you set up a TLS connection to a website.
So, I just want to make this clear because in my previous video, which I link below, where I went through a lot of this in a lot of detail, some people were confused. Encrypting DNS will stop an ISP snooping on your DNS queries, as an example. But it doesn't stop your connections to a web server, even if you're using the latest version of TLS or HTTPS, as some of us who have been doing this for a long time would call it. Latest version of TLS 1.3 is also affected by this.
In that previous video, I talked about ECH and how ECH doesn't always help you. And I'm going to demonstrate that quite clearly here by using a Raspberry Pi once again with two Python scripts. So in this first script, I'm going to run Python and monitor DNS queries. And in the second Python script, I'm going to look at SNI. So on the right hand side, we're looking at HTTPS connections, and on the left hand side, we're looking at DNS queries. We can already see connections going to ui.com. And that's because I am running a tap on my network between my router and the internet.
So in this example, I've got my Windows laptop connected to a UniFi Express, which is connected to Starlink. However, here I have my tap between my UniFi router and the Starlink dish. So, this is my tap where I'm tapping the network. All traffic sent from my local router to the internet will be forwarded to my Kali Linux Pi. So, my little Pi is going to see all the traffic sent by my network.
What I've done is set up my Starlink in bypass mode, which means that my UniFi Express will receive an IP address in this range. That's because Starlink uses carrier-grade network address translation internally. So devices in the Starlink network are NATted when going onto the internet. We can see that by looking at the UniFi Express device. Here is the internal IP address and the external address is 100.1.16.something.something. So this device is connected directly to the internet. I am tapping the network between my internal network and the internet.
So looking at my Raspberry Pi, you can see a lot of traffic has already been sent onto the network. We are seeing DNS resolutions, as an example, to Microsoft and Unifi.com. And on the right hand side, we're seeing traffic going to Mozilla. So the connections on the right hand side are actual connections using TLS. So in other words, a device on the network is making a connection to a server. The left hand side are DNS queries.
The reason that you can see all of that information is because in my browser, in this case Firefox, under privacy and security, we're using standard for tracking protection. And scrolling all the way down, I am not using DNS over HTTPS. So at the moment, we are just using the default protection. It'll use DNS in regions where it's available, and it'll use a local provider. So on my Windows computer, if I type ipconfig /all, you'll be able to see that the IP address of the device is 192.168.1.152. DNS server is my UniFi device.
So as an example, if I go to a website, let's say davidbombell.com, what we should see on the Raspberry Pi is the DNS lookup, which we can right over there. And we also see connections to that website and any other connections made when I go to that website. So let's try another website like nvidia.com because you might say, "Well, David, your website is dodgy." So let's choose some big websites. Nvidia and let's go to say cisco.com. These are big companies.
And what we can see straight away in the output here, and there's a lot of information. So scrolling up. So there's a DNS query for Nvidia. And then a whole bunch of other domains are also queried using DNS. And then if I scroll down, DNS query for Cisco. Whole bunch of domains are queried when I go to cisco.com. So again, DNS on the left. On the right hand side, we can see actual connections made by my computer. So there's a connection to Nvidia. We've got images.nvidia.com. We've got Reddit here, and on and on and on. Scrolling down, here's Cisco and a whole bunch of connections are made.
So, at the moment, we can see DNS and we can see connections made to servers. If you want to do this the traditional way, we could just run Wireshark and capture all the traffic. I've simply used two Python scripts to make it easier to see what's going on. But, as you can see here, here is a bunch of information being sent onto the internet from my network.
So, I'll go to another website. Let's say chatgpt.com. So there's chatgpt. Bunch of stuff is shown there, but there you go. ChatGPT. What I'm going to do here is filter for connection types. So TLS record content type 22. This will show us the SNI in the client hello messages. So we can see, as an example, there are ChatGPT connections made. And scrolling down, we can see other connections made such as play.google.com.
Now, I explained SNI in my previous video, so I'm not going to go into it in much detail here. All I want to show you once again is I can see ChatGPT over there. ChatGPT over here. So, DNS on the left, connections made on the right. Even though in this example, ChatGPT is hosted on Cloudflare.
Now, in my previous video, people complained about various things. One of the complaints was, "David, you shouldn't be tapping your internal network." So, here I'm not. I'm tapping externally. Not that it would make any difference, because your connection is made from your PC to the server that you're connecting to. So whether I tap here or I tap here, what I'm going to see differently are your IP addresses because of NAT. But apart from that, I'm still going to see your connection because the SNI in the HTTPS or TLS connection is going to be visible. Doesn't matter if I'm internal or external.
So again, in Wireshark, notice here I can see all those client hello messages that you're sending, even though I'm using TLS 1.3 for my connection to the server. So some people will complain and say, "Well, you should be using the latest version of TLS." There you go, 1.3. It's not an old version of TLS. Again, based on some of the complaints in the previous video.
People say, "David, you shouldn't be using your standard tracking. You shouldn't be using your local router. You should be using an encrypted DNS server. You should be using Cloudflare." So, that's what I'm going to do here. I agree, by the way, that you should use DNS over HTTPS and you should try and go for the MAX protection if you can. But just be aware, it's not going to hide TLS connections. It's going to hide DNS.
And to prove that, let's go and do the following on the Raspberry Pi. So, firstly, on my two scripts, I will close this down and run my DNS monitoring. And I will run my SNI monitoring. So what should happen now is we should see less traffic on the DNS side. Now, the reason I'm seeing this ui.com connection is because my UniFi device, my router, as an example, is making the connection. So it's sending traffic out onto the internet. I actually see Microsoft here as well, which is interesting. But, um, let's go back to my PC here. I will show you in a moment how to set this up globally on the PC. So that should hide that as well.
But as an example, let's flush the DNS cache. So DNS has been flushed, and I'll go and do a search for Nvidia and I'll do cisco.com and let's do chatgpt.com and let's do canva.com. So a bunch of domains now, and what you might notice is very little is shown on the left hand side. I do see Mozilla, Cloudflare DNS.com, but on the right hand side, let's see what we can see. We can see Canva, we can see Cisco, we can see ChatGPT. Scrolling up, more Cisco here. Nvidia. I've been able to see the websites that this device is going to, not through DNS on the left hand side, but through HTTPS or TLS in this example, TLS connections to the internet, because those client hellos are in clear text.
So if I scroll down here in Wireshark, we can see Canva, we can see Cisco, etc. We can see the traffic being sent, even though I am tapping on the ISP side. This is my own router, my UniFi router. I can still see the connections, just like an ISP would, going onto the internet.
Okay. So, let's close down Firefox now. Flush the DNS and let's change the DNS settings for the entire computer. So on my interface connected to the internet, notice there's my IP address 192.168.1.152. Default gateway is that. What I'll do here is set the DNS to use Cloudflare. I'll set automatic on and click save. And there you go. The DNS server assignment is manual. We are using encrypted DNS on our DNS server. So again, that's what it looks like.
So, back on the Raspberry Pi, I'll run the DNS monitor and I'll run the SNI monitor. I'll also restart the capture in Wireshark. Now, you can see straight away we're seeing DNS here for UI. That's coming from the browser, not the Windows computer. Interesting that I see Microsoft there. However, on our Windows computer now, I'll go to a website. Let's say cisco.com, nvidia.com, chatgpt, Canva. Let's see what happens.
And as you can see here, we don't see a lot of output on the DNS script, but we see a lot on the SNI script. So again, we do see Cloudflare here doing DNS lookups. So that may have hidden one of the domains. And this is probably ECH that's doing it. So if I look in Wireshark, we're seeing Cloudflare here and it looks like Nvidia got hidden there. So if I go try and find a packet that includes Nvidia. I'll search for Nvidia. Okay, we still see Nvidia there. We still see Cisco. We still see ChatGPT. So it looks like my script didn't pick that up.
So basically, even though I'm using encrypted DNS here, I can still see the websites that this device is going to. Okay, there's Nvidia down there. So I can see Nvidia, I can see Cisco, I can see Canva, I can see ChatGPT in the output. And let's just go to another website. So I'll just use my website as an example. And let's say Microsoft.com. I see Microsoft in output here. But scrolling down on the SNI, I see my website and I see Microsoft in the output.
So again, just because you're using encrypted DNS on your computer doesn't mean that your ISP can't see where you're going. It can by intercepting SNI traffic.
Now, in my previous video, a lot of people asked about using Pi Hole or something like that to try and hide the information. And again, that's going to hide DNS, but it's not going to hide the SNI information because the actual HTTPS or TLS connections to the servers are going to be shown here unless ECH is used. And generally, as I'm showing you here, they're not used. Even if you go to websites hosted on Cloudflare, I can still see the information in a lot of cases, as I'm demonstrating here.
Now, your mileage may vary. But in the output here, notice there's X. I can see X in the output. See ChatGPT, OpenAI, Canva, again, all that kind of information is shown. So all these TLS connections are shown.
Okay, so let's go to Pi Hole. So I'll go to my Pi Hole server and log in. At the moment, we can see lots of domains are blocked. You can see queries that are being made and blocked. At the moment, we're seeing very little here. At the moment, this is not being used because what I want to do here is go to my DNS settings. I'll do this for the whole computer and I'll remove this to point to Pi Hole. So, I'm going to set my preferred DNS server to 192.168.1.10, which is my Pi Hole server. And I'll save that. So, that's Pi Hole.
Now, some people might say, "Oh, but you're using unencrypted DNS here." But remember, my tap is on the outside. So, what happens here is not seen. So this connection to the Pi Hole over here is not going to be seen by my tap. The DNS query is going to go from the Pi Hole to the PC locally, and then the HTTPS connection will go onto the internet. Or if the Pi Hole queries a DNS server, it's going to go through the internet. And just to show you those settings, if I go to settings here, DNS, notice I'm using Quad9, the filtered DNSSEC option.
So looking at the settings of Firefox, I'm going to set privacy and security to strict, which is fine. And scrolling down, we are going to use enable DNS over HTTPS, and set that to off. That means we're using the default DNS resolver, which is our Pi Hole. In our DNS settings on our network interface card. The IPv4 DNS server is 192.168.1.10, which is the Pi Hole.
Okay, so let's close all of these down. I'll flush the DNS. So that's now flushed. Go to my Raspberry Pi and let's restart my scripts. And what I'll simply do here is just open up the tabs again. So I'll just reopen all those tabs. So you can see some connections to Cisco, Nvidia, etc.
So back on Pi Hole, guess what? I can see all of that information. I'm not seeing the DNS queries. So the DNS is encrypted as expected, but I can still see the websites that you're going to. David Bombell, Microsoft over there, there's X, there's Canva, Nvidia, Cisco again, etc. Just because of the connections made. In other words, the TLS connections made to those servers.
Now, again, on my previous video, people were asking, can we use an Unbound server. So, I'll uncheck all of these options. And I'm going to use Unbound here and paste that in and save and apply those changes. Back on my scripts, I will reset them. So now we're using a Pi Hole with Unbound. And what I'll do is just restart Wireshark so that we have that as a backup in case there's a problem with the scripts.
So notice no SNI traffic sent at the moment. But what I'll do is close all these tabs down and then I'll simply open them again. And what I'll do is clear the DNS cache and then open them up again. So a few connections made again. And back on my script, we're not seeing any SNI traffic. So you might think, oh, okay, David, you're it doesn't work. But again, if I search in Wireshark, I can see information here. So if I search for say ChatGPT, there it is. If I search for David Bombell, there it is. Search for Cisco, there it is. Nvidia, there it is.
So it might have been that my script just messed up. So let's run that script again. Let's clear the screen. I'll clear this side. So, we're running the DNS script on the left and we're running the SNI script on the right. I will restart the capture in Wireshark again just as a backup in case there's a problem with my script. What I'll do is close Firefox down entirely. And what I'll do is just manually go to the website. So, davidbombell.com. There it is over there. I'll go to say cisco.com. There it is over there. I'll go to ChatGPT. There we see that as well.
So even if you're using encrypted DNS, I can still see your SNI connections. Even if you're using Pi Hole, I can see your connections. Even if you're using an Unbound server, I can see your connections because this is not DNS. These are TLS connections. Your DNS is resolving using encryption, but I can see all your TLS traffic because of the SNI and the TLS connection that you're making.
Now, if I just show Firefox, a lot of people complain. So, I'm going to also use Chrome to show you the options. So, in Chrome, if I go to settings and I go to privacy and security and scroll down, look at security. Notice here, "Use secure DNS service provider" is OS default. So, we are using the default settings on the operating system. If I look at my DNS settings, the DNS server is going to be 192.168.1.10, which once again is my Pi Hole server. I'll show you in a moment where I change this to Cloudflare. But let's start with this.
So on the left hand side, I'm going to run the script DNS monitor so that we can monitor DNS queries. And on the right hand side, I'm going to run the script SNI monitor where we can monitor TLS connections using SNI. So we see some stuff on the left hand side already. As an example, the router is sending information to UniFi. We've got some Windows update information. But now in Chrome, let's go to Nvidia. Let's go to Cisco. I'll go to my website. And let's go to ChatGPT.
So we can see Nvidia there. There's Cisco, my website, and ChatGPT. Looking at our scripts, I actually do see some information in the output here, which is interesting. But the point I want to make is notice the SNI traffic. We see Cisco, we see Google, we see OpenAI, Nvidia, and we see a bunch of other websites.
Going back here, let me close this down, and I'll do a DNS flush. So, I'll say ipconfig /flushdns. And let's get that up again. I'll go to davidbombell.com. I'll go to nvidia.com, cisco.com, chatgpt, and let's do something else. So, Canva as an example. So, canva.com. And again, we see Cisco, we see Canva, we see OpenAI, ChatGPT, we see my website. Okay. So, that's not working as well as I'd like.
So, let's do the example where we use Cloudflare. So rather than using the Pi Hole, what I'll do is set it to use Cloudflare directly. So we'll close all of that down and let's change the settings. Scrolling all the way down. Security. Scrolling down. Let's use Cloudflare. So secure DNS is used. Let's go for enhanced protection. So real-time AI-powered protection against dangerous sites. We are using Cloudflare. And let's try that again.
So on the left hand side we'll start our DNS monitor. On the right hand side we'll start our SNI monitor. So Nvidia, David Bombell, Cisco, ChatGPT, Canva. So various websites are displayed now. And notice now we see no traffic on the DNS side but we see all the connections in the SNI traffic. So even if your DNS is hidden, even if you're using encrypted DNS or some other system to hide your DNS, the ISP can still see your traffic using SNI. Not always true, but in a lot of cases is true. Nvidia, ChatGPT, Cisco, scrolling down, Canva, etc. I'm seeing these websites.
So I'll just try a few more as a last test because I'm beating a dead horse here. But let's go to Google Gemini. Let's go to, um, some news websites. So depending on which news you like to read, CNN.com, let's go Fox News, let's go BBC. So choose the website that you either love or hate. Telegraph, thecode.uk as an example. So without getting to the politics, forget about the politics from a political point of view, remember governments or states may decide that this is fake news and decide to block it as an example. So you know, I'm not going to get into left or right debate here. The point is is that a government could decide block CNN, block News, whatever. They could do that with just SNI information.
So I could search for stuff manually here, but what the script actually does is it writes stuff to a file. So rather than doing it that way, I could just say, "Okay, grep CNN SNI_log.txt." And you can see I went to CNN. Grep Fox. There we go. Grep Nvidia. And notice I have a log of every time you went to whichever website you decided to go to. I'm logging all of this on the internet-facing side of the connection. So my little UniFi router is getting an IP address once again from Starlink. I'm sniffing all of that traffic using my tap and my little Raspberry Pi. I can see every website that you've decided to go to and I can see a log of when you went to those websites, the date and time.
Now, I think this video is long enough. So, in a separate video, I'm going to show you how to block connections to certain websites. So, as an example, let's say the government decides that Fox News is fake news or CNN is fake news or the BBC is terrible or whatever. I'll show you how you can block those websites. So, we could say, okay, CNN is fake news. Let's block it. So, anything that's logged to CNN gets blocked.
Remember, in the UK, they are already doing this. They are blocking these websites. So a whole bunch of websites, as listed here, are blocked in the UK. So ISPs such as British Telecom, EE, Virgin, etc., are blocking those websites in the UK for, in this example, copyright reasons. But a government could decide that these websites are sanctioned and block them. All I want to show you is using encrypted DNS, using Cloudflare, using all kinds of fancy stuff is not going to stop an ISP, in a lot of cases, seeing your SNI and blocking those websites or just logging them.
Now again, in my previous video, which I've linked below, I explained ECH and how the encrypted hello could be used to hide the SNI, but it doesn't always apply. As I've demonstrated here, I've gone to all these websites. I'm simply using Starlink and I could log all of these websites that you potentially go to.
Okay, I think that's enough. Let me know in the comments. Do you agree with this? Do you like this? Did you enjoy this demo with these Python scripts? Let me know if there's any other videos you want me to create. In the next video, I'm going to show you how to block websites because this video is getting too long. I'm David Bombell and I want to wish you all the very.