Researchers at The Citizen Lab have for the first time released technical evidence of sophisticated mercenary spyware being distributed via online advertising.
I only know the basics of networking, so I’ve been wondering why this “DNS-sinkhole” functionality can’t simply be implemented directly in private routers (as some kind of blocklist) instead of adding a new device to your network. Do routers not support this for technical or security reasons?
Most consumer routers don’t offer this functionality out of the box, likely because manufacturers don’t consider it essential for most users. There’s no major technical reason it couldn’t be built in though. You can already set up DNS sinkholing with OPNsense or pfSense if you don’t mind running and managing your own router.
Routers are usually hardware level optimized for throughput, filtering is inherently computationally expensive compared to routing (not crazy expensive just more than usually fits an FPGA), especially if you have to keep up multi-gigabit throughput
You could totally do it at the router, it would just become a more expensive piece of hardware and most people choose to cheap out
I only know the basics of networking, so I’ve been wondering why this “DNS-sinkhole” functionality can’t simply be implemented directly in private routers (as some kind of blocklist) instead of adding a new device to your network. Do routers not support this for technical or security reasons?
Most consumer routers don’t offer this functionality out of the box, likely because manufacturers don’t consider it essential for most users. There’s no major technical reason it couldn’t be built in though. You can already set up DNS sinkholing with OPNsense or pfSense if you don’t mind running and managing your own router.
Routers are usually hardware level optimized for throughput, filtering is inherently computationally expensive compared to routing (not crazy expensive just more than usually fits an FPGA), especially if you have to keep up multi-gigabit throughput
You could totally do it at the router, it would just become a more expensive piece of hardware and most people choose to cheap out
I doubt a DNS filter would noticeably increase CPU usage. We’re not talking about deep packet inspection here.
A Raspberry Pi 3b is adequate to run PiHole to do the job, or implementing AdGuard DNS.
However, these require a little skill and knowledge to implement.
Consumer routers aren’t built to do the job.
I love my Pihole. It blocks ads on my PCs, my iPads, our streaming devices, etc. It also blocks telemetry gathering by other device manufacturers.