QUOTE(Kadaj @ Jul 19 2024, 09:03 AM)
This is definitely evil...
Makes me think their only reason for going with ZTE for next gen network is importing censorship from CCP.
QUOTE(zhuoyang @ Jul 20 2024, 02:35 AM)
No wonder yesterday suddenly my android private dns settings suddenly not working.
Btw this redirecting will break TLS right? Considering if we use DoH or DoT
If your resolver is properly configured then it should break TLS.
Mikrotik by default won't validate certificate if you enable DoH so this will successfully poison all Mikrotik device. If you use Mikrotik resolver you must manually import the CA certificate and enable validation.
I have verified the following resolver to be safe:Android Private DNS. This is the most noob-proof resolver as in they won't allow you to configure it wrongly.
systemd-resolved (if you configure domain name)
CODE
[Resolve]
DNSOverTLS=yes
DNS=2606:4700:4700::1111#one.one.one.one 1.1.1.1#one.one.one.one
stubby (if you configure tls_auth_name)
CODE
tls_authentication: GETDNS_AUTHENTICATION_REQUIRED
- address_data: 2606:4700:4700::1111
tls_auth_name: "one.one.one.one"
Windows 11, Firefox, Chromium-based browser (if you use full path)
CODE
https://cloudflare-dns.com/dns-query
This post has been edited by kwss: Jul 21 2024, 12:41 AM