What to look for when getting an internet connection?

[MentoDates]

OpenWRT's dnsmasq is too fragile, just put a public resolver in WAN

I have just done that

I assume you would be running PiHole/AGH on a different LXC/VM, then you should advertise that in DHCP, RDNSS/DHCPv6.

Already been using that.

 

[unnecessary]

Guys one question, what act does specifically to improve pings? Here in my city Jaipur they use tata as their upstream, same as Excitel. I've heard someone say on this forum that they block certain packets for better pings, so how's that done? Also DNS hijacking means I can't set my custom DNS on the router level? Like even if I use my own secondary router? Please tell.
Thanks

 

[MentoDates]

Static IP is worth it especially if you are on CGNAT and are doing homelab kind of stuff.

so i did end up getting static ip

i get the following results in NAT behaviour discovery using STUN Test

1. NAT mapping behavior: endpoint independent
2. NAT filtering behavior: address and port dependent

however, it still says Type 2 NAT on my PS5

after getting static , i think they are not doing any DNS Hijacking, because all the Prerequisite Tests for unbound are successful. I eneded up setting up pihole with unbound now

and i get following buffer bloat test with SQM of 700mbps download and 500 mbps upload limits

i was finally able to remote access Plex without Taiscale because of Static IP via UPnP on my OpenWRT Router

 

[MentoDates]

Also DNS hijacking means I can't set my custom DNS on the router level?

You can set it , however ISP can Still enforce their own DNS, technically what you said is True. for eg if some websites are blocked by ISP, They should be accessible by using another DNS servers, however they are still blocked despite using cloudflare 1.1.1.1 servers. This is what ha happened in my case. You can bypass this using DoH if your router supports it or you can use a local dns server such as AdGuard Home with upstream DNS Server set with DoH, and pointing your router to AGH

 

[x86_64]

Your speculation about DNS hijacking is not correct.
There have been no instances till now where major Indian ISPs have altered DNS responses from public resolver by intercepting them.
Sites still being blocked on your end is because of SNI based blocking done by their middleboxes not because DNS being hijacked.

I have performed a DNS measurement of a govt blocked domain to 1.1.1.1 with all RIPE Atlas probes in India which also includes ACT and all of them have successfully returned correct DNS response without any hijacking.

RIPE Atlas - RIPE Network Coordination Centre

RIPE Atlas is the RIPE NCC's main Internet data measurement system.

atlas.ripe.net

 

[MentoDates]

Your speculation about DNS hijacking is not correct

You are probably right. I am not literate on this. I saw someone also saying the same about ACT on reddit and they also said the same. I only used that term because i am not sure what other word to use.

 

[x86_64]

Correct term would be DNS filtering on their own resolvers.
Just like you filter ad serving domains on your pihole, ISPs filter blocked domains on their resolver.

 

[MentoDates]

DNS filtering

So they are actually filtering out Unbound DNS Root Servers?

But when i got a Static IP, i am able to access the Unbound DNS Root Servers without any issue.

What could be happening. I don't seem to understand.

 

[thatayush]

There is a mechanism called SNI - What is SNI? How TLS server name indication works

They can read this mechanism since this is before TLS, that's how its blocked

 

[f0r3he4d]

theres ESNI and ECH to counteract this but most of the websites don’t implement it as it is an optional feature.