Hub 5 Intercepting all DNS queries?

[deev]

Hi,

I've just moved to Virgin from Sky.

After setting up my Router, and disabling all WebSafe stuff online, I got some weird DNS failing to resolve issues - hostnames that if i switched back to Sky, we're working fine, and my other colleagues can all connect fine.

I noticed that I couldn't change the default DNS server on the Router itself, a quick google said that's no longer possible with this new hub.

I then updated my Wifi Connection DNS servers on both a Windows and Mac device and both of them claimed to be searching through either 1.1.1.1 or 8.8.8.8, but both failed to return the results.

I can only assume that VM is intercepting all DNS queries, even when you specifiy an alternative? Also not sure why they're failing to resolve so many different generic AWS domains.

Has anyone else had similar issues / knows of a way to fix it?

My next port of call will be switching to https based DNS, but I'd rather not 😞 

[Adduxi]

On one of the machines you have set a static DNS on, what does nslookup show ?

[Client62 · Accepted solution]

DNS interception & DNS / AWS resolution issues have appeared as repeat gripes of Hub 5s in Router mode. 
The fix is to use Hub 5 in Modem mode + a Wi-Fi Router.

[legacy1]

VM really locking down the hub pretty soon most will use modem mode...

[Adduxi]

---

@Client62 wrote:

<snip>  The fix is to use Hub 5 in Modem mode + a Wi-Fi Router.

---

Yes, totally agree.  I run the Hub 5 in modem mode with a non Wifi Router and use AP's.  Everything works as it should.

[Adduxi]

---

@legacy1 wrote:

VM really locking down the hub pretty soon most will use modem mode...

---

If only they would go back to the days of supplying just a decent cable modem.  But then again, 99% of the user base would leave .....   😉

[Client62]

The Hub 5 does appear to be decent as a modem. 

As a Router, Hub 5 has many known issues, its recent software / firmware release has not resulted in a single post saying a known problem has been resolved.

[legacy1]

---

@Adduxi wrote:

---

@legacy1 wrote:

VM really locking down the hub pretty soon most will use modem mode...

---

If only they would go back to the days of supplying just a decent cable modem.  But then again, 99% of the user base would leave .....   😉

---

I don't think so if VM can go from modems to hubs they can go hubs to modems like we have desktops and laptops and we know  desktops are better

[deev]

I have setup DNS over HTTPS from Cloudflare (guide: https://blog.smittytone.net/2022/05/07/how-to-do-dns-over-https-on-macos/) which works fine, though obviously doesn't work for all other devices on my network.

I will eventually get a new router and switch the VM to modem mode, thanks for the help 

[jk1990]

Setup static IP on device to make the required changes

E.g. IP 192.168.0.200

Subnet 255.255.255.0

DNS 192.168.0.1

On RaspberryPi

install Adguard via one line config:

sudo wget --no-verbose -O - https://raw.githubusercontent.com/AdguardTeam/AdGuardHome/master/scripts/install.sh | sh -s -- -v

It will display URL to navigate Adguard admin console in a browser

Settings – DHCP (enable): My settings as below with the raspberryPi set to a static IP of 192.168.0.2 (outside of the range of IP addresses).

RaspberryPi static IP config (in green). IPv6 static IP is the local-link IPv6 which you will see if you run ifconfig. It starts fe80:

Add required filters in Adguard. I got tracker + ad block and then a large threat intelligence database.

Setup required DNS in Adguard (I opted for these SecureDNS). Find your optimal DNS servers using the DNS speedtest: https://dnsspeedtest.online/

On Hub 5 go to admin console 192.168.0.1 and login

Advanced – DHCP – Disabled

Now devices will get pushed to the AdGuard DNS and receive IP via Adguard DHCP server. & you are away.

I ran this over a year without issues previously. Example of it blocking:

Considering my £20 ebay Rasberry Pi 3b+ had been in a draw for over a year, it gives it some life back. Cheaper than a new router, some nice features to block ads etc natively. I also opted for the cloudflare DNS that auto blocks security risks (layering up on security). For me google DNS is always much slower so it serves as a backup only really. 

If anyone attempts this, welcome to message back here, I will hopefully receive and see the notification email and it would be my pleasure to offer any tips required. 

Goodbye evil corp DNS interception. Notably my Sky Hub SR203 intercepted DNS in the same way so I am surprised as an ex-sky customer this appears new to you. Perhaps Sky had me on extra special monitoring 😄