-3

I'm using Unbound as a resolver, and I'm curious if there's a way to block all HTTP traffic with it; in 2021, every website that doesn't use HTTPS is garbage.

Prajwal

Improve this question
2
  • 2
    Blocking outgoing HTTP traffic will have implications on your software updates. You may want to consider the broader implications of your objective.
    – matigo
    May 24, 2021 at 14:53
  • Purely informational, or recreational websites, that process no confidential information, do not have reasons to be served via HTTPS. HTTP is still good enough for these sites. Also, DNS has nothing to do with HTTP/HTTPS. You can use DNS to block access to a particular domain altogether, but not to individual services on that domain. That's firewall's job, not DNS's.
    – raj
    May 24, 2021 at 16:39

2 Answers 2

Reset to default
6

The answer is: no. A DNS resolver cannot block traffic. It can only resolve DNS queries.

Improve this answer
7
  • You have no idea what you're talking about, my good sir.
    – Prajwal Koirala
    May 24, 2021 at 14:00
  • If you say so. Pray tell me how a DNS resolver would be able to block traffic then.
    – Tilman
    May 24, 2021 at 14:04
  • Before the resolver send the traffic to a certain website, we tell the resolver to forward it to 0.0.0.0 or some other ip that's invalid.
    – Prajwal Koirala
    May 24, 2021 at 14:51
  • 2
    @PrajwalKoirala DNS has zero awareness as to whether you're talking over HTTP or HTTPS or not (it only speaks DNS it is not protocol-aware of what's going to use the DNS resolution - and as a Network Security expert by trade I can guarantee this). That's an Application level issue, not a DNS one. You're talking about Firefox's HTTPS only mode or similar HTTPS Everywhere plugins in Chrome/Chromium. The pnly alternative to those plugins is to block all outgoing traffic to port 80 on your firewall in an Outboud direction, however this will break your non-HTTPS things like ubuntu updates.
    – Thomas Ward ♦
    May 24, 2021 at 15:24
  • 2
    @PrajwalKoirala and Unbound, BIND, SystemD-ResolveD, etc. are all DNS Servers and Clients - they only know about DNS, and only can speak DNS, they can't resolve based on the requested protocol (HTTP/HTTPS), because they only know DNS and not the application level protocols that you're talking about which happen outside of DNS
    – Thomas Ward ♦
    May 24, 2021 at 15:25
3

Assuming the goal is to block your browser from accessing web content without an SSL certificate, you can do this with FireFox by setting HTTPS-Only mode.

In FireFox, go to settings and scroll right to the bottom. You'll see an option to enable HTTPS-Only mode:

FireFox - HTTPS Only

This will try to upgrade insecure connections to a site and, if the visiting site does not support HTTPS, a message will be shown letting you know (better than a blank page) that there is no SSL certificate. You can read more about FireFox's implementation of HTTPS-only mode via their documentation.

Chromium-based browsers, as far as I can tell, do not yet have any feature like this.

Of course, if you really want to block all HTTP traffic, you can do this:

sudo ufw deny out 80

This will break all sorts of things almost immediately, but you'll have your wish: zero requests will leave your computer over HTTP.

Improve this answer
1
  • Re blocking outgoing port 80: not quite. Port 80 is the standard port for HTTP, but HTTP can and often will be spoken over other TCP ports. 8080, for example, is quite popular.
    – Tilman
    Jan 17, 2022 at 7:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .