DNS threat-blocking comparison: 8 DNS services

[Evjl's Rain]

my hungarian ISP DIGI blocks both 1.1.1.1 and 1.0.0.1
I could probably never be able to use Cloudflare DNS

 

[mekelek]

my hungarian ISP DIGI blocks both 1.1.1.1 and 1.0.0.1
I could probably never be able to use Cloudflare DNS

i would have tried if i werent running Heimdal but i guess its too late now

 

[ForgottenSeer 58943]

http://any.ac/E394n6.webm

gave a chance to Forticlient, I'm getting stomach problems from the UI and the way UI works

you can get into settings, but you can't edit it. once you find somewhere an option that asks to elevate, you can, but then its bugged.

lets not talk about how group selection works...

if you want to elevate, you can't just have a main option, you have to go to that certain option to elevate every time.

then it blocked my own domain for being new, fine, tried disabling those categories, as shown on the webm, doesn't work.

logs tab has no option to right click and exclude, you gotta go to Exclusions and manually fill it out.

and all this just with one module, I can't imagine what it's like with all the other modules....

i suggest them hiring some UI designer cause all the technology is wasted behind this catastrophy they call a console.

Looks like user error, I've never heard of such issues and I think a good number of people on the forum use it. Maybe they can help you. Also, keep in mind, the GUI is rarely seen by end users, it's for enterprise and the configuration takes place on the Fortigate/EMS and is pushed to the clients. Also, most of us make adjustments in the CONF file, not in the GUI and in the CONF you have flexibility enough to practically re-design how the entire product works.

 

[mekelek]

Looks like user error, I've never heard of such issues and I think a good number of people on the forum use it. Maybe they can help you. Also, keep in mind, the GUI is rarely seen by end users, it's for enterprise and the configuration takes place on the Fortigate/EMS and is pushed to the clients. Also, most of us make adjustments in the CONF file, not in the GUI and in the CONF you have flexibility enough to practically re-design how the entire product works.

that UI bug is not user error, you literally can't change those categories at all.

 

[CyberTech]

my hungarian ISP DIGI blocks both 1.1.1.1 and 1.0.0.1
I could probably never be able to use Cloudflare DNS

You can use VPN then..

 

[Evjl's Rain]

You can use VPN then..

why? in order to use just a DNS?
VPN usually slows down the internet speed a bit despite the fastest VPN in our regions and it does cost some money
even if I use a slow DNS, it's still faster or the same as using under the fastest VPN with the fastest DNS

In my region, google DNS is even faster than my ISP's DNS so I will stick to Google DNS if I want speed. Privacy is not a problem for me

 

[Pat MacKnife]

my hungarian ISP DIGI blocks both 1.1.1.1 and 1.0.0.1
I could probably never be able to use Cloudflare DNS

How do they block it ? with things on your router level ?
Have you try to set 1.1.1.1 in your computer system (in options ipv4 and ipv6 that should work No ?)

 

[Evjl's Rain]

How do they block it ? with things on your router level ?
Have you try to set 1.1.1.1 in your computer system (in options ipv4 and ipv6 that should work No ?)

yes I did try but nothing could be loaded even google.com or malwaretips.com
I also tried to ping it but it got "destination host unreachable

I think it's at ISP level because I don't change anything in my router

 

[HarborFront]

I found out that my stupid At&t DSL/Fiber Gateways blocks the IP 1.1.1.1. If you are not able to resolve addresses, use 1.0.0.1 instead for Cloudfare.

Beware if you use DNS over TLS your local Hosts file and your AV won't kick in to block phishing/adware/malware domains because they are not programmed to check traffic over other ports, much less encrypted traffic.

So, which AVs don't check encrypted traffic currently if use DNS over TLS?

Thanks

 

[DeepWeb]

So, which AVs don't check encrypted traffic currently if use DNS over TLS?

Thanks

Emsisoft Anti-Malware. Mostly because DNS over TLS uses a different port than 53 so it flies straight under the radar of everything. The pro is faster resolution I guess....
DNS over TLS also breaks Windows 10 Store too.

 

[Chimaira]

http://any.ac/E394n6.webm

gave a chance to Forticlient, I'm getting stomach problems from the UI and the way UI works

you can get into settings, but you can't edit it. once you find somewhere an option that asks to elevate, you can, but then its bugged.

lets not talk about how group selection works...

if you want to elevate, you can't just have a main option, you have to go to that certain option to elevate every time.

then it blocked my own domain for being new, fine, tried disabling those categories, as shown on the webm, doesn't work.

logs tab has no option to right click and exclude, you gotta go to Exclusions and manually fill it out.

and all this just with one module, I can't imagine what it's like with all the other modules....

i suggest them hiring some UI designer cause all the technology is wasted behind this catastrophy they call a console.

I run only the web filtering module and honestly it was easy to set up all the things I wanted to block and I never touch it now.

I've had none of the problems you've mentioned. Very strange.

 

[CyberTech]

why? in order to use just a DNS?
VPN usually slows down the internet speed a bit despite the fastest VPN in our regions and it does cost some money
even if I use a slow DNS, it's still faster or the same as using under the fastest VPN with the fastest DNS

In my region, google DNS is even faster than my ISP's DNS so I will stick to Google DNS if I want speed. Privacy is not a problem for me

No man you use VPN to visit the site what you want to see and change the DNS then stop using VPN....

 

[mekelek]

I run only the web filtering module and honestly it was easy to set up all the things I wanted to block and I never touch it now.

I've had none of the problems you've mentioned. Very strange.

so you're saying you can't replicate what i showed in the webm?

 

[Chimaira]

so you're saying you can't replicate what i showed in the webm?

Yes. When I change those settings they stick and don't change back like it shows in your webm.

 

[mekelek]

Yes. When I change those settings they stick and don't change back like it shows in your webm.

i guess its time to reinstall it and try again

 

[mekelek]

yes I did try but nothing could be loaded even google.com or malwaretips.com
I also tried to ping it but it got "destination host unreachable

I think it's at ISP level because I don't change anything in my router

I have changed my DNS to 1.1.1.1 and secondary to 1.0.0.1 and it works just fine

 

[mekelek]

i guess its time to reinstall it and try again

alright so i reinstalled it, the issue still exists, but after backing up the config, editing it and restoring, it works.
it's a UI bug for sure.

ps: after restoring an edited config file, the UI showed correctly, then after closing it and opening it again, the UI is back to showing wrong things, but Forticlient is behaving based on the config restored and not based on the UI.
well I can live with this.