

Yeah, I have my own DNS server that caches from multiple backing servers as needed. I’m not worried about DNS blocking, it’s never been effective. The issue is ISP level blocking usually isnt just DNS blocking, it’s also involves IP level blocking, many of which dont work on IPv6 which is one reason (besides just resistance to replacing old hardware) it hasn’t been adopted widely by consumer ISPs. If you have only a single, unchangeable (by anyone other than them) IP address, they have much more control and your traffic is much easier to track and manipulate.
And there is even lower level blocking at lower layers of the network stack. ISPs can intercept and mangle packet’s destinations at any layer because your traffic must go through them and so your networking equipment must trust their equipment to properly route traffic. They don’t do it now mostly because it means adding a lot more processing power to analyze every packet. I do it all the time at home to block ads and other malicious traffic. But if they’re required to upgrade to allow for that level of traffic analysis, by law, then that opens the floodgates for all kinds of manipulation either politically or capitalistically nefarious in nature.




Yeah get that. I do it because my pangolin is segregated so that if that internet facing layer is penetrated, there’s not much else they’ll have access to. Similarly, if my WiFi is penetrated, there’s just a few devices. And many of my services run on Kubernetes distributed and load balanced across a bunch of cheap devices, so it needs reverse proxying at the ingress anyway. And there are a few other reasons for keeping traffic off of the pangolin server or even the router when it’s internal to internal, but still be able to use the single domain name for the service, especially with IPv6 not having static IP addresses quite the same way as IPv4, so not wanting to hard code IP addresses or even port assignments in services that back other services like the database server which originally was just running on the NAS, but switching it over to another system only required changing the internal reverse proxy, not every service that used it. I like abstraction like that.