743
this post was submitted on 16 Apr 2025
743 points (99.2% liked)
Technology
69098 readers
3708 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Sometimes even that's not enough. I've had some questionable kit before that would just ignore the DNS settings fed to it if it thought they were no good, and fall back to something else preconfigured.
pfSense is a wonderful tool for situations like that. Anything intended for local use only here just doesn't get outside at all. Handy for stuff like a fire stick that only needs to be calling up a local media library.
It can also mangle any DNS requests going out to a different server and redirect them to itself instead. You could do this without it with iptables/nftables on a generic Linux box, but pfSense makes it much friendlier.
There are other packages that can do the same, but physically all you need is one piece of hardware as a bouncer that manages connections between inside/outside.
what can it do if the TV uses DoH, DoT, or something else similar? I expect that it can do nothing. unless the TV is on a separate vlan with very strictly only access to internal services
Don't connect it at all and just use an Android TV box or dongle.
well that's what I'm saying to the parent commenter
At that point I would expect control of it, or at least for it to respect the configuration it is given. If neither are true, then it just doesn't go online at all. If that's part of the main function, then I find an alternative or live without it.
Nothing on the inside should be sending anything to the outside that can't be inspected before it leaves, with the exception of stuff that is directly driven by a human (guests browsing, etc).