Feature Request: Norton ConnectSafe alternative to Yandex

[brummygit]

Hi Merlin

I would like to request a feature upgrade to include the free Norton ConnectSafe as an alternative to Yandex. I think they both work in the same way by offering different DNS servers depending on the protection level required.

If I use Yandex, the exception pages are in Russian and I am not as confident in them as I would be with Norton. The Russian certainly worries my family when they see it.

Would this be possible to include in a future release?

Thanks

 

[RMerlin]

Not sure at this time. I've been recently talking with Asus about this feature, so for now I don't know.

 

[Kobold]

The Russian certainly worries my family when they see it.

Yeah, Cyrillic letters make them think they are going to be raped, killed and ripped to pieces. Even seeing Russian can damage your mind beyond repair. Russian is even more powerful than Arabic! Beware!

 

[brummygit]

I think it's more a case of them reaching a page they didn't expect in a language they can't read. This leads them to think they already found some malware.

 

[Sky1111]

I think it's more a case of them reaching a page they didn't expect in a language they can't read. This leads them to think they already found some malware.

Completely understandable. Your family may not be able to differentiate between Yandex warning and some ransomware attack... however, look at the situation from a different angle: it is either GRU (former KGB) collects information, or NSA .

On a serious note, you can always set up Norton's DNS server on each system you want to protect...


What does really concern me is that with the current unprecedented attack on our freedoms, what if tomorrow Yandex or Norton decide to block, for example, popular torrents sites, or news site they (or their corresponding government) do not approve - "not safe for your family"?
Thanks to Merlin, this DNS protection is per MAC address, not a global setting - really good idea Merlin!

 

[brummygit]

I agree that there is never a perfect option and already use Norton for my main DNS servers but I prefer the granular configuration approach that is provided for Yandex. This would allow different configurations for the devices of various members of my family.

At the end of the day if any service becomes unusable due to external influences then I can always remove it.

 

[RMerlin]

I think it's more a case of them reaching a page they didn't expect in a language they can't read. This leads them to think they already found some malware.

Good. That will scare them enough so they will never try to visit that site again

 

[brummygit]

Good. That will scare them enough so they will never try to visit that site again

You might have a point

 

[RMerlin]

I took a look at how YandexDNS is implemented. The implementation has a few annoying limitations that doesn't really make it useful for implementing other DNS services.

• When enabled, it completely overtakes control of DNS. That means unfiltered devices will STILL use Yandex's DNS, except they use one that isn't filtering. Implementing support for any other service would require the implementation to be redesigned to use the ISP DNS for non-filtered devices.
• It disables the local resolv.conf, which means that VPN clients that obtain DNS servers from the remote end will not use these provided DNS servers anymore

The current solution would require a fair amount of redesign to be able to work with any other DNS providers (and also to resolve the issues it creates). Technically possible, but not something I can put a high priority on.

 

[brummygit]

Thanks for looking

• When enabled, it completely overtakes control of DNS. That means unfiltered devices will STILL use Yandex's DNS, except they use one that isn't filtering. Implementing support for any other service would require the implementation to be redesigned to use the ISP DNS for non-filtered devices.

I could live without a "no protection" option if it was enabled, but I appreciate that this may not work for others.

• It disables the local resolv.conf, which means that VPN clients that obtain DNS servers from the remote end will not use these provided DNS servers anymore

Again this wouldn't be an issue for me, however I see that others may feel differently.

The current solution would require a fair amount of redesign to be able to work with any other DNS providers (and also to resolve the issues it creates). Technically possible, but not something I can put a high priority on.

That's OK - thanks for taking a look at the options

 

[RMerlin]

I'm not sure why Asus chose to completely override the regular DNS handling done by dnsmasq when Yandex is enabled. Pretty sure they could simply have added iptable rules to redirect traffic to the appropriate DNS server if a specific MAC address gets matched. Something similar to the "Redirect ALL DNS queries" found on the Wiki, but matching with a MAC:

https://github.com/RMerl/asuswrt-merlin/wiki/Iptables-tips