Is it possible to always show a blank image instead of warnings? Probably not, right?

[mfioretti]

Greetings,

I just installed Technitium DNS Server 15.4, and like it, thanks!, and I would really appreciate a clarification about what I see in the browser instead of ads when Technitium is running, to know what am I missing, and if I I got certan thing right or not.

Question 1: why, exactly, certain ads are replaced with blank spaces, and others with error messages like the one pasted at the bottom?? I guess that ads that just disappear were clickable images, and those that generate messages like below are iframes instead. Am I right?

Question 2: if I am right, would it be possible to replace even THOSE ads with blank boxes? I fear not, because that could only happen with some other server that either a) replaces those iframes with other HTML BEFORE the browser reads it, or b) is a proxy between the browser and the internet that does the replacement every time a browser requests certain domain names. Again, am I right here, and if I am wrong, is there a way to make even those iframes look blank?

EDIT:

I just found out now (of course) this comment on the technitium blog that seems to me a confirmation my hypothesis in Question 1 about iframes is correct:

Technically you can return any IP address from the DNS server instead of 0.0.0.0 for blocked domain names but, practically it wont work.

This is since most websites nowadays are served over HTTPS and thus you wont be able to show custom error message for most websites. If you implement it then users will mostly see SSL certificate error notices instead of your custom error page.

Secondly most blocked items are Ads that are loaded using iframes and that space will too show SSL errors and create a mess.

Again, confirmation is welcome!

Thanks in advance!!!

Example of the messages I would like to NOT see, but replace with blank area instead:

Be careful. Something doesn’t look right.

Firefox spotted a potentially serious security issue with a2f0762009c2d3ae5e2beb26cd2e3254.safeframe.googlesyndication.com. Someone pretending to be the site could try to steal things like credit card info, passwords, or emails.

a2f0762009c2d3ae5e2beb26cd2e3254.safeframe.googlesyndication.com has a security policy called HTTP Strict Transport Security (HSTS), which means that Firefox can only connect to it securely. You can’t add an exception to visit this site.

[ShreyasZare]

Thanks for the post and compliments.

Question 1: why, exactly, certain ads are replaced with blank spaces, and others with error messages like the one pasted at the bottom?? I guess that ads that just disappear were clickable images, and those that generate messages like below are iframes instead. Am I right?

It depends on how the iframe is loaded. When the DNS resolution fails, the browser may show some default error page inside the iframe. If you have configured Block Page app then there will be SSL error displayed inside the iframe. There is pretty much nothing that can be done about it since the blocking is being done at the DNS level and the DNS server does not know what page/URL you are visiting.

Question 2: if I am right, would it be possible to replace even THOSE ads with blank boxes? I fear not, because that could only happen with some other server that either a) replaces those iframes with other HTML BEFORE the browser reads it, or b) is a proxy between the browser and the internet that does the replacement every time a browser requests certain domain names. Again, am I right here, and if I am wrong, is there a way to make even those iframes look blank?

If you install the Block Page app and have the root cert it generates installed on your client system then the SSL error will go away and the block page app's html content will show up inside the iframe. The Block Page app essentially will do SSL MiTM attack and since you have the root cert installed, the web browser will trust the connection.

[mfioretti]

Thank you for the prompt answser. Wrt this part:

If you install the Block Page app and have the root cert it generates installed on your client system then the SSL error will go away and the block page app's html content will show up inside the iframe. The Block Page app essentially will do SSL MiTM attack and since you have the root cert installed, the web browser will trust the connection.

what I would like to do is to NOT see the "html content inside the iframe" but an empty / 100% white iframe, because it's just another ad that tracks me (at least that't the case with almost all the websites I usually visit). If that's not possible OK, it would have been a nice esthetic improvement but only esthetic, I can certainly live without it.

[ShreyasZare]

If you create an empty html page and configure the Block Page app to use it then the content inside the blocked iframe will be empty page.

[mfioretti]

If you create an empty html page and configure the Block Page app to use it then the content inside the blocked iframe will be empty page.

Thanks but... how to I tell that app to use the html page I created? I did install the app, but when I click on "Config" I only get to edit the config file below and honestly I don't recognize where I should put the full path to that page. Or maybe I should set
serveBlockPageFromWebServerRoot to true, and then just write the text I want to show users in the blockPageMessage variable?

Thanks

[
  {
    "name": "default",
    "enableWebServer": true,
    "webServerLocalAddresses": [
      "0.0.0.0",
      "::"
    ],
    "webServerUseSelfSignedTlsCertificate": true,
    "webServerTlsCertificateFilePath": null,
    "webServerTlsCertificatePassword": null,
    "webServerEnableOnlineCertificateSigning": true,
    "webServerRootPath": "wwwroot",
    "serveBlockPageFromWebServerRoot": true,
    "blockPageTitle": "Website Blocked",
    "blockPageHeading": "Website Blocked",
    "blockPageMessage": "This website has been blocked by your network administrator.",
    "includeBlockingInfo": true
  }
]

[ShreyasZare]

You need to configure the Blocking option to use Custom Blocking Address and set the IP address of your DNS server in there. This will cause all blocked domain names to resolve to your DNS server's IP address and the client will send HTTP requests to it. The Block Page app that you have installed will handle all these HTTP requests and answer back with the html page you configure.

You can have your own blank html page saved in a folder on the server and configure it to allow read permission for the DNS server's user. Then set the webServerRootPath option in the Block Page app to use the folder you have the index.html page in. Also ensure that serveBlockPageFromWebServerRoot is set to true so that the root path is used to serve the html page.

Once the above config is done, the blocked pages/iframes will get the blank html page. Now, you will see SSL error which you can fix by installing the self signed cert pfx file you will find in /etc/dns/apps/Block Page folder on the DNS server.