1

I use the openDNS servers : 208.67.222.123 / 208.67.220.123 as DNS provider for my PC.

When I go to an inappropriate http:// (adult content), I got redirected to https:// open dns site.

I just wonder how a DNS server can redirect from HTTP to HTTPS content ?

(and eventually How to disable that ?)

2

OpenDNS DNS system returns an IP number when you request the inappropriate site. Your browser connects to the server located at the IP which is run by OpenDNS. They perform the redirect from their server using their code. I doubt that you can change this behaviour.

1

You can't change the IP address that an OpenDNS server will return when your system looks up an IP address for a domain name, e.g, example.com. If the OpenDNS server returns an IP address for one of their own web servers, that web server can do an automatic redirect to another URL, e.g., from http://example.com to https://example.com, if the IP address points to example.com by returning an HTTP 301 status code to your browser along with the redirect URL. They could redirect your browser to https://example.com or http://someothersite.com as long as example.com resolves to an IP address for their own server.

You could however modify the hosts file on your system to point to the correct IP for example.com. On Microsoft Windows systems the file is found at C:\Windows\System32\Drivers\etc\hosts. Edit the file with a text editor, such as Notepad, but be sure Notepad doesn't add a .txt to the end of the file name, and add the following line to the file, substituting the real IP address and fully qualified domain name (FQDN):

10.5.0.25 example.com

If you might use www.example.com or example.com, add both to the host file. E.g.:

10.5.0.25      example.com
10.5.0.25      www.example.com

Note: if your account isn't in the administrators group on the system, you will need to right-click on Notepad, or whatever editor you use, and choose "Run as administrator" and then provide the userid and password for an administrator account in order to save any modifications you make to the hosts file.

You can use some other DNS server, e.g., the one provided by Google at 8.8.8.8, to find the correct IP address for www.example.com by issuing the following command at a command prompt:

nslookup example.com 8.8.8.8

Or you could get the IP address for example.com by using an online DNS service, such as DNS Lookup.

Then whenever you put http://example.com in your browser's address bar, the system should first check the hosts file for any FQDN to IP address mapping. If it finds a relevant entry there, it does not need to consult a DNS server to obtain an IP address.

Since your system is configured to use the OpenDNS parental control DNS servers, e.g., see FamilyShield Router Configuration Instructions, rather than the regular OpenDNS DNS servers, you are being redirected to the block.opendns.com system. I.e., since your system is using 208.67.222.123 and 208.67.220.123, rather than 208.67.222.222 or 208.67.220.220, since the latter return 206.125.164.82 for sex.com as does Google's DNS server at 8.8.8.8 while the former returns 146.112.61.106 as the IP address for sex.com, you are sent to block.opendns.com rather than the web server for the site.

$ nslookup sex.com 208.67.222.222
Server:     208.67.222.222
Address:    208.67.222.222#53

Non-authoritative answer:
Name:   sex.com
Address: 206.125.164.82

$ nslookup sex.com 8.8.8.8
Server:     8.8.8.8
Address:    8.8.8.8#53

Non-authoritative answer:
Name:   sex.com
Address: 206.125.164.82

$ nslookup sex.com 208.67.222.123
Server:     208.67.222.123
Address:    208.67.222.123#53

Non-authoritative answer:
Name:   sex.com
Address: 146.112.61.106

If you connect to port 80 at 146.112.61.106 by telnet and emulate the query a browser would submit by entering the query below you can see the response from the website at that IP address:

GET / HTTP/1.1
Host: sex.com

The response is as follows:

$ telnet 146.112.61.106 80
Trying 146.112.61.106...
Connected to 146.112.61.106.
Escape character is '^]'.
GET / HTTP/1.1
Host: sex.com

HTTP/1.1 403 Forbidden
Server: openresty/1.7.7.2
Date: Sun, 09 Aug 2015 18:05:01 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive

202
<html><head><script type="text/javascript">location.replace("https://block.opendns.com/?url=84708915688078&ablock&server=ash15&prefs=&tagging=&nref");</script></head></html> 

I'm uncertain now what you actually want to do. If you want to visit the actual website as your question suggests, the hosts entry should allow you to do so, if you add the following entries to it:

206.125.164.82   sex.com
206.125.164.82   www.sex.com

If, however, you wish to redirect your browser to go to a website you control as your comment suggests, then you will likely need to use a proxy server, such as Fiddler and add its security certificate to the trusted root certificates list on your system, so it can be a man-in-the-middle (MITM) so that the browsers on your system don't realize they aren't getting the actual security certificates for sites you visit using HTTPS. Some malware, such as Genius Box, uses MITM attacks to intercept and alter HTTPS traffic.

  • Intersting... When I go to sex.com, it reditects to block.opendns.com. Using hosts file however I cannot redirect that https to my domain : it will give CERTIFICATE error HTTPS. Is there a way to redirect to my site BEFORE opendns redirect to HTTPS ? – yarek Aug 9 '15 at 17:46
  • @yarek, I thought you wanted to go the actual website for the domain, but your comment suggests that isn't what you want to do. Your comment suggests that you want to redirect any attempts to go to the actual website to your own domain name, instead. Your browser will, of course, report that your website's security certificate isn't a valid one for the domain unless you own sex.com and its certificate. Are you trying to redirect browser queries to your own domain name, instead? I added some additional information above to what OpenDNS is doing. – moonpoint Aug 9 '15 at 18:28
  • AMAZING ! Infact What I try to do is: when opendns sees an adult site, it redirects to 146.112.61.106 where a javascript redirect to https version. What I want is to redirect to my 127.0.0.1 server instead of 146.112.61.106: can this be done ? HOSTS 127.0.0.1 block.opendns.com was working before the HTTPS redirection change. – yarek Aug 9 '15 at 21:49
  • my solution would be to MAP 146.112.61.106 to 127.0.0.1 : can this be done ? Maybe with netsh command or route command ? (windows) – yarek Aug 9 '15 at 21:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.