I was assuming that there is a court order saying make sure that your customers cannot access the file served at URL http://blah/the_judges_mum.mpeg. The ISP would then simply configure his DNS forwarder to use his own resolver for blah (a one liner) which in turn would serve a dummy IP address. Job done, no need to touch it ever again. Performance penalty almost none. Clients will cache DNS data for hours so serverload is low.
Filtering on IP level is much more expensive. Of course the equipment can do it but it requires a lookup in an ever growing filter list for every IP packet to be routed (millions per second).
AFAIK Russia does block telegram, though probably not wholly successfully.
Peter wrote:
Well, a court order to an ISP to block DNS resolution if it yields an IP within a given range (which I assume is what you describe)
No, blocking by DNS typically is block DNS resolution of a domain or hostname. This is done easily by configuration of the DNS resolver. “Just” configure that domain to resolve internally rather than interrogate the official DNS servers hierarchy.
Isn’t that trivial to circumvent? Even if all Italian ISP’s DNS servers are “hiding” a particular domain, I could simply configure the connection to use 8.8.8.8 or any other DNS server. And if they somehow inspect packets and prevent DNS resolution that way, I can configure the address locally if I really want.
Of course, but > 99% of people won’t know that.
The ones who want to do dodgy stuff on the internet and horny teenagers are more likely to be in the 1% than in the 99.
