My Internet Provider lets big tech onto my home network.
| 3 min read
Recently I've learned that much of todays browsing no longer happens through the TCP protocol. But goes via the 'unmonitored' UDP protocol. Supposedly because it's faster and more private. QUIC I think this technology is called. I don't really understand how any of that works. TCP, UDP they're protocols and there are many protocols. Some are used for web traffic, and all kinds of things. I know it exists, never really looked into it.
This method of browsing has been around for ages. I think I saw a post where someone mentioned it being in use in 2013, but I only discovered it because it was blocked on my pfSense router. When I read some docs about why there are massive amounts of blocks on UDP:443 going in and out of my network I found out that it's the browser. And when I opened the outbound port my internet felt like 4 times faster. Because why would we use standard TCP:80 and TCP:443. right?
Now that's all fine and dandy, the internet gets better, speeds improve. Protocols and methods change. Whatever!
What's not so 'whatever' is that those connections also originate from the internet sometimes. I've traced IP ranges from AWS/Amazon, Microsoft, and other unspecified data entering my network. Without me querying them first.
Hundreds of times per day, my modem (The one I got from my ISP) would let data through it's firewalls, NAT and whatever should block inbound traffic to do god knows what.
I don't visit Microsoft services. There is no Windows computer on my network. Why is Microsoft poking around my network. I do use Github and that's owned by Microsoft. But then that connection should ping back to my laptop, maybe my phone (for the github app). Microsoft has no business approaching any other devices that happen to be on the network. Why does it even know about these devices? And why do they initiate contact and have access to my network?
The same happens with IP addresses coming from AWS. Traffic skates right past the firewall, they probe all kinds of IP addresses on my network and continuously do so. I don't know why. Looking up the IPs shows nothing about who controls that. If it resolves to a domain, those domains won't load. Very weird stuff.
I looked this up, and at first it was suggested that the incoming connections are left over responses from already timed out requests. But my managed switch doesn't make web requests, nor does my WiFi AP. Yet both got hammered with UDP traffic from AWS daily. The same happened with an android phone I have. I barely use it, yet it's constantly talking to unknown servers probing it. Why? For what?
So, pfSense is set to block any inbound UDP:443 traffic. And big tech can fuck right off. You had your fun, but now my network is mine again!