Skip to content

Latest commit

 

History

History
572 lines (461 loc) · 35.8 KB

README.en.md

File metadata and controls

572 lines (461 loc) · 35.8 KB
Raw
Bahasa / Languages:

Indonesia English

BEBASID LOGO BEBASID LOGO

"Refuse to be blocked, Agree to blocking.

Because Kominfo blocking, let's unblock!"

DISCLAIMER:
Kominfudge is not responsible for any damages caused to your device, do with your own risk.


Community Server:

Discord
Join BEBASID Discord Join BEBASID Telegram Group
Join WhatsApp
Join BEBASID WhatsApp Group


Donate Us:

BebasID Trakteer Donation BebasID Saweria Donation
BebasID Trakteer Donation BebasID Saweria Donation

Navigation

This project would not exist without your contributions.
Oh, if you want to contribute, take a look at this first.

Top Choices🔝

DNS: 1.1.1.1
Most intuitive DNS resolver and easy to use.

DPI: PowerTunnel
Intuitive and Open Source.

Filehost: bebasid
Host file with a lot of content.

VPN: ProtonVPN
Free and secure.

Choosing less-STRICT ISP🔝

ISP is your Internet provider, this list will helps you understand more about how Indonesian ISPs blocking.

IP Transit

To determine what Transit IP that your ISP is using, you can check on https://bgp.tools or https://bgp.he.net

ISP that using these upstreams will not be able to change DNS in usual way due to port 53 redirection to each Transit IP provider DNS resolvers following the National DNS that unveiled during IDNOG 2022.

ASN Name Blocking using DNS Note Example of affected ISP
- - - - -

If your ISP does not comply with National DNS regulation but uses Transit IP as shown above, you will experience the same blocking and must use encrypted DNS.
Or you can use DNS that is not routed towards those Transit IPs if available.

This IP transit redirects several popular DNS resolvers so you must use less popular DNS resolvers.

ASN Name Blocking using DNS Blocked DNS Note Example of affected ISP
AS4800 PT Aplikanusa Lintasarta Yes All DNS that routed towards Lintasarta Transit IP AS4800 Proof of Redirection Trisula, Netciti
AS55685 PT Jala Lintas Media Yes Cloudflare 1.1.1.1, Google, OpenDNS Proof of Redirection PT Hyperindo Media Perkasa
AS23947 PT Mora Telematika Indonesia Yes Quad9 Redirecting Quad9 at Transit IP level as can be seen at traceroute result. PT Queen Network Indonesia

If your ISP does not comply with National DNS regulation but uses Transit IP as shown above, you will experience the same blocking and must use encrypted DNS.
Or you can use DNS that is not routed towards those Transit IPs if available.

For ISPs that using these upstream providers, you must use WARP/VPN, GoodbyeDPI, or GreenTunnel/PowerTunnel.

ASN Name Blocking using DPI Note Example of affected ISP
AS7713 PT Telkom Indonesia Yes State-owned, so auto-comply Several Universities and local ISP that use upstream AS7713
AS4787 PT Cyberindo Aditama (CBN) Yes
AS9341 / AS38757 PT. Indonesia Comnet Plus (ICONNET) Yes
AS45735 PT. UNINET MEDIA SAKTI Yes Traceroute Proof
AS55655 PT Saranainsan Mudaselaras (SIMS/MVNET) Yes
AS55685 PT Jala Lintas Media Yes PC24, Hyperindo Media Perkasa
AS23947 / AS131111 PT Mora Telematika Indonesia Yes Traceroute to Moratel PT Queen Network Indonesia
AS17995 PT iForte Solusi Infotek Ya Traceroute Proof Transjakarta Wi-Fi is affected, beware.

If your ISP does not use DPI but using those upstreams, you can use an anti DPI tool to bypass

Internet Exchange using DPI middlebox:

Name Using DPI Example of affected CDN Note
- - - -

Fiber ISP

Note

Almost all ISPs violate freedom of internet access by implementing the National DNS programme and because of it, users cannot change to other resolvers other than ISP ones. Especially for users who want to use other DNS blocking services such as OpenDNS and NextDNS and because of it, making it not suitable for users who want to implement filter other than TrustPositif which is well-known for its strange blocking policy.
But, National DNS implementation varied across ISPs. Some are only redirecting or blocking UDP 53 (Such as FirstMedia), some are into international connection, and there are some redirecting or blocking TCP 53 (Examples: MyRepublic dan Smartfren).

For ISPs that already checked and confirmed as implementing the National DNS, we have added legend on how ISPs implementing National DNS:

International = Blocking port 53 towards international connection
Local = Blocking port 53 towards local connection (across Indonesia) within OpenIXP, IIX, CXC, JKT-IX, etc
TCP = Blocking TCP port 53, making Zone Transfer impossible for those using providers with this designation

Residential ISP

Name Blocking using DNS Blocking using DPI Sending TCP RST to server Note
Indihome Yes (International, Local) & IPv6 DNS Injection (Out) Yes Yes Telkom's residential offering. Indihome DPI also sending TCP RST to server
CBN Yes (Google, OpenDNS, Cloudflare, Quad9) (Including TCP for those servers) Yes No
Biznet Home Yes (International, Local) Yes Yes Biznet DPI also sending TCP RST to server
MyRepublic Yes (International, Local) Yes No MyRepublic DPI only blocking 18+ sites
FirstMedia Yes (International, Local) Yes No
Megavision Yes (International, Local) No ? Other name: StarNET
MNC Yes Yes/No (Depends on routing) ? Affected by DPI from iForte upstream
Iconnet PLN Yes Yes Yes Iconnet DPI also sending TCP RST to server. Two-way DPI blocking. Several DNS such as Google, Cisco, Cloudflare are redirected to ICON DNS and others are blocked
PT Netciti Persada Yes No ? Blocking DoH, just wow...
Oxygen Yes (International) Yes No Other name: Moratelindo
Blocking Google DoH andn DoT
Blocking alt-port DNS 5353
Citranet Yes Yes/No (Depends on routing) ? DPI from Citranet upstream. If routed towards Indosat and some of their upstreams, it will be affected
Padi Net Yes (International, Local) No ?
Fiberstream Yes (International, Local) No ? Residential ISP of G-MEDIA
Balifiber Yes No ?
PT Media Cepat Indonesia Yes (International, Local) No ?
Melsa Yes (International, Local) No ? Google DNS should be safe
Circle One Yes No ?
WINET (PT Wahyu Aditama Network) Yes (International, Local) Depends on routing ? Affected by DPI from BIX
MyNet Yes Depends on routing ? Affected by DPI from BIX
Bnetfit Yes Yes No Owned by PT Jala Lintas Media
Marvatel Yes No No
NusaNet Yes (Google. Quad9, OpenDNS, Cloudflare) Yes/No (Depends on routing) Affected by DPI from Indosat upstream
XL Home Yes (International) Yes Probably No (?) XL Home blocking overseas DNS, local DNS should be safe
PT Wifiku Indonesia Yes Yes (Affected by PT Saranainsan Mudaselaras) - Affected by DPI from SIMS
VIBERLINK Yes No
Tri Data Raya Internet Yes No
Rama Wima Nusantara Yes (International, Local) No No
PT Starlink Indonesia (Starlink) Yes No No Starlink Indonesia

Corporate ISP

Name Blocking using DNS Blocking using DPI Sending TCP RST to server Note
Astinet Yes (DNS Injection for International DNS via Transparent Proxy) Yes ? Telkom's corporate offering. Overseas DNS is redirected first to Telkom proxy within TELIN so ACL whitelist for overseas DNS will not work because during query, the query will be read as IP address of Telkom proxy not own IP address. This is very disruptive for corporate users that have overseas server or using custom filtering server such as NextDNS, ControlD, OpenDNS, etc
Linknet Yes No No FirstMedia's corporate offering
Lintasarta Yes (International, Local) No No Implementing National DNS
Biznet Metronet Yes (International) Yes Yes aka Biznet Dedicated
PT Metrasat Yes Yes ?
PT Pasifik Satelit Nusantara Yes No ?
PT Artha Telekomindo Yes No ?
PT Hawk Teknologi Solusi Yes No ?
PT Jaringanku Sarana Nusantara Yes (Out, Local) No ? Other name: JSN
PT. Infotama Lintas Global Yes (Out, Local) No ?
PT Remala Abadi Yes No No Other name: Tachyon
PT iForte Global internet Yes Yes No
PT Cipta Informatika Cemeriang Yes No ?
PT Lexa Net Yes No ? Other name: PT Lexa Global Akses
PT Media Sarana Data Yes (Out, Local) No ? Other name: G-MEDIA
PT Artorius Telemetri Sentosa Yes No ?
D-NET Yes (Google, OpenDNS, Cloudflare, Quad9) (Including TCP for those servers) No ? Other name: PT Core Mediatech
Only redirecting Google, Cloudflare, and Quad9 DNS
PT Sumber Koneksi Indotelematika Yes No ?
ProNET Yes Yes/No (Depends on routing) Yes Other name: PT Trisari Data Indonesia
Several Public DNS resolvers like Cloudflare, Alibaba DNS, and several Indonesian DNS resolvers are blocked.
PT Media Jaringan Telekomunikasi Yes No ?
PT Sekawan Global Komunika Yes No ?
PT INFORMASI NUSANTARA TEKNOLOGI Yes No ?
Orion Cyber Internet Yes No ? Popular DNS resolvers like Cloudflare, Google, Quad9, Level3, etc are redirected to ISP server
PT AGTI Yes (Out, Local) No ? Other name: PT. Arjuna Global Teknologi Indonesia
PT Parsaoran Global Datatrans Yes No - Other name: HSP NET
PT Fiber Networks Indonesia Yes (Out, Local) No ? Other name: FIBERNET
PT Power Telecom Indonesia Yes Yes ? DPI does not blocking Vimeo
PT Solnet Indonesia Yes No ?
PT Data Utama Dinamika Yes Yes Yes Affected by Lintasarta
PT BIT TEKNOLOGI NUSANTARA Yes Yes ? Affected by iForte
PT Hyperindo Media Perkasa Yes Yes ? Affected by PT Jala Lintas Media
PT Hipernet Indodata Yes (Cloudflare, Google, Quad9, OpenDNS, Level3, along with the TCP 53) No
PT PC24 Telekomunikasi Indonesia Yes Yes Yes, Telkom DPI is strong Probably affected by Telkom and JLM. Blocking traceroute
PT Widya Intersat Nusantara (IP One) Yes (International, Local) No

Mobile ISP

Name Blocking using DNS Blocking using DPI Sending TCP RST to server Note
Telkomsel / By.U / KartuHalo Yes (International, Local, TCP) Yes Yes Telkomsel DPI also sending TCP RST to server
XL / Axis / Live On Yes (International, Local, TCP) Yes Yes XL DPI also sending TCP RST to server
3 Yes (Google, OpenDNS) Yes Yes Three hijacks Google and OpenDNS servers and redirect them to its resolver
Indosat Yes (Google, OpenDNS) Yes No, but throttling connection to blocked sites if Host/SNI header is detected Starting on 4-5 October 2023, Indosat hijacks Google and OpenDNS servers and redirect them to its resolver
Smartfren Yes (International, Local, TCP) Yes No Blocking Google DoH/DoT

Effort level to unblock with DPI

How much effort needed to unblock with DPI per-ISP

Name Effort Bypass MikroTik & IPTables
Telkomsel / By.U / Kartu Halo High Not Possible
Indihome High Not Possible
XL / Axis / Live On High Not Possible
Iconnet High Not Possible
Indosat Medium Not Possible (IM3) & Possible (Hi-Fi, Transit IP)
FirstMedia Medium Not Possible (HTTP) & Possible (HTTPS)
PT Jala Lintas Media Medium Possible
PT Mora Telematika Indonesia Medium Possible
CBN Medium Possible
Smartfren Medium Possible
3 Low Possible
PT UNINET MEDIA SAKTI Low Possible
PT SaranaInsan Mudaselaras (SIMS) Low Possible
iForte Low Possible

THIS DATA IS NOT COMPLETE, IF YOU WANT TO ADD MORE, PLEASE GIVE FURTHER INFORMATION

Take this with a grain of salt, all ISPs will change their blocking method without notice.

Choosing the right DNS🔝

DNS, a simple way for kominfo to block, but DNS can be changed!. This is a list of DNS resolvers that can be used instead of blocking resolvers of Kominfo.

Name Note IPv4 IPv4 2 Alternative Port IPv6 IPv6 2 DoH DoT
BebasDNS Bebasid's own DNS resolver, blocking ad, malware, and also there is family variant 103.87.68.194 35.219.67.150 53 & 1753 2a06:9f44:f3e0:beba:51d::53 2600:1901:8170:268:: https://dns.bebasid.com/dns-query tls://dns.bebasid.com
Cloudflare DNS - 1.1.1.1 1.0.0.1 - 2606:4700:4700::1111 2606:4700:4700::1001 cloudflare-dns.com/dns-query 1dot1dot1dot1.cloudflare-dns.com
Cloudflare Secure DNS Blocking malware 1.1.1.2 1.0.0.2 - 2606:4700:4700::1112 2606:4700:4700::1002 security.cloudflare-dns.com/dns-query security.cloudflare-dns.com
Cloudflare Family DNS Blocking malware & adult sites 1.1.1.3 1.0.0.3 - 2606:4700:4700::1113 2606:4700:4700::1003 family.cloudflare-dns.com/dns-query family.cloudflare-dns.com
Google DNS - 8.8.8.8 8.8.4.4 - 2001:4860:4860::8888 2001:4860:4860::8844 dns.google/dns-query dns.google
OpenDNS - 208.67.222.222 208.67.220.220 5353, 443 2620:119:35::35 2620:119:53::53 doh.opendns.com/dns-query -
OpenDNS Familyshield Blocking adult sites 208.67.222.123 208.67.220.123 5353, 443 - - doh.familyshield.opendns.com/dns-query -
Quad9 Secured Blocking malware 9.9.9.9 149.112.112.112 9953 2620:fe::fe 2620:fe::9 dns.quad9.net/dns-query tls://dns.quad9.net
Quad9 Secured with ECS Blocking malware, supporting ECS 9.9.9.11 149.112.112.11 9953 2620:fe::11 2620:fe::fe::11 dns11.quad9.net/dns-query tls://dns11.quad9.net
Quad9 Unsecured Alternative DNS resolvers from Quad9 that does not block malware 9.9.9.10 149.112.112.10 9953 2620:fe::10 2620:fe::fe:10 dns10.quad9.net/dns-query tls://dns10.quad9.net
Quad9 Unsecured ECS Alternative DNS resolvers from Quad9 that does not block malware, supporting ECS 9.9.9.12 149.112.112.12 9953 2620:fe::12 2620:fe::fe:12 dns12.quad9.net/dns-query tls://dns12.quad9.net
AhaDNS - ? ? ? ? ? blitz.ahadns.com ?
BlahDNS - 45.91.92.121 X - 2a0e:dc0:6:23::2 X doh-ch.blahdns.com/dns-query dot-ch.blahdns.com
RethinkDNS - ? ? - ? ? basic.rethinkdns.com max.rethinkdns.com
NextDNS - 45.90.28.233 45.90.30.233 5353 2a07:a8c0:: 2a07:a8c0:: dns.nextdns.io dns.nextdns.io
LibreDNS - 116.202.176.26 X - X X doh.libredns.gr/dns-query dot.libredns.gr
ControlD - 76.76.2.2 76.76.10.2 - 2606:1a40::2 2606:1a40:1::2 freedns.controld.com/p1 p1.freedns.controld.com
AdGuard DNS Blocking ad and malware 94.140.14.14 94.140.15.15 5353 2a10:50c0::ad1:ff 2a10:50c0::ad2:ff https://dns.adguard-dns.com/dns-query dns.adguard-dns.com
DNS.SB - 185.222.222.222 45.11.45.11 53 2a09:: 2a11:: https://45.11.45.11/dns-query tls://dot.sb:853
DNSWarden - ? ? ? ? ? ? ?

More comprehensive list can be seen at Adguard KB and Curl wiki. You can create your own DNS over HTTPS with Cloudflare Workers or with PHP.

DNS Applications🔝

These DNS applications can help you in configuring DNS resolvers on your system.

⚠ ATTENTION ⚠
If your ISP is also blocking using DPI also use applications to eliminate DPI.

  1. Nebulo [Android]
    Application to easily change DNS on Android.

  2. DNSCloak [iOS]
    Application to change DNS and configure dnscrypt on iOS.

  3. DNSCrypt [Windows,macOS,Linux]
    Selfhost DNS that can do forwarding to DNSCrypt & DNS over HTTPS servers.

  4. SimpleDNSCrypt [Windows]
    An easy to use graphical DNSCrypt client.

  5. DNS Profile Creator [Browser]
    Easily create Apple mobileconfig.

  6. YogaDNS [Windows]
    DNS changer for Windows.

  7. RethinkDNS [Android]
    Application to change DNS and ad blocker.

  8. Intra [Android]
    Application to change DNS on Android.

  9. AdGuard Home [Windows, macOS, Linux]
    Selfhost DNS with integrated adblock, encrypted upstream and downstream.

  10. Stubby [Windows, macOS, Linux]
    Selfhost DNS that can do forwarding to DNS over TLS server.

  11. InviZible [Android]
    An Android application for DNS and Tor.

How to change DNS🔝

Now, you have got the List, so how to use it?

Android

1.Settings>Other Wireless Connections>Private DNS . 2.Type the DNS hostname and tap Save.

iOS

1.Settings>Wi-Fi>wifi
2.Tap (i) icon.
3.Change the IP Address into Static and type the DNS hostname on the DNS column.

Windows

Windows 7 to Windows 10:

  1. Control Panel>Network and Internet>Network and Sharing Center>Connections>Properties.
  2. Click Internet Protocol Version 4 (TCP/IPv4) twice.
  3. Change from "Obtain DNS server address automatically" to "Use the following DNS server addresses".
  4. Type the DNS hostname on the DNS column and click OK.

Windows 11:

  1. Open Settings on Windows 11, Go to Network & Internet and click Properties.
  2. On the DNS server assignment section, click Edit button.
  3. Change from Automatic to Manual.
  4. On Preferred DNS, type 1.1.1.1/8.8.8.8/9.9.9.9 and on Alternate type 1.0.0.1/8.8.4.4/149.112.112.112.
  5. On Preferred and Alternate DNS Encryption, choose Encrypted only (DNS-over-HTTPS) option.
  6. Click Save.

macOS

  1. System Preferences>Network>Wi-Fi>Advanced>DNS.
  2. Click “+” button and type the DNS hostname on the DNS column,
  3. Then click OK and Apply.

Linux

  1. Open Terminal
  2. Type the command nano /etc/resolv.conf to edit /etc/resolv.conf.
  3. Change the file content into something like this (replace <dns hostname> into one of the DNS hostname listed here).
nameserver <dns hostname>
nameserver <dns hostname>

Note: Some components that installed on Linux distribution (like NetworkManager) may change the content of /etc/resolv.conf without notice, to prevent this you can type chattr +i /etc/resolv.conf after editing the file. If you want to change the content of /etc/resolv.conf again, you can type chattr -i /etc/resolv.conf.

Browser

Chromium-based browser

1.Settings>Privacy and Security.
2.Type the DNS hostname on the DNS column.

Firefox-based browser

1.Settings>Network Settings.
2.Type the DNS hostname on the DNS column.

How to determine if the DNS is properly configured?

Go to DNSLeakTest or BrowserLeaks for testing. If the ISP DNS being shown instead of one you have already set, you can download DNSCrypt or SimpleDNSCrypt.

Applications to eliminate DPI🔝

Now, many ISPs are using Deep Packet Inspection as blocking method.

You can eliminate the DPI with these applications:

⚠ ATTENTION ⚠
Do not forget to change DNS first or using Hosts file if your ISP is also using DNS for blocking.

ℹ️ Info
We also providing config for application and ISP in this folder.

  1. GoodbyeDPI [Windows]
    CLI application to eliminate DPI.

  2. GreenTunnel [Windows,macOS,Linux]
    GUI application to eliminate DPI.

  3. PowerTunnel [Windows,macOS,Linux,Android]
    GUI application to eliminate DPI (2).

  4. SNI-Mask [Windows]
    Proxy to eliminate DPI.

  5. Accesser [Windows,macOS,Linux]
    Application to solve TCP RST, used primarily in Mainland China.

  6. GhosTCP [Windows]
    Securing TCP connection.

  7. sniffjoke [Linux]
    Securing wiretap/sniff/IDS.

  8. SpoofDPI [macOS,Linux]
    Spoofing your DPI.

  9. Zapret [Linux, FreeBSD]
    DPI Circumvention Tool.

  10. DPITunnel [Linux,Android]
    CLI application for Linux.

  11. Geneva [Linux]
    AI-powered DPI Circumvention Tool.

Trick to bypass DPI without application🔝

On Linux

Drop TCP RST and lamanlabuh with IPTables, run these commands:

sudo iptables -I INPUT -p tcp --tcp-flags ALL RST,ACK -j DROP 
sudo iptables -A INPUT -p tcp -m string --string "Location: http://lamanlabuh.aduankonten.id/" --algo bm -j DROP

For firewall-cmd, run this command:

sudo firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -p tcp --tcp-flags ALL RST,ACK -j DROP

Use the firewall-cmd one for Linux distribution that using firewalld, like Fedora and OpenSUSE in terminal. Note that those commands will not work if ISP is also sending TCP RST to server (List of ISP can be seen in Sending TCP RST to server column on above table).

Trick to bypass DPI using router🔝

OpenWRT

Follow this tutorial https://github.com/bebasid/bebasit/blob/master/docs/openwrt-tutorial.en.md

MikroTik

Follow this tutorial https://github.com/bebasid/bebasit/blob/master/docs/mikrotik-tutorial.en.md

List of hosts file🔝

For some users, they will prefer this way If you prefer to use hosts file, here the list:

List Alternative
bebasid
mul14
tumblr
Netflix 2
nhentai
Binance
Reddit
Steam 2

How to unblock using hosts file🔝

So, you have the file... now what?

On Windows

  1. Copy the text inside the hosts file that you have chosen before.
  2. Open File Explorer and go to C:\Windows\System32\drivers\etc.
  3. Paste text to "hosts" file.

On Android

ROOT:

  1. Copy the text inside the hosts file that you have chosen before.
  2. Open File Explorer and go to /system/etc.
  3. Paste text to "hosts" file.

NON-ROOT:

  1. Copy the text inside the hosts file that you have chosen before.
  2. Create the file and paste the text inside that file.
  3. Install Virtual Hosts or Host Go.
  4. Tap "Select Host File"/"Import HOSTS file" and choose the file that you have created before.

Choosing secure VPN🔝

Ah VPN, the easiest way to bypass the block if any of above methods do not work, But do not download insecure and untrustworthy VPN! Take a look at this list of secure VPN that you can use instead of untrustworthy VPN:

Name Positive Negative Server
Mullvad A secure paid VPN Paid 867
ProtonVPN A "secure" "free" VPN Lack of Split-tunneling on free plan and this 100
Windscribe Split-tunneling and many features 15GB per month and this 15
ExpressVPN Fast Not that secure and paid 148
Psiphon Open Source ? ?
OVPN Secure Paid 102

VPN for Advanced Users🔝

VPN in this section needs configuration, if you just want a Out of the box VPN, please ignore this.

Name Description
OpenVPN VPN system that implements techniques to create secure point-to-point or site-to-site connections
Wireguard Similar to OpenVPN
Softether Similar to OpenVPN(?)

Tor Applications🔝

And, this is the most extreme part, using Tor.

  1. Tor Browser [Windows,macOS,Linux,Android]
    Official browser of Tor Project.

  2. Orbot [Android]
    Proxy with Tor.

  3. Onion Browser [iOS]
    Tor browser for iOS.

  4. InviZible [Android]
    Android application for DNS and Tor.

Share this project!

☕ Buy us coffee!

BebasID Trakteer Donation BebasID Saweria Donation
BebasID Trakteer Donation BebasID Saweria Donation

KominFudge from bebasid is licensed under CC-BY-SA-4.0.