Solved Please teach me how to remove DNS completely and permanently.

[hma]

Hi everyone,

Could somebody teach me how to remove Windows 7 (Home Premium) DNS completely and permanently?

I want to use hosts file instead of DNS to visit less than 5 websites only.

I am not asking how to disable DNS Client Services.

Help will be greatly appreciated.

 

[x BlueRobot]

What do you mean remove DNS?

This may be useful to read -Domain Name System - Wikipedia, the free encyclopedia

 

[Shadowjk]

Aye, x BlueRobot is correct. Removing DNS is like trying to delete the foundations of the internet

If you are obtaining an IP address stack via DHCP then it is almost certain that your DHCP server is handing out a DNS sever for you to use. Please follow this tutorial on the interface used to connect to the internet but rather than entering a severs IP address please leave the box empty.

http://www.sevenforums.com/tutorials/15037-dns-addressing-how-change-windows-7-a.html

To apply to all clients within the network you would need to edit the DHCP scope options. Typically in most home environments this is managed by the router therefore you would need to make the changes there.

   Note

Remember to either reboot the machines or type ipconfig /renew into a command prompt otherwise the clients will still use their old leases.

Also understand that this will not restrict any internet access but rather prevent you from accessing severs using their hostnames. Also you may find issues with websites that use load balancing unless you map all IP addresses because if the one IP address you use goes down then you will not be automatically redirected a working server. An example of Google's multiple servers can be seen below:



Another point to consider is that internet IP addresses can change and do change all the time therefore any previous mappings in your hosts file will be rendered useless.

All in all, I would strongly advise against such task and personally would only use the HOSTS file to map local computers rather than internet addresses. If you wish to restrict internet access then I would setup an Access control list to block or allow only specific websites offering a more redundant option.

Hope This Helps,
Josh

 

[Barman58]

The safest way I can think of achieving this in win7 is by the use of parental controls, create a standard user, apply parental controls, set to use a site white list and add your allowed sites to this list

This just controls access on a user by user basis whilst not risking issues when system processes are blocked from access the net

 

[hma]

Thank you very much for these quick answers.

To clarify my request further more. I want to block my PC from going out using any DNS services on the Internet. I want to use hosts file completely instead of DNS servers. I don't mind keeping updating hosts file regularly. I am not afraid of website load balancing might make me update hosts file more often.I just do not want my PC to use any DNS. Maybe DNS Client Service removed or uninstalled would do the job......, I am guessing.

I want my PC to be unable to connect to any DNS completely and permanently. I want that function disappear forever.

Thank you very much for your help.

 

[diplo]

Could you statically assign your DNS servers to your loopback address (127.0.0.1)? Go to network and sharing center in your control panel, click change adapter settings, right click your network adapter, and change your DNS servers to static under IPv4 and / or IPv6 by clicking on their respective properties. I would start here and then look at blocking DNS with something like Peerblock or by crippling services and / or changing firewall rules. There is a default windows outbound firewall rule allowing DNS (UDP-Out) that you could try disabling. Good luck!

 

[UsernameIssues]

Could you statically assign your DNS servers to your loopback address (127.0.0.1)? .....

@OP,
The method quoted above is the best way to point DNS queries back to the local computer... but apps can still get to web based servers if they know the IP address of interest. You don't want to break the DNS process as doing so will slow stuff down as apps wait for a DNS reply.

Disabling/removing the DNS service will not stop DNS queries from being made. It will just force each app to make their own DNS queries. I keep the DNS service disabled and you should too for this setup.

How will you handle the Windows update process and anti-virus updates?

Let us know how this works out for you.

 

[hma]

Thank you very much for these good suggestions.

Once I finish testing, I will report it here to let everybody know the results.

I do not worry about Windows update and anti-virus updates. This PC will be used to do online banking and stock trading only. No surfing at all. I use at least one or two external commercial firewall(s) (like Palo Alto, Fortinet, Check Point, or Sonicwall) to protect it.

 

[x BlueRobot]

I do not worry about Windows update and anti-virus updates. This PC will be used to do online banking and stock trading only. No surfing at all. I use at least one or two external commercial firewall(s) (like Palo Alto, Fortinet, Check Point, or Sonicwall) to protect it.

That's even more reason to check Windows Updates and anti-virus definitions.

 

[Shadowjk]

I wouldn't rely on your firewall to protect you unless it has some sort of intrusion prevention system. An attack can come in the same port as your web traffic (TCP port 80). Equally if you get infected by any malware whether it be from a thumb drive or the internet then it is likely for it to remotely connect to a host without your knowledge. This could be done using TCP port 80 which is the same port as your HTTP traffic.

Also, it is possible for some malware to spoof the DNS servers and use that therefore to reduce this risk I would strongly recommend placing a deny inbound statement on the inside interface of your firewall to deny any DNS requests (UDP port 53). Please understand that this will not restrict any communications that use IP addresses and if I were to make some sort of application I would set the machine to connect to an IP address rather than a URL since my remote server will most likely not be in the public DNS servers.

   Note

This would apply to all hosts if done on your firewall. If you wish to only do it on a single PC then you would need to edit the personal firewall

Just a caution that you may wish to consider,
Josh

 

[diplo]

I wouldn't rely on your firewall to protect you unless it has some sort of intrusion prevention system. An attack can come in the same port as your web traffic (TCP port 80). Equally if you get infected by any malware whether it be from a thumb drive or the internet then it is likely for it to remotely connect to a host without your knowledge. This could be done using TCP port 80 which is the same port as your HTTP traffic.

Also, it is possible for some malware to spoof the DNS servers and use that therefore to reduce this risk I would strongly recommend placing a deny inbound statement on the inside interface of your firewall to deny any DNS requests (UDP port 53). Please understand that this will not restrict any communications that use IP addresses and if I were to make some sort of application I would set the machine to connect to an IP address rather than a URL since my remote server will most likely not be in the public DNS servers.

   Note

This would apply to all hosts if done on your firewall. If you wish to only do it on a single PC then you would need to edit the personal firewall

Just a caution that you may wish to consider,
Josh

Josh - this guy isn't running a web server, therefore he doesn't have anything open on port 80. web servers accept connections on port 80, the user end uses an ephemeral port. Also he's talking about turning DNS OFF so why talk about malware redirecting his DNS traffic? Furthermore, you're talking about the possibility of malware turning his PC into a rogue DNS server (telling him to deny port 53, as if his NAT box or doesn't have a firewall on)... why hijack this thread to talk about some unlikely malware disaster?

 

[Shadowjk]

I wouldn't rely on your firewall to protect you unless it has some sort of intrusion prevention system. An attack can come in the same port as your web traffic (TCP port 80). Equally if you get infected by any malware whether it be from a thumb drive or the internet then it is likely for it to remotely connect to a host without your knowledge. This could be done using TCP port 80 which is the same port as your HTTP traffic.

Also, it is possible for some malware to spoof the DNS servers and use that therefore to reduce this risk I would strongly recommend placing a deny inbound statement on the inside interface of your firewall to deny any DNS requests (UDP port 53). Please understand that this will not restrict any communications that use IP addresses and if I were to make some sort of application I would set the machine to connect to an IP address rather than a URL since my remote server will most likely not be in the public DNS servers.

   Note

This would apply to all hosts if done on your firewall. If you wish to only do it on a single PC then you would need to edit the personal firewall

Just a caution that you may wish to consider,
Josh

Josh - this guy isn't running a web server, therefore he doesn't have anything open on port 80. web servers accept connections on port 80, the user end uses an ephemeral port. Also he's talking about turning DNS OFF so why talk about malware redirecting his DNS traffic? Furthermore, you're talking about the possibility of malware turning his PC into a rogue DNS server (telling him to deny port 53, as if his NAT box or doesn't have a firewall on)... why hijack this thread to talk about some unlikely malware disaster?

Correct the host will use a source port when initiating a TCP session but the destination port for the segments are on port 80. What I'm trying to say is that some hackers will use that when trying to hijack a connection (Source port of 80 as if it came from a web server using a port sniffer to find an open port) and then if succeeded they will try to send information out on a destination of port 80. All I want to say is that they shouldn't solely rely on their hardware firewall to complete all the security. As to whether or not they are using NAT I do not know.

Yes they wish to turn DNS OFF but that doesn't stop an application from initiating a UDP request out. I am not saying that their machine turns into a DNS server but rather an application will exploit the loopback address setup as the primary DNS server on the NIC so that when it doesn't find the record requested it will use a predefined DNS server within the application and then make the request to wherever rather than the usual drop of packet. Denying UDP port 53 is the closest thing to preventing any DNS requests to the internet as you are going to get.

I just thought to mention the possible threats that could happen since the OP stated that they will not be using any Anti-Virus/malware applications. Chances of this happening are slim but its best to know especially if the OP is going to do important tasks such as banking.

Josh

 

[hma]

Thank you very much for caring about my issue.

Sorry. I didn't report quickly. I was busy working on something else.

My PC used to keep looking for ISP DNS even though I disabled Windows 7 DNS Client Service. After I configured my PC as diplo instructed, my PC quit looking for ISP DNS servers. When I set up DNS to be 127.0.0.1, my PC became quiet. That's very nice.

The above conversation reminds me to set up my commercial firewalls to block all UDP traffic. Period. It is a very good point.

I really appreciate the help that was provided by forum members. Problem was solved.

Best luck to everyone.

 

[Shadowjk]

I am glad you have completed what you wished Please understand that UDP traffic isn't just used for DNS. Other UDP ports are used for any Video streaming, VoIP and other streaming services such as gaming. By blocking all UDP traffic you will find those services will be inaccessible.

Just a pointer,
Josh