Deshittification as a Service: Reclaiming Privacy and Performance with OpenBSD

This presents a practical blueprint for reclaiming privacy and improving performance on home networks by forcing Smart TVs and other IoT devices to behave at the network layer using an OpenBSD gateway running pf (Packet Filter) and Unbound DNS. The recommended architecture isolates devices into VLANs (examples: WAN, management, trusted, guest), disables IPv6 for untrusted segments, and runs an instrumented DHCP. pf enforces strict east-west isolation and actively intercepts evasive outbound traffic rather than merely dropping it: encrypted bypasses like QUIC and DNS‑over‑TLS are blocked, and hardcoded DNS and NTP queries are rewritten to local services so clients receive valid responses without leaking telemetry. This prevents lateral scans and opaque resolver fallbacks that would otherwise bypass blocklists.

The how includes specific operational choices: redirect external port 53 and 123 traffic to local Unbound and ntpd so responses appear to come from original targets, and configure Unbound to return immediate NXDomain for known telemetry domains (fast failure makes clients discard telemetry). Practical notes cover a WebOS 26 time‑bootstrap trap - factory resets leave the clock at a firmware date that breaks TLS until time is set manually - and advocate interface binding and access controls for Unbound to avoid becoming an open resolver. The expected payoff is tangible: reduced background TLS/NTP chatter frees underpowered device CPUs, reducing stutter and speeding app launches across TVs, phones, and tablets.