Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pi-hole 5.0

pi-hole.net

Post reply on HN
Print view View original

61–70 of 254 posts

Re: Pi-hole 5.0

#61

Post by ciarannolan »

dastx wrote: post #42
ciarannolan wrote: post #31

Earlier quoted context omitted.

>I’m especially excited to see CNAME inspection. I was tired of trying to figure out what domains like “xuenl4v1szy8g.cloudfront.net” were doing. Is there a good explainer for CNAME inspection? I'm not finding anything good with my Google Fu.

Some ad agencies starting asking hosters to add a CNAME record to one of their domains. Let's say I have your own blog running on dastx.me, and I wanted some ads from adgiant.com. As an adblocker you've added `* .adgiant.com` to your blacklist and I'm an asshole and try to circumvent such adblocking measure. Them young millennials and their tech. Stealing me out of my money! So I go to adgiant.com and ask them if the…

>What adblocking software do now, is they do a dns lookup for every domain, and consider all domains in the result as the same. So if either of previous domains are in the block list, both domains are considered blocked.

So this means that the ad blocker will query "definitely-not-an-ad-subdomain.dastx.me" and realize that it actually points to "terribleads.adgiant.com", right?

Re: Pi-hole 5.0

#63

Post by sciurus »

xwdv wrote: post #55
dastx wrote: post #42

Earlier quoted context omitted.

Some ad agencies starting asking hosters to add a CNAME record to one of their domains. Let's say I have your own blog running on dastx.me, and I wanted some ads from adgiant.com. As an adblocker you've added `* .adgiant.com` to your blacklist and I'm an asshole and try to circumvent such adblocking measure. Them young millennials and their tech. Stealing me out of my money! So I go to adgiant.com and ask them if the…

> This CNAME method is also a huge security issue, but I'm not gonna go into that. I will. The CNAME method could potentially allow a malicious actor to harvest user cookies, gain access to their accounts, and utterly destroy them.

This. At my previous job we had to serve content from Salesforce and Marketo from subdomains of our main domain. Rather than use CNAMEs direct to those companies, we proxied the requests so we could strip cookies etc.

Re: Pi-hole 5.0

#64

Post by arthurfm »

xref wrote: post #27

Is there a way to quickly disable/re-enable pihole for the network? With AdGuard DNS or uBlock Origin I still get into situations where occasionally they break a site completely and I have to temporarily disable the plugin (or switch to cell tower dns) to get the site working, so I’d want a quick way out of pi-holing traffic as well

> Is there a way to quickly disable/re-enable pihole for the network?

Bookmark the following URL

  http://pi.hole/admin/api.php?disable=120&auth=PWHASH
Replace PWHASH with the value of your WEBPASSWORD in setupVars.conf

  cat /etc/pihole/setupVars.conf | grep 'WEBPASSWORD=' | cut -c13-
and '120' with the number of seconds you want to disable the Pi-hole filtering for.

Re: Pi-hole 5.0

#65

Post by wnevets »

nirav72 wrote: post #47
xref wrote: post #27

Is there a way to quickly disable/re-enable pihole for the network? With AdGuard DNS or uBlock Origin I still get into situations where occasionally they break a site completely and I have to temporarily disable the plugin (or switch to cell tower dns) to get the site working, so I’d want a quick way out of pi-holing traffic as well

there is a chrome extension that quickly let's you disable pihole blocking with 1-click. default is 10 minutes. But you can set a custom time in the toolbar popup.

>there is a chrome extension

oh, good to know! This concerned has stopped me from going out of way to setup pihole

Re: Pi-hole 5.0

#66

Post by senectus1 »

haha, just got around to setting up my pi-hole again this weekend... I was wondering why it didn't install 5.0

Just jumped onto it and kicked off a "pihole -up" and off it goes upgrading beautifully.

pihole is a massively underrated project.

Re: Pi-hole 5.0

#68

Post by surround »

jftuga wrote: post #39

Pi-hole on Apple Watch - just ran up a quick proof of concept. Would there be any use/interest in this? https://www.reddit.com/r/pihole/comments/gathus/pihole_on_ap...

That’s pretty neat! Do you plan on open sourcing it? I’m hesitant to trust an application with my pi-hole api token (and with it, all of my browsing/network data).

Re: Pi-hole 5.0

#69

Post by neurostimulant »

iou wrote: post #28

Alternatively for MAX_lazyness and convenience I've been using https://nextdns.io , does all the same stuff and is the alternative to cloudflare in Firefox for DNS-over-Https (DOH)

Too bad in my country all ISPs are required by the government to intercept (or block) all dns requests except their own dns server to block any domain listed in the national domain blocklist database. DNS on port other than 53 is still working though, so I have set up my pihole to use an upstream dns server that accept connection on a higher port and a cloudflare DoH server as a fallback (not sure why but DoH is really slow here).

Re: Pi-hole 5.0

#70

Post by surround »

disiplus wrote: post #4

does anybody know how to properly secure the the DNS server from replay attacks with iptables. i have a pihone running on a cheap vps on internet, but i connect to it with a vpn and that's draining my smartphone battery. i want to be able to change only the dns settings and point to my pi-hole. but at that time the recommendation was to not run the dns part on the internet because it could be used for dns replay atta…

The official documentation includes a tutorial on how to use pi-hole with OpenVPN. This section describes how to use the VPN for only DNS requests:

https://docs.pi-hole.net/guides/vpn/only-dns-via-vpn/

A Wireguard setup would probably be even less resource intensive if you know how to set it up (there’s no official tutorial for Wireguard).

Do not open your pi to the internet, I doubt the iptables rules would be sufficient to protect it.

Post reply on HN