Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pi-hole 5.0

pi-hole.net

Post reply on HN
Print view View original

211–220 of 254 posts

Re: Pi-hole 5.0

#211

Post by paddez »

patrickdavey wrote: post #201
fulafel wrote: post #133

Earlier quoted context omitted.

Finding a years abandoned Linux server on your home network m ight be a good leasson to always treat your home network as if it was compromised.

Honestly curious: how would you exploit it? If the pi isn't exposed to the www by your router, what can you do?

The PiHole interacts with DNS servers. Theoretically - imagine a crafted TXT Record which is somehow improperly handled by dnsmasq.

Essentially - it's reading user-defined data - which is probably enough to be really bad, incase of a malicious exploit in the wild.

Re: Pi-hole 5.0

#212

Post by aembleton »

lonelappde wrote: post #100

I set up pihole on docker on Windows and it worked great until I rebooted and then the pihoke server (both ports 53 and 80) was unreachable from outside docker even though docker claimed to be forwarding the ports. So I switched to AdGuard DNS on my devices.

Had the container started up?

Re: Pi-hole 5.0

#213

Post by leonroy »

willyyr wrote: post #165
Doxin wrote: post #152

Earlier quoted context omitted.

Setting up automatic updates is probably a good idea.

Can you recommend a good way to make sure the Pi and Pi-hole are always up to date? I imagine a simple cron with pihole -up is not sufficient?

I run this on a cron to auto update PiHole:

    #!/bin/sh

    LOG_FILE=/var/log/update_pihole.log

    echo "Starting upate" >> $LOG_FILE
    date >> $LOG_FILE
    pihole -up >> $LOG_FILE
    pihole -g >> $LOG_FILE

    exit 0

Re: Pi-hole 5.0

#214

Post by diroussel »

patrickdavey wrote: post #201
fulafel wrote: post #133

Earlier quoted context omitted.

Finding a years abandoned Linux server on your home network m ight be a good leasson to always treat your home network as if it was compromised.

Honestly curious: how would you exploit it? If the pi isn't exposed to the www by your router, what can you do?

Typically a pi-hole is used as a DNS resolver. In order to work it must connect to the internet.

Scenario for attack: Laptop looks up a website, DNS request is made to pi-hole, pi-hole sends request to internet. Response packet received back is actually from an attacker, that uses a known vulnerability in the handling of the packet to take over the machine.

Attacker can now see what DNS requests are being made, and by returning custom responses, it can MITM any HTTP request you make from your laptop. Let's hope everything is encripted via TLS, and hope that some piece of software that just asked for admin permission didn't just install a new TLS trust root.

Re: Pi-hole 5.0

#215

Post by aembleton »

yjftsjthsd-h wrote: post #89
c0nsumer wrote: post #37

Earlier quoted context omitted.

I do this too. After throwing around a bunch of other ideas, I realized that a Pi is cheap enough and the one-shot cost is nice. If it dies, I just update the MAC address for its DHCP reservation to the new pi, spend 10 minutes setting up a new instance, and that's that. It just ends up working.

The dream is to network boot the thing, so you literally plug a new pi in to network+power and it automatically boots and starts running stuff:) (Well, a Pi also needs a 1-time step to enable network boot, but still)

Can't you just move the microSD card over so all the configuration is in place and you just need to power it?

Re: Pi-hole 5.0

#216

Post by encom »

StreamBright wrote: post #190
encom wrote: post #168

Earlier quoted context omitted.

I've made this exact argument before, but it was unpopular. I maintain that if your software distrubution model is writing ISO files to SD cards, it's about as retarded as piping `curl` into `bash`. I too run a Gentoo server at home (fist bump), and I'm running `dnsmasq` for filtering and caching, and `stubby` for DNS-over-TLS, and I run this beauty of a cron job every morning: curl -s --compressed -o /var/lib/dnsmas…

The result of this looks a bit mixed up. Are you sure that sedding 0.0.0.0 works? There are some spammers who include 0.0.0.0 in the domain name for example. I used positional splitting with awk to do the same. That worked very well.

The `sed` turns this

    address=/example.com/0.0.0.0
into

    address=/example.com/
...which makes dnsmasq return NXDOMAIN instead of 0.0.0.0. I think that's more correct.

Re: Pi-hole 5.0

#217

Post by MattSteelblade »

yjftsjthsd-h wrote: post #84
ciarannolan wrote: post #61

Earlier quoted context omitted.

>What adblocking software do now, is they do a dns lookup for every domain, and consider all domains in the result as the same. So if either of previous domains are in the block list, both domains are considered blocked. So this means that the ad blocker will query "definitely-not-an-ad-subdomain.dastx.me" and realize that it actually points to "terribleads.adgiant.com", right?

> So this means that the ad blocker will query "definitely-not-an-ad-subdomain.dastx.me" and realize that it actually points to "terribleads.adgiant.com", right? Yeah, uBlock Origin recently added a new permission request just to allow that.

From my understanding, it only works in Firefox and not Chrome though as an FYI.

Re: Pi-hole 5.0

#218

Post by Havoc »

neurostimulant wrote: post #69
iou wrote: post #28

Alternatively for MAX_lazyness and convenience I've been using https://nextdns.io , does all the same stuff and is the alternative to cloudflare in Firefox for DNS-over-Https (DOH)

Too bad in my country all ISPs are required by the government to intercept (or block) all dns requests except their own dns server to block any domain listed in the national domain blocklist database. DNS on port other than 53 is still working though, so I have set up my pihole to use an upstream dns server that accept connection on a higher port and a cloudflare DoH server as a fallback (not sure why but DoH is real…

Presumably you can just VPN through to a VPS with pihole on it?

Re: Pi-hole 5.0

#219

Post by ekko911 »

aembleton wrote: post #203
bni wrote: post #194

Does it support blocking YouTube ads yet? I mean the short video ads that interrupt the videos

No they come from the same domain as the video that you are trying to watch. If you want to block YouTube ads, then use uBlockOrigin.

I though they had multiple domains instead for most ads? As seen here (however this is 4 years ago) - https://discourse.pi-hole.net/t/how-do-i-block-ads-on-youtub...

If this is still true, this pi hole update might solve those ads at least?

Re: Pi-hole 5.0

#220

Post by move-on-by »

Tepix wrote: post #187

Looks good! Is anyone else getting this during the update? [i] Target: https://hosts-file.net/ad_servers.txt [] Status: Connection Refused [] List download failed: no cached list available Looking at the query log, I see a fairly large amount of requests 24/7 by my Xiaomi robot vacuum and my Xiaomi desk LED Desk Lamp. I've blocked both of them. Is there any way of disabling the wifi on the desk light completely? Righ…

That hosts server was shut down. They don’t maintain a blocklist anymore and removed it from the internet.
Post reply on HN