101–110 of 211 posts
Tailscale with NextDNS is a simpler alternative to this and is easy to set up on all your devices.
Why is tailscale needed?
Earlier quoted context omitted.
To be fair, if you are geeky enough to run a PiHole you will have no trouble finding the config option to turn off DoH in your browser.
Don't turn it off in your browser. If you have control of that setting just install an ad blocker. The point of DNS block lists is to get rid of ads on phones, TVs, and other non configurable things.
Yes, and...It's not just to block ads. It's also to block various trackers and unwanted/surreptitious "telemetry" and "updates" to those devices you can't control/configure.
Always wanted to do this but if I get a call from home and I am either 1) at work 2) out of town 3) or just not home Then, my family's ability to troubleshoot if PiHole goes down is extremely limited. Even if I had two.
You could also set up 2 ssids depending on your WiFi set up. Point one to pi hole and the other to a different DNS provider. Instruction if pi hole breaks is just switch WiFi.
Earlier quoted context omitted.
> read TFA for the iptables config that fixes those apps and devices that bypass local DNS. For example, Don't worry. All the browsers and stuff are bypassing this level of control by moving to DNS-over-HTTPS. You'll either have to deploy a TLS terminating proxy on your network, or give up on this arms race.
Would certificate pinning also remove the first option? I wonder if we are moving to a system where inspecting your own traffic isn't a viable option anymore, am I missing a workaround?
Always wanted to do this but if I get a call from home and I am either 1) at work 2) out of town 3) or just not home Then, my family's ability to troubleshoot if PiHole goes down is extremely limited. Even if I had two.
I wonder if anyone has made it easy to run the Pi Hole software on regular Unix-like systems without containers and without machine specific binaries. Perhaps I'll have to give that a try some time.
I really don't understand why people go to the trouble of using Pi-hole that only blocks at the DNS level, instead of using uBlock Origin which can block at the DOM level. uBlock Origin is easier and cheaper to set up, less maintenance, and more effective.
* I haven't actually used PiHole itself that much, mostly AdGuard and PfBlocker. Same basic idea, though. The cost for me to run PfBlocker on my router is basically zero, it's pretty much set-and-forget.
Earlier quoted context omitted.
An increasing number of them also rely on hard coded DoH servers which is harder to block/redirect. You will need to will Pi-Hole/Adguard Home on router to block them based on some curtailed lists (i.e [1]) [1] https://github.com/dibdot/DoH-IP-blocklists
In this arms race you are saying a current "move" is a curated list of IPs that correspond to known DoH servers ... and that's fine .. However, if the adversary decides to just query - and answer - DoH requests on the same hostname that you are trying to talk to ... isn't that a winning move ? For instance: If one had an application - or an appliance - that spoke https to endpoint.samsung.com, how would one block DoH…
In our house the only device that tries to use DoH is my partner's iPhone. It tries a few times, fails, then uses the Adguard DNS, which blocks the trackers.