Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pi-hole v6

pi-hole.net

Post reply on HN
Print view View original

111–120 of 316 posts

Re: Pi-hole v6

#111

Post by JB_Dev »

progbits wrote: post #49
BHSPitMonkey wrote: post #44

Earlier quoted context omitted.

Is a DNS blackhole the right way to restrict your TV from doing bad things? The software running on the device might not even use DNS lookups to connect to hosts as it pleases. Your router is probably the better place to add guardrails.

I recommend putting all these things on their own VLANs with strict routing rules. For example my STB is on a VLAN that has WAN access (otherwise it won't do anything), but that makes it untrustworthy so it is completely isolated from rest of LAN. On the other hand some "smart"/IoT devices are on a VLAN that has no WAN access so that they can't phone home, become a botnet, or download firmware updates that remove fun…

Call me pessimistic, but as the sidewalk pattern becomes more common for IoT, I wouldn’t be surprised if a “malfunctioning radio” just results in the device not working properly.

Re: Pi-hole v6

#112

Post by dark-star »

_chris_ wrote: post #97
wkyleg wrote: post #91

In my experience Pi hole is a very worthwhile investment. People who used my internet when I had one would remark how much faster it was. Everything in general seems faster, even things that you wouldn't think of. I typically use Brave for browsing which has good ad blocking capabilities, but this adds a whole additional layer. The only reason I don't use one now is that I travel a lot more so it's irrelevant, and I…

Wouldn’t a smart tv do something ... smarter than just using the default dns given to it by the network? I’m not up to speed on this stuff but I thought pihole only blocked the simplest stuff from devices that play nice?

> Wouldn’t a smart tv do something ... smarter than just using the default dns given to it by the network?

It could certainly try... but usually you would block that in your firewall. Fixed DNS servers or fixed server IP addresses are tricky because if you ever need to change them, you can't, because you'd need to update the hardware (which you can't since it sits behind a firewall).

It could try to use things like Google's DNS server, but that is easily blocked in your router.

Not a lot that could be done except trusting your (internal) DNS server...

Re: Pi-hole v6

#113

Post by [deleted] »

RandomDistort wrote: post #85

Not sure if this is the right place to ask, but I've got a semi-obscure DNS question. I'd like to use Cloudflare's Zero Trust DNS filtering with DoH by running a DNS proxy on my network. I can get this to work great with github.com/adguardTeam/dnsproxy (running on a Pi 4B) but what I would really like is to have different devices (based on their IP on the network) get their queries forwarded onto a different DoH upst…

[deleted]

Re: Pi-hole v6

#114

Post by bee_rider »

b3lvedere wrote: post #65
RandomDistort wrote: post #63

Earlier quoted context omitted.

Isn't a TV that permanently shows HDMI input a big monitor? Weirdly they always seem to be more expensive than a TV though.

Well yes, but i guess either big monitors use different panels or there's some shady business going on.

Inclusive or.

Re: Pi-hole v6

#115

Post by lotharcable2 »

ge96 wrote: post #33
andy_xor_andrew wrote: post #21

I set up pi-hole recently after hearing about it for years. I was kind of surprised at a lack of really basic features (imo): There isn't any kind of "dry run" or "phantom" mode, where requests are not actually blocked, but appear marked in the log UI as "would be blocked". This is super important because I want to see all the things my home network is doing that would be blocked before I actually hit the big red but…

I think I'll never buy a smart TV what an ultimate ahole move to put ads in there. It's like the Kindles where you have to read these ads before you can open your book (of course you can pay a 1-time fee). Like buying a movie on YouTube and having to watch ads in it or can't see full res unless you're on an allowed device. If UBO actually stops working on Chrome I'll either leave or use pihole. My cheap android phone…

I have a 'smart tv'. I don't allow it to connect to any network.

The only really annoying thing about it is that noises from tv shows or the house sometimes triggers the voice recognition, which fails, and then you have to click through the error message.

Re: Pi-hole v6

#116

Post by Marsymars »

ncrmro wrote: post #45

Nice. I wish pihole or adguard would add support for change DNS records based on the query subnet. I believe this is called DNS views. That way my local devices and wireguard devices can get the correct IP for internal services.

I managed this by getting a gTLD (digit-only .xyz is cheapest) for internal-only services and then running a Caddy instance to reverse-proxy to my internal services. I don't port forward or open ports to that Caddy instance, so it's not available externally.

Re: Pi-hole v6

#118

Post by bolster8505 »

paxys wrote: post #95
MyOutfitIsVague wrote: post #38

Earlier quoted context omitted.

> It's also not possible (or not clear) how to have different behavior for different clients There's a menu item for that: Clients. You create a group, add a client to that group, and configure blocking for that group. To have what you want, you create a group that has just one client in it.

It's slightly more complicated. What you are suggesting works if (1) you are using Pi-hole as a DHCP server or (2) all your devices are individually configured to use the Pi-hole IP address for DNS resolution. What's more likely though is that you just point your router's DNS setting to Pi-hole, and in that case there is only one client on the Pi-hole dashboard - your router.

Using clients and groups works fine for me. I'm able to block youtube on my kids' devices, but allow it on others. I have pihole running in a container without being my dhcp server.

Re: Pi-hole v6

#119

Post by LeoPanthera »

mrmuagi wrote: post #100
laweijfmvo wrote: post #55

Earlier quoted context omitted.

I went from PiHole -> AdGuard -> NextDNS. My patience for tinkering and maintaining wasn't high enough to not just pay someone else to do it :)

Same except skipping AdGuard. Having the DNS live on a pi sounded like fun for me but it gave me stress due to power outages. There is safety in knowing you aren't adding a point of failure that only you know how to solve. I also had issues with adding backup DNS, since a backup DNS would be queried if the pihole blocked the DNS query -- so I would have to maintain two seperate blocklists, one local and one offsite.

I run AdGuard Home on the same device as my router, so anything that would take it down would also take down the entire router anyway.
Post reply on HN