The Beauty of Having a Pi-Hole (2024)

Post by jcalvinowens » Tue, May 06, 2025, 4:56 PM UTC

mikevin wrote: post #44

wang_li wrote: post #12

Earlier quoted context omitted.

> read TFA for the iptables config that fixes those apps and devices that bypass local DNS. For example, Don't worry. All the browsers and stuff are bypassing this level of control by moving to DNS-over-HTTPS. You'll either have to deploy a TLS terminating proxy on your network, or give up on this arms race.

Would certificate pinning also remove the first option? I wonder if we are moving to a system where inspecting your own traffic isn't a viable option anymore, am I missing a workaround?

Post by tonymet » Tue, May 06, 2025, 5:01 PM UTC

sgbeal wrote: post #191

perdomon wrote: post #188

Earlier quoted context omitted.

1. You’re totally right about that, but I couldn’t find one as easily 2. I was initally hesitant about using WiFi for DNS, but after reading comments it seemed that no one really had any issues. Mine has been kicking for 6 months sitting right next to my router without any noticeable delays, so I think it’s okay.

> I was initally hesitant about using WiFi for DNS, but after reading comments it seemed that no one really had any issues FWIW, that was also an initial concern of mine. Almost three years later, i've never once had an issue with running my pi-hole over wifi.

Post by mberlove » Tue, May 06, 2025, 5:16 PM UTC

everdrive wrote: post #94

My router just ate itself after the breaker on the house got cycled a few times in rapid succession. The router is almost a decade old, so perhaps it's not surprising. As a consequence, my pihole is temporarily out of commission. When we first set it up, we had IOT, android, chromebook, etc. Currently the whole household is on Linux and we just have a couple of smartphones. (plus a steamdeck) My wife has a few ugly a…

Post by jstanley » Tue, May 06, 2025, 8:47 PM UTC

Mashimo wrote: post #187

jstanley wrote: post #186

Earlier quoted context omitted.

Leave the computer running all the time. Never install software updates. Browsing for videos with keyboard is equivalent or better than browsing with phone. If you really want to browse with phone I guess you need a Firefox extension that can send the tab to the laptop. Personally I've never looked into that because I can't imagine wanting to do it.

> Browsing for videos with keyboard is equivalent or better than browsing with phone. Again, for you yes. But some lay down on the couch and a keyboard in that posture is just annoying. And copying a youtube video from the app, into firefox app to just send it to the computer is bonkers complicated when you could just press the cast icon. A lot of people interact with their phone all the time, but rarely use the comp…

Post by illiac786 » Wed, May 07, 2025, 7:29 AM UTC

silon42 wrote: post #179

h4kunamata wrote: post #162

Earlier quoted context omitted.

I followed this blog to get the firewall dynamic firewall in place: https://labzilla.io/blog/force-dns-pihole Like you said, you cannot just block 443, the dynamic firewall uses a public list, which contains all the public DNS known to man ( the last bit was just to sound a little dramatic haha ) So OPNSense will block anything within that list in both 443 and 853. So my Samsung QLED TV can no longer use Google:443 f…

Good stuff. As an alternative, has someone tried running http/s proxy on the firewall and blocking the rest of client HTTPS (except maybe for whitelist devices)?