251–260 of 262 posts
Earlier quoted context omitted.
could setup a small firewall (pfSense) that routes all DNS queries from connected devices to your own DNS server.
Not with DNS-over-HTTPs and certificate pinning you can't, because the certificate check would fail. (That would be a very annoying thing to do in a device or browser, but it's certainly possible)
Earlier quoted context omitted.
I see it as an advantage for all the devices on your network. I mean, to block trackers from Windows computers, or Roku devices or android apps. But as an adblocker - I feel like I'm missing something. It acts as a DNS server for your local network and blocks what's essentially a host file. So how does it handle ads served through websockets? How does it handle ads that come from the same domain as legitimate content…
There are tradeoffs in all solutions of course. The pi-hole asks you to choose security over convenience, and you must accept that not all apps and services will work. That's a personal choice you can make for your own setup in your own home. I've never seen anyone say this _replaces_ your browser's ad blocker though.
This is an easy choice for myself.
it's not an easy choice for one person to make for a family of others.
I haven’t tried Pi-Hole yet but this was the impetus I needed to decide to set it up tonight. I commented on a different post last night, that I was a bit shocked and saddened to see their Patreon is only pulling in $1,700/mo. Do they have another significant revenue stream? Is it just too much hassle to bother signing up to Patreon to commit to even $1/mo? Do they have something on the Admin panel where users can cl…
I love the pi-hole, but I can't seem to figure out how to get resolving of .local hostnames back when I use it. Like, I can no longer ping my media server at media.local, I have to use the exact IP address. Not a deal breaker, but annoying.
If you point the PiHole Upstream DNS to your router's DNS (Or whatever DNS server is hosting the .local domains) it should resolve .local hostnames again. I think by default it uses 8.8.8.8 or 8.8.4.4 https://discourse.pi-hole.net/t/change-upstream-dns-server-i...
First, certain streaming websites would fail and it was too much trouble to try to find the URL to whitelist.
Then after I had disabled it from the Pi-hole interface everything was fine but it wasn't actually active. No problem...until I forgot my router was using it as a DNS server and I moved and didn't set my Pi up yet. Then it took me a couple weeks going back and forth with Comcast to find out that my router was still pointing to a DNS server that wasn't running.
Somehow my FireTV bypassed the bad DNS server at one point (still no idea how this happened cause my router was routing all traffic through the IP for pi-hole) and that made me realize that I can get data from Comcast somehow so maybe it really was my router.
Earlier quoted context omitted.
I'm running a pfsense setup with cloudflare as my DNS (DNS-over-TLS, in specific). As soon as I had the rpi in the middle, it jacked up resolution times like crazy (rpi was set to use my SG as its DNS, so ->rpi->pfsense->1.1.1.1 It's good to know you guys haven't been having problems; I thought everyone was just fucking nuts or something, but no; local problem. Sigh.
If you're using pfsense, why not just use pfBlockerNG-dev?
I wanted to try it again and NOT do what I had done previously, but I think a conf file is still floating around because the second I install pfBlockerNG(maybe -dev too? I actually can't remember now), my entire network instantly goes down and won't come back until I remove the pkg again.
I don't know enough about BSD's package manager or where pfsense puts package conf files to try to track this down and stop clean it out. I'm sure I COULD figure it out, but I have other projects that are higher priority :)
Edit: I should also note when I was trying to figure this out I had a very angry spouse standing behind me burning holes into the back of my head because the network was down, so I didn't make a priority of really looking through logs and trying to properly diagnose things. I just wanted things to be up so that I wasn't slain.
Earlier quoted context omitted.
Cloudflare has also rolled out ESNI ( https://www.cloudflare.com/ssl/encrypted-sni/ ) which would mean someone reading your traffic would only be able to tell that you're connecting to a cloudflare IP address. However be unable to determine which specific site you were accessing.
What does that accomplish? As opposed to Tor use, specifically?
a) Used where Tor is unacceptable, such as some university networks, and workplaces where using anonymization such as Tor/VPN is prohibited by policy.
b) When using Tor protecting yourself from the Tor endpoint collecting information / statistics on what you are visiting.
Earlier quoted context omitted.
What does that accomplish? As opposed to Tor use, specifically?
Well it to me has a few use cases that are reasonable. a) Used where Tor is unacceptable, such as some university networks, and workplaces where using anonymization such as Tor/VPN is prohibited by policy. b) When using Tor protecting yourself from the Tor endpoint collecting information / statistics on what you are visiting.
It seems to me like these DNS tricks are parlor tricks in a security sideshow. Any attacker that could see your packets can also see who you are connecting to. It's pretty rare that SNI does anything relevant to a real threat model.
I think a false sense of privacy is at least as dangerous as the alternative.
Also, owners or routers able to run OpenWRT (which is actively maintained and in great shape since the merge with LEDE), you have access to several packages providing the same technical solution (DNS-based blocking). As far as I know, the most common and maintained is https://github.com/openwrt/packages/tree/master/net/adblock/... . Super easy to install, full-featured, lots of lists to pick from, auto-updates lists,…
pfSense based routers can use pfBlockerNG which can be installed from the Package Manager.