Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pi-hole v6

pi-hole.net

Post reply on HN
Print view View original

281–290 of 316 posts

Re: Pi-hole v6

#281

Post by whalesalad »

8fingerlouie wrote: post #145
whalesalad wrote: post #15

Earlier quoted context omitted.

it's more than that - an app running on your internal network is going to have way better latency than nextdns

Define latency ? This is my latency (ping.nextdns.io): zepto-cph (IPv6) 12 ms (anycast1, ultralow2) zepto-cph 13 ms (anycast1, ultralow2) ■ anexia-cph 13 ms (anycast2, ultralow1) anexia-cph (IPv6) 15 ms (anycast2, ultralow1)

welp. for every single domain you interact with, you gotta do a dns lookup. visit a modern website like yahoo, cnn, wapo, whatever and that will be like 100 dns requests. your device hits your router, if it has no answer, it recursively goes up the line getting an answer. do that 100 times. that is just for resolution. you still gotta actually hit that endpoint and get whatever it is you are trying to get.

so if your dns is slow, there is a tremendous amount of latency added to virtually everything that you do. just because you can hit nextdns in 12ms does not mean the e2e duration for a single dns-then-fetch is going to be in the realm of 12ms. if nextdns doesn't have the answer it needs to go find it.

Re: Pi-hole v6

#282

Post by jimsmart »

master_crab wrote: post #162
jimsmart wrote: post #103

Earlier quoted context omitted.

> What's more likely though is that you just point your router's DNS setting to Pi-hole, and in that case there is only one client on the Pi-hole dashboard - your router. That depends entirely on what capabilities your router has. Many routers have a setting for the DNS info they give to clients via DHCP, which would mean every client is indeed using PiHole directly for DNS resolution. Other less capable routers, onl…

And if your gateway device is configurable enough you can ban or redirect port 53 requests (DNS) to whatever machine you would like to use to serve up resolution.

That's kinda janky really.

DNS doesn't have redirection like HTTP has, so what you describe can only be implemented using port forwarding (or SSH tunnelling, but I've never seen a router with the ability to tunnel DNS in this fashion?).

Port forwarding used like this, won't enable one to use the 'groups' functionality on PiHole — which was the (g)parent thread here — because all requests arriving at the PiHole will come from the same client, i.e. the router. Because port forwarding is more like a proxy than a redirect (to use HTTP terms).

The correct solution here if one wishes to use PiHole's groups — and not have a janky network configuration like you describe here (an extra unnecessary hop for local DNS) — is to either (a) use the router's DHCP settings to tell the clients to use the PiHole IP for their DNS, or (b) disable the router's DHCP and simply use the DHCP that PiHole provides, which is at least as good as what most routers provide (and more configurable than most routers also, should one need to)

Re: Pi-hole v6

#283

Post by robk »

_fat_santa wrote: post #17

Pi-hole is a killer application and I've loved it since I got it setup. One other app I highly recommend to run on your Pi in addition to Pi-hole is Nginx Proxy Manager[1]. [1]: https://nginxproxymanager.com/

Do yourself a favor and move from nginx to caddy

Re: Pi-hole v6

#284

Post by jimsmart »

bilalel wrote: post #235
10729287 wrote: post #227

Earlier quoted context omitted.

Not OP but we can assume when he's talking about blocking Youtube, he's in fact blocking youtube for his kids, not Youtube ads. Pi-hole can't block Youtube ads as they are delivered by the same servers as content. Then you can't block one without blocking the other.

My comment wasn't clear. I was indeed referring to blocking youtube completely, not just ads on youtube.

Just go to PiHole's "Domains" page, in the box labelled Domain, type youtube.com, enable the checkbox for Add domain as wildcard, then click the button labelled Add to denied domains.

Now youtube.com and all of its subdomains are blocked, for all clients.

If you wish for it to only be blocked for some clients, then assign your clients to groups, and set the setting appropriately on the domains page.

Re: Pi-hole v6

#285

Post by jimsmart »

aulin wrote: post #214
MyOutfitIsVague wrote: post #38

Earlier quoted context omitted.

> It's also not possible (or not clear) how to have different behavior for different clients There's a menu item for that: Clients. You create a group, add a client to that group, and configure blocking for that group. To have what you want, you create a group that has just one client in it.

I use pihole for dhcp and it's extremely easy with dnsmasq. Hope their settings overhaul does not break this. dhcp-option=tag:nospam,option:dns-server,x.x.x.x dhcp-option=tag:spam,option:dns-server,y.y.y.y dhcp-host=client1...,set:nospam dhcp-host=client2...,set:spam

Previously, PiHole used /etc/dnsmasq.d/ with best practice being to put one's own additional config, or overrides, in separate file(s) in that folder.

PiHole v6 appears to have most of that config built-in, and upgrading to v6 removes all of the previous standard config files, leaving only user-created / user-edited files in /etc/dnsmasq.d/ - and PiHole v6 by default no longer imports anything from this folder (to prevent possible incompatibilities).

But it's just a setting, and toggling it brings back the original functionality of importing config from files in that folder. And for me, my custom dnsmasq config worked just the same as it previously did.

Re: Pi-hole v6

#286

Post by aborsy »

yard2010 wrote: post #233
_fat_santa wrote: post #17

Pi-hole is a killer application and I've loved it since I got it setup. One other app I highly recommend to run on your Pi in addition to Pi-hole is Nginx Proxy Manager[1]. [1]: https://nginxproxymanager.com/

Nginx Proxy Manager is a great piece of software!

How do? It has frequent vulnerabilities.

Re: Pi-hole v6

#287

Post by chgs »

kube-system wrote: post #279
chgs wrote: post #231

Earlier quoted context omitted.

DoT sure. The whole “tunnel everything over http” is a terrible pattern

Hostile firewalls that block and/or intercept DNS traffic are also a bad pattern, but people don't always control their local network these days. You can't always count on 853 being open. There are valid use cases for both.

its far easier to control your network than it is to control your devices on that network - far too many closed source devices nowadays, and it’s extremely difficult to avoid all of them

Re: Pi-hole v6

#288

Post by kube-system »

chgs wrote: post #287
kube-system wrote: post #279

Earlier quoted context omitted.

Hostile firewalls that block and/or intercept DNS traffic are also a bad pattern, but people don't always control their local network these days. You can't always count on 853 being open. There are valid use cases for both.

its far easier to control your network than it is to control your devices on that network - far too many closed source devices nowadays, and it’s extremely difficult to avoid all of them

Maybe that is true about your devices, and your use cases, on your home network, but that is far from the only use case in the world.

Re: Pi-hole v6

#289

Post by master_crab »

jimsmart wrote: post #282
master_crab wrote: post #162

Earlier quoted context omitted.

And if your gateway device is configurable enough you can ban or redirect port 53 requests (DNS) to whatever machine you would like to use to serve up resolution.

That's kinda janky really. DNS doesn't have redirection like HTTP has, so what you describe can only be implemented using port forwarding (or SSH tunnelling, but I've never seen a router with the ability to tunnel DNS in this fashion?). Port forwarding used like this, won't enable one to use the 'groups' functionality on PiHole — which was the (g)parent thread here — because all requests arriving at the PiHole will c…

That doesn’t correct the situation in which the device is ignoring DHCP DNS requests.

Re: Pi-hole v6

#290

Post by themadturk »

ge96 wrote: post #33
andy_xor_andrew wrote: post #21

I set up pi-hole recently after hearing about it for years. I was kind of surprised at a lack of really basic features (imo): There isn't any kind of "dry run" or "phantom" mode, where requests are not actually blocked, but appear marked in the log UI as "would be blocked". This is super important because I want to see all the things my home network is doing that would be blocked before I actually hit the big red but…

I think I'll never buy a smart TV what an ultimate ahole move to put ads in there. It's like the Kindles where you have to read these ads before you can open your book (of course you can pay a 1-time fee). Like buying a movie on YouTube and having to watch ads in it or can't see full res unless you're on an allowed device. If UBO actually stops working on Chrome I'll either leave or use pihole. My cheap android phone…

I just have never connected my Samsung TV to the Internet. My streaming all goes through my Roku. When the TV turns on it displays a splash screen asking me to connect to the network, which disappears after about 15 seconds and never comes back until I turn the TV back on.

I know there are TVs far more obnoxious than this, but I have no complaints and the Internet doesn't know a thing about my TV.

Post reply on HN