301–310 of 316 posts
I have a script update my hosts file to route domains to 0.0.0.0 and ::0 . I get the domains from https://github.com/StevenBlack/hosts .
Earlier quoted context omitted.
If only they had a stop blocking function.
NextDNS has not updated its client applications on multiple platforms (iOS/iPadOS/macOS) for several years. Those client applications did have the ability to stop the blocking (or not), but now it's just a toggle that does nothing. Most of the time when I visit test.nextdns.io it shows as "unconfigured" even though the NextDNS client is installed and configured with a NextDNS profile (and approved in Settings as a VP…
Earlier quoted context omitted.
Basic statistics. The chance of someone from Netherlands being a state-level hacker is a lot smaller than someone from a Russian IP.
Logically, if Russians would want to infiltrate your organization, they won't do it from Russian IPs directly, but instead do it from cheap proxies, and those proxies are abundant in Netherlands or Germany.
Will it block YouTube ads?
Instead, use yout-ube.com [insert a hyphen into any URL] and ALL ads disappear.
Use Class A2 SDmicro cards (they'll last significantly longer... particularly if you keep logs). There are additional 3rd-party installations which can write into RAM, but IMHO it's easier for most new users to just buy better NANDs.
Set up more than one physical Raspberry Pi, running multiple versions of PiHole software on multiple IP addresses.
Have your main DHCP router auto-issue DNS information for your "most permissive" PiHole, with a minimal list of choice URL-blocks (e.g. pagead2.* , doubleclick). Individual clients can then manually change DNS server to 2nd (3rd... 4th...) PiHole(s) which are each more-restrictive.
This allows non-technical users to still browse somewhat ad-free, but also won't block banking/govt/etc for novices. As a failsafe, teach users to enter your router's IP as DNS x.x.x.1 [should they ever need to bypass local filtering, entirely].
I use sequential IP addresses [192.168.0.6, x.x.x.7, x.x.x.8, x.x.x.9] so it's easier to explain/teach my networks ad-blocking capabilities. YES, I understand that Pi-Hole allows different clients to follow different rulesets, but if you can afford to buy redundant hardware it's just so much easier to change the client DNS server information when a specific website isn't working correctly [due to erroneously blocked host].
Earlier quoted context omitted.
Logically, if Russians would want to infiltrate your organization, they won't do it from Russian IPs directly, but instead do it from cheap proxies, and those proxies are abundant in Netherlands or Germany.
And yet experience shows that GP is correct. The vast majority of mailicious traffic originates from those countries IME.
Finally a REST API! I've been waiting for this - I wanted to play around with blocking distractions on various rules, but controlling pi-hole remotely was a huge pain and often didn't work until now.
Have they added more to the existing API? They already had an http API to enable/disable blocking.
Earlier quoted context omitted.
And if your gateway device is configurable enough you can ban or redirect port 53 requests (DNS) to whatever machine you would like to use to serve up resolution.
That's kinda janky really. DNS doesn't have redirection like HTTP has, so what you describe can only be implemented using port forwarding (or SSH tunnelling, but I've never seen a router with the ability to tunnel DNS in this fashion?). Port forwarding used like this, won't enable one to use the 'groups' functionality on PiHole — which was the (g)parent thread here — because all requests arriving at the PiHole will c…
dnsmasq has grown up a lot in the last few years and does have the ability to redirect domains. It's that time again got to read the man page
Earlier quoted context omitted.
That doesn’t correct the situation in which the device is ignoring DHCP DNS requests.
> That doesn’t correct the situation in which the device is ignoring DHCP DNS requests. That's the first time such a thing has been mentioned in this thread. But I now get what you're trying to say in your comment above. Sure, one can use e.g. iptables, to forward all outbound traffic on some port to some local IP. If your router has such capabilities. But your rules won't be as simple as forward all port 53 traffic:…
It’s not meant to answer your direct question, but pointing out what’s possible. Because yes, there are a lot of IoT and other devices that misbehave on a network.
And it’s incredibly trivial to port ban or port forward a selection of IPs and not affect the behavior of your Pi-hole. Packets carry last hop ip and source ip. I do it all the time on my gateway device.
DoH is a completely different story. Now you are talking about browser based DNS systems, apple private relay and other related 443 based solutions.
I've been using AdGuard Home, which does pretty much the same thing, but is slightly better polished, with things like support for DoH and OSs other than Linux. https://github.com/AdguardTeam/AdGuardHome
