Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pi-hole v6

pi-hole.net

Post reply on HN
Print view View original

51–60 of 316 posts

Re: Pi-hole v6

#51

Post by bjoli »

unsnap_biceps wrote: post #41
chgs wrote: post #37

Earlier quoted context omitted.

I’m not sure why I’d ever want DoH, I block as much as I can at my firewall and have a canary domain. I want my devices to use my defined dns sever on my network, not some ad company (and all tech companies eventually become ad companies)

I want pihole to talk encrypted to the upstream dns server. I don't actually care if my devices talk encrypted to pihole. I just don't want to leak dns requests to my isp. If there's a way to do this without DoH or DoT, I'd happily learn more about it.

DoT has a standard port, meaning blocking (conforming) requests simple. DoH uses 443.

Nothing says clients need to confirm to the port requirements, but most companies will be lazy and assume 853 will work.

Re: Pi-hole v6

#52

Post by unethical_ban »

chgs wrote: post #37
unsnap_biceps wrote: post #4

Does anyone know if pihole is ever going to add DoH or similar support natively? I've had such troubles with cloudflared awhile back that I gave up on DoH, but would love to encrypt those queries.

I’m not sure why I’d ever want DoH, I block as much as I can at my firewall and have a canary domain. I want my devices to use my defined dns sever on my network, not some ad company (and all tech companies eventually become ad companies)

IIRC, there is not a native GUI method for Pihole to talk encrypted to DoH providers. You have to set up a daemon locally and configure via CLI, then set that as your "upstream" DNS provider in Pihole admin.

Obviously the goal is to have your local clients talking to Pihole, but the goal of having remote DNS queries encrypted is to prevent ISP snooping.

Though if you really want to prevent ISP snooping you have all clients using VPN or configure your router to send all outbound traffic to a VPN endpoint.

Re: Pi-hole v6

#53

Post by uncharted9 »

zufallsheld wrote: post #25
whalesalad wrote: post #15

Earlier quoted context omitted.

it's more than that - an app running on your internal network is going to have way better latency than nextdns

However you can't use it on the phone while not at home (aside from using vpn/wireguard), but nextdns allows it. As for the latency - is it really noticeable?

my biggest gripe with NextDNS is not having an ability to add custom blocklists. I'd gladly pay for it even if there was a paid tier with this feature.

Re: Pi-hole v6

#54

Post by progbits »

b3lvedere wrote: post #46
ge96 wrote: post #33

Earlier quoted context omitted.

I think I'll never buy a smart TV what an ultimate ahole move to put ads in there. It's like the Kindles where you have to read these ads before you can open your book (of course you can pay a 1-time fee). Like buying a movie on YouTube and having to watch ads in it or can't see full res unless you're on an allowed device. If UBO actually stops working on Chrome I'll either leave or use pihole. My cheap android phone…

Most non-smart 4K screens are more expensive than 4k-smart tv screens though. Really weird, because there's less stuff in it. I just want a nice 50" 4k screen with hdmi and display ports. I don't use all the other junk anyway, since i watch tv via a computer and sounds goes to a surround set.

Is there an equivalent of DDWRT/OpenWRT but for TVs?

Most often those are some embedded linux board running some Android fork, shouldn't there be some TV models on the market that are a good hardware/price deal with firmware that can be replaced?

Even something that just permanently shows HDMI input with no popup overlays would be good, but AOSP + VLC/Jellyfin would be even nicer.

Re: Pi-hole v6

#55

Post by laweijfmvo »

LeoPanthera wrote: post #7

I've been using AdGuard Home, which does pretty much the same thing, but is slightly better polished, with things like support for DoH and OSs other than Linux. https://github.com/AdguardTeam/AdGuardHome

I went from PiHole -> AdGuard -> NextDNS. My patience for tinkering and maintaining wasn't high enough to not just pay someone else to do it :)

Re: Pi-hole v6

#56

Post by unethical_ban »

Slightly off topic, but it annoys me that protonvpn does not allow split tunnel of DNS to an internal host. It calls this DNS leak protection, which is a good default. But I want to run my own DNS server and I know what I'm doing, and the Proton GUI won't let me.

Re: Pi-hole v6

#58

Post by google234123 »

plg wrote: post #32

love pi-hole we block all meta and X properties from our home network, also ads and it's self hosted on our own metal it's a wonderful life

Good way to teach other members of your house to use VPNs to bypass your censorship regime

Re: Pi-hole v6

#59

Post by Jeremy1026 »

b3lvedere wrote: post #46
ge96 wrote: post #33

Earlier quoted context omitted.

I think I'll never buy a smart TV what an ultimate ahole move to put ads in there. It's like the Kindles where you have to read these ads before you can open your book (of course you can pay a 1-time fee). Like buying a movie on YouTube and having to watch ads in it or can't see full res unless you're on an allowed device. If UBO actually stops working on Chrome I'll either leave or use pihole. My cheap android phone…

Most non-smart 4K screens are more expensive than 4k-smart tv screens though. Really weird, because there's less stuff in it. I just want a nice 50" 4k screen with hdmi and display ports. I don't use all the other junk anyway, since i watch tv via a computer and sounds goes to a surround set.

> Really weird, because there's less stuff in it.

It's also not subsidized by selling your user data.

Re: Pi-hole v6

#60

Post by ndriscoll »

chgs wrote: post #37
unsnap_biceps wrote: post #4

Does anyone know if pihole is ever going to add DoH or similar support natively? I've had such troubles with cloudflared awhile back that I gave up on DoH, but would love to encrypt those queries.

I’m not sure why I’d ever want DoH, I block as much as I can at my firewall and have a canary domain. I want my devices to use my defined dns sever on my network, not some ad company (and all tech companies eventually become ad companies)

Speaking of not wanting DoH to exist on the local network, does anyone know if there is anything pre-existing that can hook into firewall rules to default deny outgoing traffic and only allow (until TTL expiry) in response to a DNS lookup? That way things cannot bypass your DNS filtering with DoH or hardcoded IPs.
Post reply on HN