4 ms·
No. What you want to do is enable DoH on the pihole itself. https://docs.pi-hole.net/guides/dns-over-https/ https://docs.pi-hole.net/guides/dns-over-https/ Th
by nodja 7y ago
No. What you want to do is enable DoH on the pihole itself.
https://docs.pi-hole.net/guides/dns-over-https/ https://docs.pi-hole.net/guides/dns-over-https/
This would essentially enable DoH on all the computers that use the pihole as DNS, assuming you're not worried about people snooping on your own LAN.
- CydeWeys 7y agoIf you are going to do this approach, make sure that your ISP's router/modem is not on the same network. I.e. you should be running your own network, then have it connect to the outside world through the Pi-hole which is the only device that is connected to the ISP-controlled hardware. Otherwise, their hardware could just be reading everything and reporting home on it, since it'd be able to see the unencrypted DNS requests that are sent over its network to the Pi-hole.
- iforgotpassword 7y agoThis is actually what my network looks like but I'm curious if we know of any ISP doing this. They would basically have to sniff on the bridge between Wi-Fi and wired, or even on the switch if both ends are wired. I'm usually rather pessimistic but that seems rather involved instead of "just" spying on all the non tech-savvy users using the default DNS settings which should make up 99% of your user base.
- msla 7y agoSo when Firefox demands DoH for good and all, it won't work with a PiHole because it will demand to only talk to Cloudflare's DNS and the PiHole won't be able to MITM it?
- codedokode 7y agoYou can change URL for DNS resolver in Firefox using 'network.trr.uri' option or disable it: https://wiki.mozilla.org/Trusted_Recursive_Resolver https://wiki.mozilla.org/Trusted_Recursive_Resolver
- msla 7y agoWhich goes away when Mozilla takes that about:config option away.
- nodja 7y agoYes. You would have to disable it on all the clients that you wish to keep ad blocking on.