7 ms·

It seems like this change by Firefox would bypass a pi-hole. Am I understanding it correctly?

by Chirael 7y ago

Johnnynator 7y ago
Yes, a DoH request would never hit your Pi Hole
m-p-3 7y ago
Yes, unless you configure Firefox to not use Cloudflare DoH.
jfindley 7y ago
Out of the box? Yep! I realise that will annoy people but honestly it's a good thing - any solution that would not bypass a pi-hole would allow governments and ISPs to do the same. To retain your pi-hole, you'll need to run a DoH proxy on your pi-hole device, configure your browser to use that as the DoH provider, and this will allow your pi-hole to inspect and modify DNS results. Your pi-hole can then use any upstream DoH provider that you want.
taneq 7y ago
Would it be hard to make pi-hole into a DoH provider so you could just point your browser at it? Or does that defeat the "just works" factor of the pi-hole?
- kadoban 7y ago
  Probably easier to just turn off DoH in Firefox. In a home LAN configuration, which I'd expect is the vast majority of Pi-hole setups, I don't think you'd really be gaining anything from DoH. And even if Pi-hole does support being a DoH server, you'd have to configure that in Firefox anyway.
  - ocdtrekkie 7y ago
    Presumably you'd want DoH on the Pi-hole in the other direction, so that it's encrypting your DNS requests forwarded out to the Internet. But yeah, there'd be no reason to want to deal with certificates for your local network machines to do DoH from Pi-hole to PC.
- jm4 7y ago
  I don’t imagine it would. It might be there already. The real problem was mentioned above. We risk a situation where each app has its own doh config and not all of them allow you to change it. There’s nothing necessarily wrong with doh. It’s that app developers are baking it into apps instead of the OS where it belongs.
kadoban 7y ago
Yes, Pi-hole works via setting it as a DNS server, which this will bypass by default. You will have to turn it off manually, in Firefox. Not a great direction for DNS to be going for things like Pi-hole. If DoH becomes a thing on say smart TVs and gaming consoles, I fear it will be baked in and not configurable. Also going to be annoying on PCs/phones if each individual application is going to get its own DNS config now.
userbinator 7y ago
...and a local HOSTS file. So now it will, by default, contact all the ad/tracking hosts that you configured to be blocked. "But now your DNS queries to those ad/tracking hosts are encrypted!" No. I don't care. I didn't want to connect to those hosts in the first place.
- cremp 7y ago
  Even worse, corporate intranet addresses get leaked. Everyone on this article saying it's FUD is either a framework junky, isn't seeing the bigger picture, or just focus on one wrong thing in the article.
  - jamespo 7y ago
    Corporations concerned about that should be blocking DoH anyway
    - isostatic 7y ago
      Any device at home an go to http://nas http://nas and get on my nas, "http://desktop" http://desktop", "http://router" http://router", and "http://shed" http://shed" and get on those. How does that work in this bold new future? I'll have to register a domain name and add a bunch of A records for 192.168.0.1, but then it still won't work -- I'll have to do "http://desktop.mydomain.com" http://desktop.mydomain.com". Worse, while going to "shed" will work in chrome, it will fail in firefox. My guest network captive portal may well break too if someone visits with firefox.
      - Gaelan 7y ago
        Firefox claims they will detect this situation and disable DoH.
        Tharkun 7y ago
        Detect it, how? By forwarding the request to a local resolver after DoH fails, and thus leaking information?
seanhunter 7y ago
...unless you disable it. However you can configure firefox to use your pi-hole if you can get it serving dns over https. If that's not supported now I would expect it becomes supported very soon.
- kkarakk 7y ago
  then some "brave" company like apple/mozilla removes the option to disable it
  - seanhunter 7y ago
    How do you imagine apple will remove an option from mozilla? One option would be to worry about mozilla turning off the ability to disable this if they ever actually do that.
  - ripdog 7y ago
    There is no conceivable reason as to why anyone would remove the ability to configure DNS servers. DNS server options are present in almost all internet-facing applications and devices, from locked-down ecosystems like iOS to touchscreen printers and game consoles. You're just spreading FUD.

It seems like this change by Firefox would bypass a pi-hole. Am I understanding it correctly?

Johnnynator 7y ago

Yes, a DoH request would never hit your Pi Hole

m-p-3 7y ago

Yes, unless you configure Firefox to not use Cloudflare DoH.

jfindley 7y ago

Out of the box? Yep! I realise that will annoy people but honestly it's a good thing - any solution that would not bypass a pi-hole would allow governments and ISPs to do the same. To retain your pi-hole, you'll need to run a DoH proxy on your pi-hole device, configure your browser to use that as the DoH provider, and this will allow your pi-hole to inspect and modify DNS results. Your pi-hole can then use any upstream DoH provider that you want.

taneq 7y ago

Would it be hard to make pi-hole into a DoH provider so you could just point your browser at it? Or does that defeat the "just works" factor of the pi-hole?

kadoban 7y ago
Probably easier to just turn off DoH in Firefox. In a home LAN configuration, which I'd expect is the vast majority of Pi-hole setups, I don't think you'd really be gaining anything from DoH. And even if Pi-hole does support being a DoH server, you'd have to configure that in Firefox anyway.
- ocdtrekkie 7y ago
  Presumably you'd want DoH on the Pi-hole in the other direction, so that it's encrypting your DNS requests forwarded out to the Internet. But yeah, there'd be no reason to want to deal with certificates for your local network machines to do DoH from Pi-hole to PC.
jm4 7y ago
I don’t imagine it would. It might be there already. The real problem was mentioned above. We risk a situation where each app has its own doh config and not all of them allow you to change it. There’s nothing necessarily wrong with doh. It’s that app developers are baking it into apps instead of the OS where it belongs.

kadoban 7y ago

Yes, Pi-hole works via setting it as a DNS server, which this will bypass by default. You will have to turn it off manually, in Firefox. Not a great direction for DNS to be going for things like Pi-hole. If DoH becomes a thing on say smart TVs and gaming consoles, I fear it will be baked in and not configurable. Also going to be annoying on PCs/phones if each individual application is going to get its own DNS config now.

userbinator 7y ago

...and a local HOSTS file. So now it will, by default, contact all the ad/tracking hosts that you configured to be blocked. "But now your DNS queries to those ad/tracking hosts are encrypted!" No. I don't care. I didn't want to connect to those hosts in the first place.

cremp 7y ago
Even worse, corporate intranet addresses get leaked. Everyone on this article saying it's FUD is either a framework junky, isn't seeing the bigger picture, or just focus on one wrong thing in the article.
- jamespo 7y ago
  Corporations concerned about that should be blocking DoH anyway
  - isostatic 7y ago
    Any device at home an go to http://nas http://nas and get on my nas, "http://desktop" http://desktop", "http://router" http://router", and "http://shed" http://shed" and get on those. How does that work in this bold new future? I'll have to register a domain name and add a bunch of A records for 192.168.0.1, but then it still won't work -- I'll have to do "http://desktop.mydomain.com" http://desktop.mydomain.com". Worse, while going to "shed" will work in chrome, it will fail in firefox. My guest network captive portal may well break too if someone visits with firefox.
    - Gaelan 7y ago
      Firefox claims they will detect this situation and disable DoH.
      - Tharkun 7y ago
        Detect it, how? By forwarding the request to a local resolver after DoH fails, and thus leaking information?

seanhunter 7y ago

...unless you disable it. However you can configure firefox to use your pi-hole if you can get it serving dns over https. If that's not supported now I would expect it becomes supported very soon.

kkarakk 7y ago
then some "brave" company like apple/mozilla removes the option to disable it
- seanhunter 7y ago
  How do you imagine apple will remove an option from mozilla? One option would be to worry about mozilla turning off the ability to disable this if they ever actually do that.
- ripdog 7y ago
  There is no conceivable reason as to why anyone would remove the ability to configure DNS servers. DNS server options are present in almost all internet-facing applications and devices, from locked-down ecosystems like iOS to touchscreen printers and game consoles. You're just spreading FUD.