7 ms·

Incidentally, one of the biggest advantages of using an OpenWRT router over a PiHole is the ability to respond to all DNS requests (sent via udp port 53), as op

by vitus 6y ago

Incidentally, one of the biggest advantages of using an OpenWRT router over a PiHole is the ability to respond to all DNS requests (sent via udp port 53), as opposed to just those that use the DHCP-discovered resolver, which allows you to police devices that use a hardcoded external DNS resolver (e.g. 8.8.8.8 or 1.1.1.1).

deleted 6y ago
[deleted]
Havoc 6y ago
Did not know that - thanks for highlighting. Any idea what feature within openwrt allows this?
- vitus 6y ago
  If your main goal is adblocking (or, generally, filtering requests by domain name), the adblock software package has a config option to "force local DNS". Otherwise you'll need to set up a firewall rule to redirect all DNS requests. https://openwrt.org/docs/guide-user/firewall/fw3_configurations/intercept_dns_luci https://openwrt.org/docs/guide-user/firewall/fw3_configurati... According to a sibling commenter, that alternative is also possible through Pi-Hole, although it looks like you need to configure a router to rewrite said traffic to point at it. (potentially also requiring the purchase of a $250 piece of additional hardware, at which point, why not just buy a router that supports OpenWRT?)
  - Havoc 6y ago
    Thanks! Yeah I've got a pihole and an openwrt router (Nanopi R4S is amazing bang per buck btw) configured to point to the pihole. Yet some stuff is leaking past it (mainly iphone) hence my interest in forcing things. I suspect its connected to the fact that ipv6 resolves faster than ipv4 for me somehow but can't quite place what's wrong...because it is catching some ipv6 traffic so its not like the ipv6 pihole is broken broken. >Otherwise you'll need to set up a firewall rule to redirect all DNS requests. Yes...the whole chain concept openwrt has going is something I haven't wrapped my head around yet so no rule writing for now
- zalebz 6y ago
  I believe the comment was highlighting the advantage of a router vs a local DNS service rather than asserting the openwrt implementation has features beyond vs the pihole implementation. The advantage is the router itself is literally routing all the traffic and thus even hostile clients (e.g. smart tv) that ignore the (dhcp provided) pihole DNS still have to pass their traffic through the router and thus it always has an opportunity to take action on the packets. As was mentioned in a sibling comment, even with just a pihole and a non-openwrt router you can still configure your network to force all DNS traffic through the pihole but it is more config and more error prone vs the single openwrt router network.
gh02t 6y ago
This is possible with PiHole too by setting some firewall rules. Example for Ubiquiti: https://www.derekseaman.com/2019/10/redirect-hard-coded-dns-to-pi-hole-using-ubiquiti-edgerouter.html https://www.derekseaman.com/2019/10/redirect-hard-coded-dns-...
tssva 6y ago
You are fighting a losing battle here. Many hardcoded devices and malware are switching to using DNS over HTTPS to bypass DNS redirection. Guests on your network can also bypass DNS redirection using DNS over HTTPS with recent browsers.

by vitus 6y ago

deleted 6y ago

[deleted]

Havoc 6y ago

Did not know that - thanks for highlighting. Any idea what feature within openwrt allows this?

vitus 6y ago
If your main goal is adblocking (or, generally, filtering requests by domain name), the adblock software package has a config option to "force local DNS". Otherwise you'll need to set up a firewall rule to redirect all DNS requests. https://openwrt.org/docs/guide-user/firewall/fw3_configurations/intercept_dns_luci https://openwrt.org/docs/guide-user/firewall/fw3_configurati... According to a sibling commenter, that alternative is also possible through Pi-Hole, although it looks like you need to configure a router to rewrite said traffic to point at it. (potentially also requiring the purchase of a $250 piece of additional hardware, at which point, why not just buy a router that supports OpenWRT?)
- Havoc 6y ago
  Thanks! Yeah I've got a pihole and an openwrt router (Nanopi R4S is amazing bang per buck btw) configured to point to the pihole. Yet some stuff is leaking past it (mainly iphone) hence my interest in forcing things. I suspect its connected to the fact that ipv6 resolves faster than ipv4 for me somehow but can't quite place what's wrong...because it is catching some ipv6 traffic so its not like the ipv6 pihole is broken broken. >Otherwise you'll need to set up a firewall rule to redirect all DNS requests. Yes...the whole chain concept openwrt has going is something I haven't wrapped my head around yet so no rule writing for now
zalebz 6y ago
I believe the comment was highlighting the advantage of a router vs a local DNS service rather than asserting the openwrt implementation has features beyond vs the pihole implementation. The advantage is the router itself is literally routing all the traffic and thus even hostile clients (e.g. smart tv) that ignore the (dhcp provided) pihole DNS still have to pass their traffic through the router and thus it always has an opportunity to take action on the packets. As was mentioned in a sibling comment, even with just a pihole and a non-openwrt router you can still configure your network to force all DNS traffic through the pihole but it is more config and more error prone vs the single openwrt router network.

gh02t 6y ago

This is possible with PiHole too by setting some firewall rules. Example for Ubiquiti: https://www.derekseaman.com/2019/10/redirect-hard-coded-dns-to-pi-hole-using-ubiquiti-edgerouter.html https://www.derekseaman.com/2019/10/redirect-hard-coded-dns-...

tssva 6y ago

You are fighting a losing battle here. Many hardcoded devices and malware are switching to using DNS over HTTPS to bypass DNS redirection. Guests on your network can also bypass DNS redirection using DNS over HTTPS with recent browsers.