4 ms·

What happens if the DoH servers are blocked? I do this at home to stop any client from bypassing PiHole and if FF isn't smart enough to consider this scenario,

What happens if the DoH servers are blocked? I do this at home to stop any client from bypassing PiHole and if FF isn't smart enough to consider this scenario, then that's bad.

roody15 5y ago
It fallbacks to local DNS
- netr0ute 5y ago
  This is the kind of answer I needed.
sodality2 5y ago
I'd hope your PiHole at least resolves over DoH... if not consider AdGuard Home instead
- netr0ute 5y ago
  It's not the PiHole itself that's the problem, but rather the clients on the LAN. I already redirect the PiHole's traffic over a VPN so the ISP is none the wiser, but I could go further and use DoH for that too.
- e12e 5y ago
  That would require a valid certificate, wwouldn't it? (for it to work out of the box)
  - sodality2 5y ago
    Not for the pihole to use DoH to resolve regular :53 DNS requests, no. For it to act as a DoH DNS server, though, ie requests to it are encrypted, you would need one, yeah.
    - e12e 5y ago
      Yes, I meant in order to be able to point ff doh at the local resolver.
      - sodality2 5y ago
        Oh yeah, you probably would. or trust the cert in your OS. but there wouldn't really be a point, unless someone is intercepting 53 requests in your local network
tristor 5y ago
PiHole uses the DoH canary domain by default, so if you use PiHole it should just work without any effort on your part, and effectively disables DoH network wide. You can search how to encrypt the lookups that PiHole makes itself, a common scenario is to install cloudflared on the PiHole and point it at localhost, which you can see here: https://nathancatania.com/posts/pihole-dns-doh/ https://nathancatania.com/posts/pihole-dns-doh/
- Y_Y 5y ago
  Even if you specify them by IP? I specifically redirect addresses like 8.8.8.8 to my pihole (at the router) to prevent cheeky applications circumventing it.
  - tristor 5y ago
    I'm not certain, but I believe that would still work, because the lookup for the canary domain is done using the local resolver and if you are redirecting its configuration to your PiHole, the PiHole would respond. It sounds like you have a relatively unique network configuration, so I'd advise that you test this and share the results with all of us.
    - zinekeller 5y ago
      Not OP, but yes, it should work (as long as you're talking plain DNS on port 53. Direct DoH, you're out of luck unless you want to DPI or block IPs (and if it's Cloudflare, it's block all of Cloudflare or allow their DoH version of 1.1.1.1).
  - zinekeller 5y ago
    It'll still work, check if use-application-dns.net returns NXDOMAIN.
rany_ 5y ago
Firefox checks if use-application-dns.net is blocked, if it finds that it isn't blocked it ends up trying to use DoH. https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...

What happens if the DoH servers are blocked? I do this at home to stop any client from bypassing PiHole and if FF isn't smart enough to consider this scenario, then that's bad.

roody15 5y ago

It fallbacks to local DNS

netr0ute 5y ago
This is the kind of answer I needed.

sodality2 5y ago

I'd hope your PiHole at least resolves over DoH... if not consider AdGuard Home instead

netr0ute 5y ago
It's not the PiHole itself that's the problem, but rather the clients on the LAN. I already redirect the PiHole's traffic over a VPN so the ISP is none the wiser, but I could go further and use DoH for that too.
e12e 5y ago
That would require a valid certificate, wwouldn't it? (for it to work out of the box)
- sodality2 5y ago
  Not for the pihole to use DoH to resolve regular :53 DNS requests, no. For it to act as a DoH DNS server, though, ie requests to it are encrypted, you would need one, yeah.
  - e12e 5y ago
    Yes, I meant in order to be able to point ff doh at the local resolver.
    - sodality2 5y ago
      Oh yeah, you probably would. or trust the cert in your OS. but there wouldn't really be a point, unless someone is intercepting 53 requests in your local network

tristor 5y ago

PiHole uses the DoH canary domain by default, so if you use PiHole it should just work without any effort on your part, and effectively disables DoH network wide. You can search how to encrypt the lookups that PiHole makes itself, a common scenario is to install cloudflared on the PiHole and point it at localhost, which you can see here: https://nathancatania.com/posts/pihole-dns-doh/ https://nathancatania.com/posts/pihole-dns-doh/

Y_Y 5y ago
Even if you specify them by IP? I specifically redirect addresses like 8.8.8.8 to my pihole (at the router) to prevent cheeky applications circumventing it.
- tristor 5y ago
  I'm not certain, but I believe that would still work, because the lookup for the canary domain is done using the local resolver and if you are redirecting its configuration to your PiHole, the PiHole would respond. It sounds like you have a relatively unique network configuration, so I'd advise that you test this and share the results with all of us.
  - zinekeller 5y ago
    Not OP, but yes, it should work (as long as you're talking plain DNS on port 53. Direct DoH, you're out of luck unless you want to DPI or block IPs (and if it's Cloudflare, it's block all of Cloudflare or allow their DoH version of 1.1.1.1).
- zinekeller 5y ago
  It'll still work, check if use-application-dns.net returns NXDOMAIN.

rany_ 5y ago

Firefox checks if use-application-dns.net is blocked, if it finds that it isn't blocked it ends up trying to use DoH. https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...