6 ms·

I shove my entire home network's DNS thru pihole, cannot imagine life without it.

by whalesalad 5y ago

vorticalbox 5y ago
I found it enlightening with the amount of data an xbox sends home
- whalesalad 5y ago
  It's enlightening when you see all the crap that all the devices on your network are doing. You can take things a step further and isolate IOT devices on isolated subnets, with additional firewall/security rules to create a choke point for all traffic. Only a matter of time before applications begin to roll their own encrypted forms of DNS in order to circumvent ad blockers.
  - StillBored 5y ago
    You mean like DOH? which is quickly becoming ubiquitous.
    - blitzar 5y ago
      I expect they mean bypass your networks DNS completely and use hard coded ip's or a hard coded DNS (with some way to obscure it). DNS filtering and blocking is a very powerful tool great for bypassing many features/pitfalls of the internet.
      - BeefWellington 5y ago
        If you have the commitment to it, you can simply force all outbound connections not originating from your DNS servers to be NATed TO your DNS servers. I do this; no machine other than my 2 DNS servers are permitted to make outbound DNS requests (they are transparently handled by my LAN DNS). The real annoying change is the transition to DNS over HTTPS. The canary domain[1] is useful but apps are obviously free to ignore it. [1]: https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...
    - whalesalad 5y ago
      DOH is one way to do it. HTTPS is a secure channel.
    - JohnFen 5y ago
      That's why I had to start MITMing all of my HTTPS connections.
      - zo1 5y ago
        That's when the apps start embedding(pinning) certificates and completely ignoring any additional root certs you might want them to accept from the OS.
        userbinator 5y ago
        That's when you start injecting your own certificate into the certificate verification APIs... one of the amazing powers you get when you're root and actually have full control of your device, no wonder it scares big (ad)tech for users to have that power.
- A4ET8a8uTh0 5y ago
  I think this is the biggest piece that gets overlooked by many. I still remember the first time I ran pihole and saw all the stuff attempted and blocked. It is one thing to know all those connections are made in theory. It is so radicalizing to see it first hand on your home network.
  - vorticalbox 5y ago
    Just check my pihole there and curry 44.7% of the requests were blocked. I've seen it as high as 73%.
- elliekelly 5y ago
  Seeing how frequently the Xbox phoned home even when it was “off” prompted me to switch the settings from “instant on” to “power save” mode.
- asdff 5y ago
  My xbox turns itself on all the time entirely randomly. Most mornings its already turned on. I will be in the next room and hear the startup beep go off. I don't know if its a faulty switch or maybe I should put on a tinfoil hat.
StillBored 5y ago
My next firewall will have some kind of machine/port/etc filtering that allows me to whitelist where say my tv/etc can communicate. Even if I have to write it myself because i'm not aware of anything 1/2 as user friendly as the 3rd party "Windows X Firewall control" applet that works on a network level. Yes my current firewall can do this, but it requires me hand entering ip/port/etc combinations in a UI that is terrible. So, while I use an adblock list with my unbound caching DNS server, it only works with devices which honor the local network DNS settings, which are becoming fewer and fewer thanks to the efforts of the major players to _HELP_ everyone with DOH. A protocol without an easy way to MITM/filter the requests even when the user wants it.
- zaphar 5y ago
  To be fair though, being able to MITM the DNS is kind of a massive security hole. One you are abusing in a productive way but one that many others abuse in very non-productive ways.
  - gnu8 5y ago
    I don’t think that is fair at all. It is architecturally appropriate for every site to run DNS resolvers and most of them do outside of the residential space. This isn’t a man in the middle attack and selectively blocking queries according to local preferences doesn’t make it one.
    - zaphar 5y ago
      When my ISP decides to replace DNS traffic I call it a MiTM. I happen to be technical enough to fix it. Many of my friends are not.
- ignoramous 5y ago
  > So, while I use an adblock list with my unbound caching DNS server, it only works with devices which honor the local network DNS settings... I co-develop a FOSS DNS + Firewall for Android that prevents apps from doing their own DNS over HTTPS / TLS / QUIC by blocking all connections to IPs that the DNS client (embed within the firewall) hasn't resolved itself or the TTL of whatever answer it once resolved has expired. Something similar to this could and should be implemented by other firewalls, too. The result of such a blanket setting is devastating though, as some apps (like Telegram) refuse to do plain-old DNS and hence refuse to connect at all (so, one may have to selectively allowlist certain IPs / apps). This also has a happy side-effect (or annoying side-effect, depending on how one looks at it) of breaking apps connecting to static IP endpoints (ex: Orbot connecting to Tor bridges).
floren 5y ago
I already run my own DNS server; is there some way to fetch the pihole DNS blacklist so I can use it myself? A brief look at their github account didn't turn up anything that looked obviously like "this is the blacklist repo".
- katbyte 5y ago
  I go network -> bind -> root so I get pihole blocking and my local dns
- kube-system 5y ago
  Pihole just includes some well known lists.. and what they've included by default has changed over time. I think it's currently this: https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts https://raw.githubusercontent.com/StevenBlack/hosts/master/h...
- Trellmor 5y ago
  If you are running bind you can use my python script to aggregate various block lists into a zone file: https://github.com/Trellmor/bind-adblock https://github.com/Trellmor/bind-adblock
- julianz 5y ago
  It used to be easy to do this, I used to download the list to my Ubiquiti router and massage it slightly to work with dnsmasq. More recent releases of pihole include regular expressions as part of the list specification so you can't flatten the list easily any more.
- rsync 5y ago
  "I already run my own DNS server ..." I run my own resolver (unbound) that I point all of my networks/devices to. That resolver has, as its upstream, my nextdns.io account address. nextdns has the pihole/ublock lists built-in. So you get to run your own DNS server, you don't have to implement any of the blocking yourself, and you just point your upstream to the address you get when you sign up. I'm quite happy with this setup ...
fron 5y ago
Same. I even have wireguard set up on my phone so my phone's internet connection is pihole-enabled wherever I am
- fortuna86 5y ago
  Is there anyway to extend this to a chomecast so Youtube ads are blocked ?
  - cmeacham98 5y ago
    YouTube ads cannot be blocked at the DNS level.
    - fortuna86 5y ago
      Dang. Any way to do so via a chromecast ?
      - mazamats 5y ago
        You could pay for YouTube Premium
        fortuna86 5y ago
        I don't feel like rewarding a company for grabbing a monopoly on short form streaming video then making their service borderline unwatchable through aggressive, increasingly unskippable ads. Plus (getting back to the topic at hand), having adblock for all your devices is so ... pleasant. You forgot how jarring and upsetting (and LOUD) advertisements are. Having them puncture your DNS adblock while using Chromecast is like getting a wet slap in the face.
      - exikyut 5y ago
        I just tried googling "mitmproxy chromecast" and found a bit of a rabbithole of hacks and tweaks that can be done to Chromecasts to alter their behavior in ways they were definitely not intended for :) I expect there are probably umpteen different ways to block ads with a little digging, although I can't vouch for any as I don't have a Chromecast (or TV) myself. FWIW, a while back I reached my eye-twitch limit with Raid: Shadow Legends (deeply impressioning irritating ads: ...why...?), and so I stared at YouTube's load process to try and figure out if I could viably block everything. The technique I ended up using exploited the fact I was running within a Chrome extension and overloaded JSON.parse (lmao), and was specific to the HTML delivered for desktop, but has worked for months. I reckon it's quite possible the data sent to Chromecasts is similar enough that you could viably block it by MITMing the device then rewriting the JSON (or possibly gRPC) responses being sent to it. Using YouTube Vanced on a no-name Android TV stick might be an alternative. (Untested but should presumably/theoretically work.)
annoyingnoob 5y ago
I did too until it broke all of my wife's online shopping. Happy wife, happy life.
- metissec98 5y ago
  With recent piholes you can now ignore specific devices! This what I do for my partner.
  - salzig 5y ago
    Thanks for the hint.
- optymizer 5y ago
  From a practical point of view, the only thing it broke was Ad sponsored results on Google, so I had to teach my wife to go for the normal results, or search directly on Amazon or Wayfair or wherever. What broke for your wife's online shopping?
  - annoyingnoob 5y ago
    Several sites shes uses load images from a CDN, she would get to a page that should be full of pictures and those pictures would be missing.
- trutannus 5y ago
  You're not alone. I took out my partner's online calendar by mistake with a PiHole. I think I blocked all her productivity SaaS tools too. Found out in under 5 minutes.
- charwalker 5y ago
  My dad had an outdoorsy distribution list that shoved all links through an ad domain, like straight up as if it was clicked on a site. He was able to copy and paste the text just fine...
- x3n0ph3n3 5y ago
  I recently transitioned to the phrase "happy spouse, happy house." We all deserve to be happy.
userbinator 5y ago
DNS + MITM proxy is what I use. When I'm away from home I still VPN back in and go through the proxy. Besides adblocking, it also applies various page filters to make a few frequently-used sites more usable.
urda 5y ago
This and I combo it with restricting DNS lookups to the actual LAN servers. No way to bypass the DNS at that point via the firewall.
- ignoramous 5y ago
  > This and I combo it with restricting DNS lookups to the actual LAN servers. This won't prevent OPs concern with apps doing DNS over HTTPS, would it? > No way to bypass the DNS at that point via the firewall. Some apps do not even do DNS and connect to static IPv4s and IPv6s straight-away. Even if IPv4 is limited, plenty IPv6 to go around than an ip-table can handle.
pndy 5y ago
Are there filter lists or something similar to what adblock extensions are using?

I shove my entire home network's DNS thru pihole, cannot imagine life without it.

vorticalbox 5y ago

I found it enlightening with the amount of data an xbox sends home

whalesalad 5y ago
It's enlightening when you see all the crap that all the devices on your network are doing. You can take things a step further and isolate IOT devices on isolated subnets, with additional firewall/security rules to create a choke point for all traffic. Only a matter of time before applications begin to roll their own encrypted forms of DNS in order to circumvent ad blockers.
- StillBored 5y ago
  You mean like DOH? which is quickly becoming ubiquitous.
  - blitzar 5y ago
    I expect they mean bypass your networks DNS completely and use hard coded ip's or a hard coded DNS (with some way to obscure it). DNS filtering and blocking is a very powerful tool great for bypassing many features/pitfalls of the internet.
    - BeefWellington 5y ago
      If you have the commitment to it, you can simply force all outbound connections not originating from your DNS servers to be NATed TO your DNS servers. I do this; no machine other than my 2 DNS servers are permitted to make outbound DNS requests (they are transparently handled by my LAN DNS). The real annoying change is the transition to DNS over HTTPS. The canary domain[1] is useful but apps are obviously free to ignore it. [1]: https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...
  - whalesalad 5y ago
    DOH is one way to do it. HTTPS is a secure channel.
  - JohnFen 5y ago
    That's why I had to start MITMing all of my HTTPS connections.
    - zo1 5y ago
      That's when the apps start embedding(pinning) certificates and completely ignoring any additional root certs you might want them to accept from the OS.
      - userbinator 5y ago
        That's when you start injecting your own certificate into the certificate verification APIs... one of the amazing powers you get when you're root and actually have full control of your device, no wonder it scares big (ad)tech for users to have that power.
A4ET8a8uTh0 5y ago
I think this is the biggest piece that gets overlooked by many. I still remember the first time I ran pihole and saw all the stuff attempted and blocked. It is one thing to know all those connections are made in theory. It is so radicalizing to see it first hand on your home network.
- vorticalbox 5y ago
  Just check my pihole there and curry 44.7% of the requests were blocked. I've seen it as high as 73%.
elliekelly 5y ago
Seeing how frequently the Xbox phoned home even when it was “off” prompted me to switch the settings from “instant on” to “power save” mode.
asdff 5y ago
My xbox turns itself on all the time entirely randomly. Most mornings its already turned on. I will be in the next room and hear the startup beep go off. I don't know if its a faulty switch or maybe I should put on a tinfoil hat.

StillBored 5y ago

My next firewall will have some kind of machine/port/etc filtering that allows me to whitelist where say my tv/etc can communicate. Even if I have to write it myself because i'm not aware of anything 1/2 as user friendly as the 3rd party "Windows X Firewall control" applet that works on a network level. Yes my current firewall can do this, but it requires me hand entering ip/port/etc combinations in a UI that is terrible. So, while I use an adblock list with my unbound caching DNS server, it only works with devices which honor the local network DNS settings, which are becoming fewer and fewer thanks to the efforts of the major players to _HELP_ everyone with DOH. A protocol without an easy way to MITM/filter the requests even when the user wants it.

zaphar 5y ago
To be fair though, being able to MITM the DNS is kind of a massive security hole. One you are abusing in a productive way but one that many others abuse in very non-productive ways.
- gnu8 5y ago
  I don’t think that is fair at all. It is architecturally appropriate for every site to run DNS resolvers and most of them do outside of the residential space. This isn’t a man in the middle attack and selectively blocking queries according to local preferences doesn’t make it one.
  - zaphar 5y ago
    When my ISP decides to replace DNS traffic I call it a MiTM. I happen to be technical enough to fix it. Many of my friends are not.
ignoramous 5y ago
> So, while I use an adblock list with my unbound caching DNS server, it only works with devices which honor the local network DNS settings... I co-develop a FOSS DNS + Firewall for Android that prevents apps from doing their own DNS over HTTPS / TLS / QUIC by blocking all connections to IPs that the DNS client (embed within the firewall) hasn't resolved itself or the TTL of whatever answer it once resolved has expired. Something similar to this could and should be implemented by other firewalls, too. The result of such a blanket setting is devastating though, as some apps (like Telegram) refuse to do plain-old DNS and hence refuse to connect at all (so, one may have to selectively allowlist certain IPs / apps). This also has a happy side-effect (or annoying side-effect, depending on how one looks at it) of breaking apps connecting to static IP endpoints (ex: Orbot connecting to Tor bridges).

floren 5y ago

I already run my own DNS server; is there some way to fetch the pihole DNS blacklist so I can use it myself? A brief look at their github account didn't turn up anything that looked obviously like "this is the blacklist repo".

katbyte 5y ago
I go network -> bind -> root so I get pihole blocking and my local dns
kube-system 5y ago
Pihole just includes some well known lists.. and what they've included by default has changed over time. I think it's currently this: https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts https://raw.githubusercontent.com/StevenBlack/hosts/master/h...
Trellmor 5y ago
If you are running bind you can use my python script to aggregate various block lists into a zone file: https://github.com/Trellmor/bind-adblock https://github.com/Trellmor/bind-adblock
julianz 5y ago
It used to be easy to do this, I used to download the list to my Ubiquiti router and massage it slightly to work with dnsmasq. More recent releases of pihole include regular expressions as part of the list specification so you can't flatten the list easily any more.
rsync 5y ago
"I already run my own DNS server ..." I run my own resolver (unbound) that I point all of my networks/devices to. That resolver has, as its upstream, my nextdns.io account address. nextdns has the pihole/ublock lists built-in. So you get to run your own DNS server, you don't have to implement any of the blocking yourself, and you just point your upstream to the address you get when you sign up. I'm quite happy with this setup ...

fron 5y ago

Same. I even have wireguard set up on my phone so my phone's internet connection is pihole-enabled wherever I am

fortuna86 5y ago
Is there anyway to extend this to a chomecast so Youtube ads are blocked ?
- cmeacham98 5y ago
  YouTube ads cannot be blocked at the DNS level.
  - fortuna86 5y ago
    Dang. Any way to do so via a chromecast ?
    - mazamats 5y ago
      You could pay for YouTube Premium
      - fortuna86 5y ago
        I don't feel like rewarding a company for grabbing a monopoly on short form streaming video then making their service borderline unwatchable through aggressive, increasingly unskippable ads. Plus (getting back to the topic at hand), having adblock for all your devices is so ... pleasant. You forgot how jarring and upsetting (and LOUD) advertisements are. Having them puncture your DNS adblock while using Chromecast is like getting a wet slap in the face.
    - exikyut 5y ago
      I just tried googling "mitmproxy chromecast" and found a bit of a rabbithole of hacks and tweaks that can be done to Chromecasts to alter their behavior in ways they were definitely not intended for :) I expect there are probably umpteen different ways to block ads with a little digging, although I can't vouch for any as I don't have a Chromecast (or TV) myself. FWIW, a while back I reached my eye-twitch limit with Raid: Shadow Legends (deeply impressioning irritating ads: ...why...?), and so I stared at YouTube's load process to try and figure out if I could viably block everything. The technique I ended up using exploited the fact I was running within a Chrome extension and overloaded JSON.parse (lmao), and was specific to the HTML delivered for desktop, but has worked for months. I reckon it's quite possible the data sent to Chromecasts is similar enough that you could viably block it by MITMing the device then rewriting the JSON (or possibly gRPC) responses being sent to it. Using YouTube Vanced on a no-name Android TV stick might be an alternative. (Untested but should presumably/theoretically work.)

annoyingnoob 5y ago

I did too until it broke all of my wife's online shopping. Happy wife, happy life.

metissec98 5y ago
With recent piholes you can now ignore specific devices! This what I do for my partner.
- salzig 5y ago
  Thanks for the hint.
optymizer 5y ago
From a practical point of view, the only thing it broke was Ad sponsored results on Google, so I had to teach my wife to go for the normal results, or search directly on Amazon or Wayfair or wherever. What broke for your wife's online shopping?
- annoyingnoob 5y ago
  Several sites shes uses load images from a CDN, she would get to a page that should be full of pictures and those pictures would be missing.
trutannus 5y ago
You're not alone. I took out my partner's online calendar by mistake with a PiHole. I think I blocked all her productivity SaaS tools too. Found out in under 5 minutes.
charwalker 5y ago
My dad had an outdoorsy distribution list that shoved all links through an ad domain, like straight up as if it was clicked on a site. He was able to copy and paste the text just fine...
x3n0ph3n3 5y ago
I recently transitioned to the phrase "happy spouse, happy house." We all deserve to be happy.

userbinator 5y ago

DNS + MITM proxy is what I use. When I'm away from home I still VPN back in and go through the proxy. Besides adblocking, it also applies various page filters to make a few frequently-used sites more usable.

urda 5y ago

This and I combo it with restricting DNS lookups to the actual LAN servers. No way to bypass the DNS at that point via the firewall.

ignoramous 5y ago
> This and I combo it with restricting DNS lookups to the actual LAN servers. This won't prevent OPs concern with apps doing DNS over HTTPS, would it? > No way to bypass the DNS at that point via the firewall. Some apps do not even do DNS and connect to static IPv4s and IPv6s straight-away. Even if IPv4 is limited, plenty IPv6 to go around than an ip-table can handle.

pndy 5y ago

Are there filter lists or something similar to what adblock extensions are using?