10 ms·
Setting Up 1.1.1.1 for Families on a Pi-Hole
- truth_seeker 5y agoI use Adguard DNS. https://adguard.com/en/adguard-dns/overview.html https://adguard.com/en/adguard-dns/overview.html DNS Servers: 94.140.14.15 94.140.15.16 Also, for android phones (via private DNS): dns-family.adguard.com
- t0bia_s 5y ago1.1.1.3 for blocking also adult content, could be even faster than commonly used 1.1.1.1
- deeblering4 5y agoCongratulations, you've just sent all of your legitimate DNS traffic to a tracker (the thing pi-hole is usually deployed to avoid). Remember that when a service is free, you are usually paying with your data.
- an_ko 5y agoDepends on whether you trust your ISP's DNS more than Cloudflare's. According to https://www.cloudflare.com/en-gb/learning/dns/what-is-1.1.1.1/ https://www.cloudflare.com/en-gb/learning/dns/what-is-1.1.1....: > Unlike most DNS resolvers, 1.1.1.1 does not sell user data to advertisers. Putting aside the question of whether they actually honour that commitment, has your ISP even published a similar statement to put their reputation on the line? I think Cloudflare's commitment is plausible. They have a financial incentive to maintain their free DNS resolver's reputation and popularity, because they are selling points for their commercial authoritative DNS service; https://www.cloudflare.com/en-gb/dns/ https://www.cloudflare.com/en-gb/dns/. Does your ISP have a similar financial incentive to behave? "If it's free, you are the product" is not always true. Sometimes, if it's free, you are the marketing funnel.
- aayala 5y agoUnbound and root.hints
- 2Gkashmiri 5y agowhy? arent we already using pi-hole for blocking all the stuff? that said, i have a query about a simple way to force all dns in a local network to pass through pi-hole. i only have access to the iSP router and pi-hole and cannot use third party router
- LeoPanthera 5y agoYour router must support outbound NAT in order to force all connections on a specified port to a specified host. If your router doesn't have that feature, there's no way to do it.
- morjom 5y agoWhat would that feature be listed as on the back of the box/spec sheet?
- LeoPanthera 5y agoIt's extremely unlikely that any consumer router would support it. If you really want to force clients on your LAN to always use a specified DNS server you're looking at a more enterprise-y router solution, probably something running pfSense or OPNsense.
- ttt7 5y agoYou could double-NAT with a second router (apparently causes problems with some things like consoles, although I’ve never had a problem).
- 2Gkashmiri 5y agocan the pi zero as pi hole for example itself be the second router and pi hole at the same time?
- qwertox 5y agoDouble NATting is underrated. I have zero problems with it and I like the buffer zone (subnet) between the ISP's Gateway/Router and my home network. Should the ISP's device have a known Zero Day exploit then it won't affect my home's subnet. Then there's all the additional stuff that can be done on your own router and also use DoH to ensure that a compromised ISP-router can't rewrite your DNS queries. Plus your ISP's router won't be able to gather statistics about the devices in your home, in case it would do that. I don't trust ISP-provided devices at all.
- whalesalad 5y agoI’d urge everyone to run a dns bench tool at home. Cloudflare isn’t always the right choice and for some ISPs with routing issues it can sometimes be a bad choice.
- omgitsabird 5y agoWhat is that? ping 1.1.1.1?
- a10c 5y agocan you recommend a tool?
- captn3m0 5y agoI’ve used https://pypi.org/project/DnsBench/ https://pypi.org/project/DnsBench/
- freediver 5y agoI found https://github.com/cleanbrowsing/dnsperftest/ https://github.com/cleanbrowsing/dnsperftest/ to be really user friendy and easy to customize. Here are results for my custom edited list of domains (first three are popular domains, rest are "long-tail" domains): test1 test2 test3 test4 test5 test6 test7 test8 test9 Average 2001:558:feed::1 18 ms 18 ms 16 ms 30 ms 202 ms 377 ms 90 ms 87 ms 485 ms 147.00 2001:558:feed::2 47 ms 31 ms 32 ms 154 ms 436 ms 343 ms 102 ms 76 ms 254 ms 163.88 75.75.75.75 20 ms 16 ms 17 ms 78 ms 191 ms 293 ms 68 ms 75 ms 203 ms 106.77 75.75.76.76 35 ms 33 ms 34 ms 149 ms 437 ms 283 ms 123 ms 102 ms 464 ms 184.44 cloudflare 17 ms 19 ms 19 ms 103 ms 1135 ms 427 ms 69 ms 293 ms 191 ms 252.55 level3 18 ms 17 ms 17 ms 45 ms 209 ms 231 ms 73 ms 49 ms 358 ms 113.00 google 21 ms 17 ms 16 ms 37 ms 381 ms 124 ms 79 ms 28 ms 183 ms 98.44 quad9 18 ms 19 ms 17 ms 42 ms 211 ms 127 ms 71 ms 73 ms 181 ms 84.33 freenom 36 ms 49 ms 59 ms 88 ms 534 ms 342 ms 219 ms 82 ms 204 ms 179.22 opendns 16 ms 19 ms 27 ms 23 ms 1514 ms 325 ms 85 ms 69 ms 488 ms 285.11 norton 25 ms 27 ms 26 ms 134 ms 389 ms 243 ms 277 ms 273 ms 354 ms 194.22 cleanbrowsing 22 ms 24 ms 27 ms 105 ms 533 ms 142 ms 70 ms 289 ms 199 ms 156.77 yandex 192 ms 197 ms 191 ms 293 ms 378 ms 803 ms 287 ms 603 ms 232 ms 352.88 adguard 84 ms 75 ms 74 ms 144 ms 240 ms 257 ms 72 ms 292 ms 170 ms 156.44 neustar 18 ms 21 ms 16 ms 29 ms 389 ms 222 ms 276 ms 285 ms 315 ms 174.55 comodo 65 ms 65 ms 82 ms 119 ms 458 ms 417 ms 236 ms 267 ms 290 ms 222.11 This was my setup for reference: DOMAINS2TEST="www.google.com amazon.com facebook.com mateja.prelovac.com enigma.rs hmdt.jp podravka.hr argentia.com.ar bildung.sachsen.de"
- a10c 5y agoany ideas why 1.1.1.2 doesn't support tls?
- eastdakota 5y agoIt does. If you’re having issues, submit a support ticket.
- deleted 5y ago[deleted]
- a10c 5y agoIt's not supported. https://community.cloudflare.com/t/community-tip-best-practices-for-1-1-1-1-for-families/160496 https://community.cloudflare.com/t/community-tip-best-practi... > Does 1.1.1.1 for Families support DNS over TLS? No. But our team is working on it.
- a10c 5y agoFor those playing at home you can specify tls://security.cloudflare-dns.com instead
- pkulak 5y agoI recently switched to AdGuard (hosted in Home Assistant), and I like it a bit better than PiHole. It seems more configurable.
- hn_throwaway_69 5y agoWhy do parents feel the need to control what their children do online? I had unrestricted internet access as a child and turned out fine. Although I must say, a DNS based approach is more benign than some of the horrendously invasive alternatives.
- jasonjayr 5y agoControl or monitor? I'm pretty sure I don't want my kids around 4chan and/or kiwifarm till they're much older .....
- broodbucket 5y agoMy high school friend group lived on 4chan, and this was in the era of shock sites and the like. You grow out of it pretty quickly. Zero parenting experience here, but making something the "forbidden fruit" is probably how kids learn to change the DNS on their device. As far as I can remember, the only real-world consequence was someone applying Bengay where it should not be applied.
- LordDragonfang 5y agoPoint of clarification, was this before or after stormfront explicitly started using the site as a recruitment and training ground for neo-nazis? Because I also spent a fair bit of my middle and high-school time on 4chan, and can attest to the fact that the 4chan of 2007-2012 and the chansites of the present day are very different beasts.
- broodbucket 5y agoThat's true, I shouldn't speak to what it's like today as if it's the same when I don't actually know.
- ta8902 5y agoWhere are you getting this from? Of course discussion on 4chan wasn't as politicized back then because politics was a much smaller part of the internet a decade ago in general, but people back then are still what you'd call "nazis" or whatever even today. If anything the /n/ (the first iteration of /pol/) board had existed since close to the start of the site and only in 2008 was it removed and replaced with the Transportation board.
- freediver 5y agoI did test 1.1.1.1 and found it to be pretty slow on long tail domains (obviously everyone is caching popular ones). I bascially ran a 'dig' with multiple DNS providers and CloudFlare was slowest among the bunch for long-tail domains. Here are the details: https://twitter.com/vladquant/status/1428761979808669704 https://twitter.com/vladquant/status/1428761979808669704 CloudFlare never responded to this tweet.
- gjs278 5y agoI doubt im visiting many domains that aren’t already cached by them
- unixhero 5y agoInteresting, but what are long tail domain?
- theodorton 5y agoDomains that have less frequent lookups so the chance of getting a cached response is lower.
- lloydatkinson 5y agoWhy aren't they just called infrequently used domains then?
- jasode 5y ago>Why aren't they just called infrequently used domains then? You could call them "infrequent" but "long-tail" is also a common description to convey a Power Law distribution: https://en.wikipedia.org/wiki/Long_tail https://en.wikipedia.org/wiki/Long_tail I think in this case about DNS caching, "long tail" is better than "infrequent". In the wikipedia graph, some of the domain lookups in yellow may be "frequent" (absolute sense) but simultaneously but much less popular (long tail) such that they don't stay in DNS lookup caches.
- newscracker 5y agoThe one thing Cloudflare DNS is missing is providing something like NextDNS. Choose your own filter lists (that are constantly updated), create multiple profiles to use according to the target device/location and enjoy as blocking at the DNS level. It’s not a complete match for something like uBlock Origin, but a lot of stuff still gets blocked with DNS filters.
- SturgeonsLaw 5y agoHave you checked out Cloudflare Gateway? We used that to do DNS filtering on some iPads we deployed
- newscracker 5y agoThanks for pointing that out. I hadn't known about Cloudflare Gateway and am exploring at now. Preliminary thoughts: it seems a lot more complex than configuring and setting up NextDNS. Had a look at setting up policies, and it doesn't seem to support adding ad-blocking lists (like the ones used in uBlock Origin) easily. In NextDNS these are just checkboxes for each filter list.
- closeneough 5y agoYes, send more data to big companies like cloud front and google. They need it.
- 013 5y agoThis has nothing to do with either of them?
- closeneough 5y agoAh yes, it's cloudflare of course. On of the other contesters.
- deleted 5y ago[deleted]
- JimWestergren 5y agoAnybody know from where does CF get the domains to block on 1.1.1.2 (malware) and 1.1.1.3 (porn)?
- iso1210 5y agoI wonder how much ICMP is going to those IPs. I ping 1.0.0.1 ("ping 1.1") as a quick check to ensure my internet is working a lot, far quicker and less stretching than typing ping 8.8.8.8. When I'm tracing a fault I'll ping 1.1.1.x as I can then tcpdump on a spanport against that IP and be fairly confident any traffic is from my test point and not from another device. I'm sure I'm not the only one.
- smashed 5y agoI'd suspect a huge amount of IoT devices continually test their network connection by pinging these well known IPs.
- wink 5y agofunny that you mention it but most technically minded Germans I know (maybe outside of people spending their days with datacenter stuff) habitually use `ping heise.de` (of c't and ix print magazine fame), which seems to have been a thing since the 90s. It's usually fast, you can really count on it being up and still around. I even remember them once writing about having such an unusually high volume of ICMP traffic that they had to divert that traffic to a dedicated box at some point.
- danShumway 5y agoI still think this is a business that Cloudflare shouldn't be involved in. There are very legitimate reasons for parents to filter Internet content. But Cloudflare is in a unique position here, they have a brand as a company that cares about free speech, and specifically because of who they are, they really shouldn't be making determinations about what is and isn't inappropriate content for kids. When 1.1.1.1 for Families launched, it blocked access to GLADD's site because Cloudflare didn't do a good enough job testing any of this stuff and they just pulled in filters from other parental companies, some of which turned out to be anti-gay. Cloudflare apologized, pushed a couple of fixes, but never actually took a step back and asked how this happened. In the meantime, 1.1.1.1 for Families launched without blocking access to sites like Stormfront. Cloudlfare didn't think it was appropriate for them to make a determination over whether that site was safe for kids. I think that our society is just generally a lot less thoughtful about filtering adult content than it is about filtering other forms of content like political speech, and we don't think about adult content filters as having a downside, or being real censorship. So when 1.1.1.1 for Families was released, I came up with a challenge: https://danshumway.com/blog/sex-censorship-is-censorship/ https://danshumway.com/blog/sex-censorship-is-censorship/ I do think there are scenarios where it's completely appropriate to block content for children, and I do think families should always able to make these kinds of determinations. People and communities have a fundamental Right to Filter (https://anewdigitalmanifesto.com/#right-to-filter https://anewdigitalmanifesto.com/#right-to-filter). However, adult content isn't the only content that falls into the category of being harmful to children. It is utter hypocrisy for Cloudflare to launch a service that blocks adult content but not hate speech; both forms of content are legitimate for parents to want off of their networks. My challenge is, if Cloudflare is frightened of the implications of being the company that decides what is and isn't hate speech, then why isn't it also frightened of being the company that decides what is and isn't adult material? Why do we view accidental censorship of LGBTQ+ informational materials as less of an existential free speech risk than accidental censorship of political ideas or extremist groups? Cloudflare still, over a year later, doesn't really have clear documentation I can find anywhere about what specific criteria they use to make filtering decisions on 1.1.1.3 beyond that they "aim to imitate" Google Safe Search. Would people tolerate that kind of fuzziness if they were filtering hate speech or political extremism? There is a reasonable debate people can have about whether or not it's appropriate for Cloudflare to be the company that carves out sections of the Internet that are inappropriate, even as an opt-in filter. I think both sides of that debate can make some good points, and reasonable people could go in either direction. But for me, the biggest question isn't really whether Cloudflare is the right company to build and maintain Internet filters. For me, the biggest question is about which subjects Cloudflare views as OK to moderate, and which communities Cloudflare is OK offloading the externalities of their moderation onto. Because frankly, in free speech communities we do have a lot of hypocrisy about this. There's no argument to be made that extremist hate sites aren't just as dangerous to kids as pornography is. We should try to have more consistency about stuff like this. Are we OK with content moderation or not?