3 ms·
I think you can configure PiHole to return whatever IP you want for blocklisted domains. I guess you could set up a box with nginx that inspects the request con
by leesalminen 4y ago
I think you can configure PiHole to return whatever IP you want for blocklisted domains. I guess you could set up a box with nginx that inspects the request content type header and returns generic content. But, TLS will cause problems here. You’d need to MITM all the traffic and serve up your own root certs, install them on devices etc.
- kobalsky 4y agoyou could just -j REJECT the traffic, that makes the connection fail immediately because it sends an icmp port-unreachable packet back.
- phillipseamore 4y agoYeah TLS will be the headache. Just did a quick test with a self-signed, that works fine but I'll need to create one for each TLD (wildcard doesn't seem to be allowed as root, at least in browsers). That's easy to script, hard to install. So the only issue are devices that I can't install certs on like our Apple TV's and Rokus.
- 3np 4y agoYou should be able to install a single CA (installed on devices) and then use the key for that to sign individual domain (wildcard) certs?