12 ms·

I used a Pi-Hole for all devices in my house, including my work MacBook. They manage their MacBooks with JamF, so most things are pretty locked down (including

I used a Pi-Hole for all devices in my house, including my work MacBook. They manage their MacBooks with JamF, so most things are pretty locked down (including DNS settings in System Preferences). Sudo access is only possible if you open up the Self Service app, login, and issue yourself sudo/admin access for 6 hours. Once it expires, you have to issue yourself admin/sudo access again. No sudo = no changing DNS. I set it and forgot it, until I went to Estes Park, Colorado over the Christmas holidays one year. I travelled with my MacBook just in case anything popped off... and it did. I logged into my MacBook, but quickly realised although I could connect to WiFi as normal, no DNS would resolve (it was pointed to 192.168.1.100 of my home network), and I couldn't connect to anything - including logging in the Self Service app to re-issue sudo access, to change the DNS. I had to walk a new colleague how to handle the scandal over the phone, driving through the mountains... thank goodness for good cell service!

feet 4y ago
You could set up a VPN for cases like that. Just VPN into your home network to have all your usual services and dns
- yabones 4y ago
  Wouldn't help here, since most people have to use DDNS to connect back home since residential IPs change constantly. And with no DNS resolver, no DDNS lookup, no phone home. Best way to handle it is to just reconfigure your router to hand out the pihole dns server to all the clients on your network. That way it's automatic when at home, and doesn't override anything when you're away.
  - HelenePhisher 4y ago
    You could just use Tailscale.
  - robby_w_g 4y ago
    I think tailscale could handle this problem pretty well: https://tailscale.com/kb/1114/pi-hole/ https://tailscale.com/kb/1114/pi-hole/ You can configure the default DNS for devices when they connect to tailscale. This way, pi hole is opt in for users who want to set up tailscale. Disclaimer: I haven't tried this myself since I have Mullvad ad blocking setup and I'm lazy
  - feet 4y ago
    My method is to set up wireguard from my home network to a cheap VPS. I can then VPN into that VPS and get into my home network since the VPS has a static IP But as others mention tailscale also works
  - dspillett 4y ago
    Another option is to make your pi-hole semi-public, so you can see it what-ever network you are on. You don't want the world and his dog's flees using your DNS resolver though, so you'd have to arrange some for of port-knocking or other authentication solution to temporarily open up the relevant ports to you (or at least just the network local to you) and not everyone. Another hack to consider is running pi-hole in a VM or container on the laptop itself, and have it act as a filtering cache for a more public resolver. Though this imparts an administrative load, you no longer have a single pi-hole so either need to configure it separately or arrange for it to be able to sync with config on your main instance. Both these arrangements will have trouble if you find yourself on a network that blocks DNS requests to anything other than its local resolvers (though for the pi-hole-on-laptop you can always reconfigure pi-hole to look at the local resolvers if/when needed), so the VPN option is better where available. If you have no static IP at your base of operations, there is always the option of a cheap VPS somewhere to be the VPN endpoint – essentially my first paragraph but your “port knocking” is connecting to the VPN, with pi-hole either on that machine or a machine also connected to the same VPN to get around its lack of fixed public address. Though back to the adversarial local network problem: if the network blocks DNS queries to non-local resolvers it is not unlikely to try block VPNs too.
mig39 4y ago
The trick is to have the pi-hole in your home network, and have your router's DHCP server give it out as the DNS server. That way when you're home, you get the pi-hole, but when on the road, you get whatever DNS is given for the network you're connected to.
- sneak 4y ago
  Then you lose all your blocking/filtering when you're least equipped to deal with the noise. I use NextDNS via DoH which a) works the same everywhere and b) encrypts the DNS traffic out of the machine.
  - twodave 4y ago
    This is why I have my rpi4 set up as 1) a Pi-hole, 2) Wireguard VPN host and 3) DHCP DNS server on on my home network. That as long as I am connected to the VPN from my phone I get no ads. If there's any kind of network issue at my house I can just disable the VPN on my phone. This also has a side benefit that I can use my phone's wi-fi hotspot to remote into my work machine at home as needed.
- msravi 4y ago
  The best config I've found is to have the pihole use NextDNS as its upstream server and have the DHCP server on the router hand out the pihole's ip as the DNS server. Have tailscale set up on the pihole as a subnet router so it gives you access to your home network on the move. Then have your tailscale dns point to the tailscale ip of your pihole. All machines on your local net now use the pihole as dns as handed out by the router, and when you roam tailscale routes your dns to your pihole. If you're travelling overseas though, it makes sense to reconfigure tailscale to use NextDNS directly so its faster.
  - shepherdjerred 4y ago
    Why have pihole at all if you have NextDNS?
    - 4y ago
mycentstoo 4y ago
Have you tried adding yourself to the Sudoers file? My work didn’t see that workaround and now I always have sudo permissions.
- chasd00 4y ago
  hate to be "that guy" but you may want to look into the employee consequences of knowingly circumventing the intent of a security control.
gangstead 4y ago
That's why I ultimately stopped using my pi-hole. It works great most of the time, but there are enough exceptions that other users on my network (wife and kids) weren't able to address. I now use the adguard public DNS service and am quick to toggle it off when connecting to other networks when out and about.
yjftsjthsd-h 4y ago
Wait, your work laptop only lets you perform administrative tasks on the local machine if it can connect over the internet to corporate, and that includes being unable to modify certain network settings without first having a working network uplink? That sounds like something that was always guaranteed to break in an awkward way, not a particular problem with the DNS server that you happened to be using that day.
- kingsloi 4y ago
  Yeah exactly! Just once (every x hours) but always required for anything sudo, and it's really buggy, too. Restarting stuff, installing some stuff with brew sucks especially, even updating some apps all require sudo. I've resulted to stack the prompts in my lower right corner until I have to do to
zrail 4y ago
I treat my work laptop as a hostile entity on my network. It connects to a dedicated Wi-Fi network with client isolation enabled and on a dedicated VLAN with no access to other VLANs, just egress to the internet. DHCP serves 8.8.8.8 as DNS. On the trusted VLAN I use Technitium as DNS and DHCP. I don't use any block lists, though, because I had too many complains from other network users. Technitium is mostly just because it's easy to manage DHCP hostnames and other DNS records in the same UI.
- artificialLimbs 4y ago
  How do you move files over from work laptop if you want to keep something on homenet?
  - lolinder 4y ago
    My bet would be that if they're quarantining their work device, they also don't use it for anything other than work, and don't use any other device for work. If that's the case this would never come up.
    - zrail 4y ago
      Yep, this. No personal stuff on work laptop, with the sole exception of my Spotify login. No work stuff on personal machines other than my payroll login. Files don't leave my work laptop. If I need to get files into my work laptop (very rarely, usually slack emojis) I email them to my work account or share a Google Drive folder with my work account. These methods are traceable and auditable for my company and, importantly, don't open any of my personal accounts to legal discovery from the company's side as far as I can tell.
      - kingsloi 4y ago
        how about Hacker News?
        doubled112 4y ago
tristor 4y ago
This is why I recommend folks instead use NextDNS and a DoH resolver proxy on their edge device. Plus Pis have poor resilience to power issues which are commonplace. Using NextDNS you are getting the same capability served by a global anycasted network of resolvers and it can work even on your phone while away from home (because the mobile web is even more gross).
- runjake 4y ago
  I love, use, and subscribe to NextDNS, but round trip times from my house to their nearest Anycast address are large enough to notice a substantial difference loading webpages, over using a local caching DNS server (or 8.8.8.8 Anycast, for that matter).
  - tristor 4y ago
    Yes, that is true. They don’t have as many PoPs as Google and CloudFlare do. Thus is why I use a local caching resolver in front of it. If you use Firefox on desktop and configure it to use DoH it also internally caches which greatly helps performance. The benefits outweigh the downsides, and at least in North America the performance is good.
manibatra 4y ago
To solve this exact problem PI-Hole is setup as the DNS server on my home router. Hence when out and about the DNS is not bound to Pi-Hole. When I am out I use Tailscale to tunnel my DNS queries to Pi-Hole at my home. Easy and reliable ad blocking on the go.

feet 4y ago

You could set up a VPN for cases like that. Just VPN into your home network to have all your usual services and dns

yabones 4y ago
Wouldn't help here, since most people have to use DDNS to connect back home since residential IPs change constantly. And with no DNS resolver, no DDNS lookup, no phone home. Best way to handle it is to just reconfigure your router to hand out the pihole dns server to all the clients on your network. That way it's automatic when at home, and doesn't override anything when you're away.
- HelenePhisher 4y ago
  You could just use Tailscale.
- robby_w_g 4y ago
  I think tailscale could handle this problem pretty well: https://tailscale.com/kb/1114/pi-hole/ https://tailscale.com/kb/1114/pi-hole/ You can configure the default DNS for devices when they connect to tailscale. This way, pi hole is opt in for users who want to set up tailscale. Disclaimer: I haven't tried this myself since I have Mullvad ad blocking setup and I'm lazy
- feet 4y ago
  My method is to set up wireguard from my home network to a cheap VPS. I can then VPN into that VPS and get into my home network since the VPS has a static IP But as others mention tailscale also works
- dspillett 4y ago
  Another option is to make your pi-hole semi-public, so you can see it what-ever network you are on. You don't want the world and his dog's flees using your DNS resolver though, so you'd have to arrange some for of port-knocking or other authentication solution to temporarily open up the relevant ports to you (or at least just the network local to you) and not everyone. Another hack to consider is running pi-hole in a VM or container on the laptop itself, and have it act as a filtering cache for a more public resolver. Though this imparts an administrative load, you no longer have a single pi-hole so either need to configure it separately or arrange for it to be able to sync with config on your main instance. Both these arrangements will have trouble if you find yourself on a network that blocks DNS requests to anything other than its local resolvers (though for the pi-hole-on-laptop you can always reconfigure pi-hole to look at the local resolvers if/when needed), so the VPN option is better where available. If you have no static IP at your base of operations, there is always the option of a cheap VPS somewhere to be the VPN endpoint – essentially my first paragraph but your “port knocking” is connecting to the VPN, with pi-hole either on that machine or a machine also connected to the same VPN to get around its lack of fixed public address. Though back to the adversarial local network problem: if the network blocks DNS queries to non-local resolvers it is not unlikely to try block VPNs too.

mig39 4y ago

The trick is to have the pi-hole in your home network, and have your router's DHCP server give it out as the DNS server. That way when you're home, you get the pi-hole, but when on the road, you get whatever DNS is given for the network you're connected to.

sneak 4y ago
Then you lose all your blocking/filtering when you're least equipped to deal with the noise. I use NextDNS via DoH which a) works the same everywhere and b) encrypts the DNS traffic out of the machine.
- twodave 4y ago
  This is why I have my rpi4 set up as 1) a Pi-hole, 2) Wireguard VPN host and 3) DHCP DNS server on on my home network. That as long as I am connected to the VPN from my phone I get no ads. If there's any kind of network issue at my house I can just disable the VPN on my phone. This also has a side benefit that I can use my phone's wi-fi hotspot to remote into my work machine at home as needed.
msravi 4y ago
The best config I've found is to have the pihole use NextDNS as its upstream server and have the DHCP server on the router hand out the pihole's ip as the DNS server. Have tailscale set up on the pihole as a subnet router so it gives you access to your home network on the move. Then have your tailscale dns point to the tailscale ip of your pihole. All machines on your local net now use the pihole as dns as handed out by the router, and when you roam tailscale routes your dns to your pihole. If you're travelling overseas though, it makes sense to reconfigure tailscale to use NextDNS directly so its faster.
- shepherdjerred 4y ago
  Why have pihole at all if you have NextDNS?
  - 4y ago

mycentstoo 4y ago

Have you tried adding yourself to the Sudoers file? My work didn’t see that workaround and now I always have sudo permissions.

chasd00 4y ago
hate to be "that guy" but you may want to look into the employee consequences of knowingly circumventing the intent of a security control.

gangstead 4y ago

That's why I ultimately stopped using my pi-hole. It works great most of the time, but there are enough exceptions that other users on my network (wife and kids) weren't able to address. I now use the adguard public DNS service and am quick to toggle it off when connecting to other networks when out and about.

yjftsjthsd-h 4y ago

Wait, your work laptop only lets you perform administrative tasks on the local machine if it can connect over the internet to corporate, and that includes being unable to modify certain network settings without first having a working network uplink? That sounds like something that was always guaranteed to break in an awkward way, not a particular problem with the DNS server that you happened to be using that day.

kingsloi 4y ago
Yeah exactly! Just once (every x hours) but always required for anything sudo, and it's really buggy, too. Restarting stuff, installing some stuff with brew sucks especially, even updating some apps all require sudo. I've resulted to stack the prompts in my lower right corner until I have to do to

zrail 4y ago

I treat my work laptop as a hostile entity on my network. It connects to a dedicated Wi-Fi network with client isolation enabled and on a dedicated VLAN with no access to other VLANs, just egress to the internet. DHCP serves 8.8.8.8 as DNS. On the trusted VLAN I use Technitium as DNS and DHCP. I don't use any block lists, though, because I had too many complains from other network users. Technitium is mostly just because it's easy to manage DHCP hostnames and other DNS records in the same UI.

artificialLimbs 4y ago
How do you move files over from work laptop if you want to keep something on homenet?
- lolinder 4y ago
  My bet would be that if they're quarantining their work device, they also don't use it for anything other than work, and don't use any other device for work. If that's the case this would never come up.
  - zrail 4y ago
    Yep, this. No personal stuff on work laptop, with the sole exception of my Spotify login. No work stuff on personal machines other than my payroll login. Files don't leave my work laptop. If I need to get files into my work laptop (very rarely, usually slack emojis) I email them to my work account or share a Google Drive folder with my work account. These methods are traceable and auditable for my company and, importantly, don't open any of my personal accounts to legal discovery from the company's side as far as I can tell.
    - kingsloi 4y ago
      how about Hacker News?
      - doubled112 4y ago

tristor 4y ago

This is why I recommend folks instead use NextDNS and a DoH resolver proxy on their edge device. Plus Pis have poor resilience to power issues which are commonplace. Using NextDNS you are getting the same capability served by a global anycasted network of resolvers and it can work even on your phone while away from home (because the mobile web is even more gross).

runjake 4y ago
I love, use, and subscribe to NextDNS, but round trip times from my house to their nearest Anycast address are large enough to notice a substantial difference loading webpages, over using a local caching DNS server (or 8.8.8.8 Anycast, for that matter).
- tristor 4y ago
  Yes, that is true. They don’t have as many PoPs as Google and CloudFlare do. Thus is why I use a local caching resolver in front of it. If you use Firefox on desktop and configure it to use DoH it also internally caches which greatly helps performance. The benefits outweigh the downsides, and at least in North America the performance is good.

manibatra 4y ago

To solve this exact problem PI-Hole is setup as the DNS server on my home router. Hence when out and about the DNS is not bound to Pi-Hole. When I am out I use Tailscale to tunnel my DNS queries to Pi-Hole at my home. Easy and reliable ad blocking on the go.