3 ms·

No. I use adguardhome to act as a private DNS for my android devices. It's the best way to get both DNS for self hosted services AND DNS filtering to remove tra

No. I use adguardhome to act as a private DNS for my android devices. It's the best way to get both DNS for self hosted services AND DNS filtering to remove tracking and ads in all android apps.

somat 3y ago
Until the apps figure out dns over http. sigh
- gh02t 3y ago
  You can at least partially mitigate this by simply blocking the major DNS-over-https endpoints. There aren't that many. However, in my experience this really pisses off some devices e.g. Google/Nest Home speakers even if you have regular DNS working fine. You also of course won't catch the really nefarious devices phoning home over a custom non-public endpoint. It can be interesting just for logging purposes as well, that's what I do. https://jpgpi250.github.io/piholemanual/doc/Block%20DOH%20with%20pfsense.pdf https://jpgpi250.github.io/piholemanual/doc/Block%20DOH%20wi... really digs into the nitty gritty of how to do it to a crazy extent.
  - kube-system 3y ago
    I imagine that eventually we'll see content and DoH served from the same endpoint. Or ads proxied from the same location as the content.
    - gh02t 3y ago
      Yep, playing whack-a-mole trying to block it is a losing battle long term, but for now it kinda works. Serving content from the same endpoints is indeed the whole point because it makes it hard to block without collateral damage. Probably the only way to really block it is some kind of SSL unwrapping and deep packet inspection at the firewall but that's a HUGE hassle to deal with and is itself a potential privacy issue.
  - Mister_Snuggles 3y ago
    This really feels like a game of whack-a-mole. Personally, I think DoH was a mistake. Instead of the network admin configuring the name resolution services (via DHCP, for example) each app has a hard-coded list of IP addresses that it will use to resolve hostnames. Instead of a system resolver that does the job we now have a resolver, complete with hard-coded server configuration, baked into various applications/devices.

No. I use adguardhome to act as a private DNS for my android devices. It's the best way to get both DNS for self hosted services AND DNS filtering to remove tracking and ads in all android apps.

somat 3y ago

Until the apps figure out dns over http. sigh

gh02t 3y ago
You can at least partially mitigate this by simply blocking the major DNS-over-https endpoints. There aren't that many. However, in my experience this really pisses off some devices e.g. Google/Nest Home speakers even if you have regular DNS working fine. You also of course won't catch the really nefarious devices phoning home over a custom non-public endpoint. It can be interesting just for logging purposes as well, that's what I do. https://jpgpi250.github.io/piholemanual/doc/Block%20DOH%20with%20pfsense.pdf https://jpgpi250.github.io/piholemanual/doc/Block%20DOH%20wi... really digs into the nitty gritty of how to do it to a crazy extent.
- kube-system 3y ago
  I imagine that eventually we'll see content and DoH served from the same endpoint. Or ads proxied from the same location as the content.
  - gh02t 3y ago
    Yep, playing whack-a-mole trying to block it is a losing battle long term, but for now it kinda works. Serving content from the same endpoints is indeed the whole point because it makes it hard to block without collateral damage. Probably the only way to really block it is some kind of SSL unwrapping and deep packet inspection at the firewall but that's a HUGE hassle to deal with and is itself a potential privacy issue.
- Mister_Snuggles 3y ago
  This really feels like a game of whack-a-mole. Personally, I think DoH was a mistake. Instead of the network admin configuring the name resolution services (via DHCP, for example) each app has a hard-coded list of IP addresses that it will use to resolve hostnames. Instead of a system resolver that does the job we now have a resolver, complete with hard-coded server configuration, baked into various applications/devices.