6 ms·

A simpler solution: Deploy one Pi-Hole instance and then set clients to use Pi-Hole as the primary resolver and your ISP/router as the secondary. In the rare ci

by Narkov 3y ago

A simpler solution: Deploy one Pi-Hole instance and then set clients to use Pi-Hole as the primary resolver and your ISP/router as the secondary. In the rare circumstance that the Pi-Hole device is down, you fallback and get the "normal" ISP DNS service.

malfist 3y ago
That's exactly what I do. Never been concerned about downtime with my pihole, except the odd smart TV is something that won't using the secondary dns
g96alqdm0x 3y ago
The problem is that many devices instantly spill over to the secondary Pi-Hole. And rogue devices bypass the primary altogether once they begin to get blocked for a short period of time. Having a secondary without blocking nearly negates the benefit of having the primary pi-hole, for the devices that it matters for most.
- master_crab 3y ago
  This is why you need a port 53 ban on your network that blocks all traffic except to your piholes ips. Keeps rogue machines from reaching the internet for queries
josho 3y ago
I did that. Then saw that filtering was inconsistent. It turns out that some systems treat the DNS list as alternatives, not as primary and failover. The spec only says the dns IPs should be specified in preference order. Nothing says to treat it as primary and failover.
- geerlingguy 3y ago
  Yeah, far too many devices and apps seem to use DNS in a more round robin fashion. Too inconsistent for my liking.
- magicalhippo 3y ago
  Oh wow that might explain why my SO is sometimes filtered and sometimes not. I've got her on an exclusion list because she just cares about being able to click on Google ads also known as "search results". But I might not have added her on the backup Pihole now that I think of it...
karlshea 3y ago
Quite a few DNS clients don't make any distinction between "primary" and "secondary". You may enter them in order when configuring them but that has no bearing on which ends up being the server queries are sent to.
- nirav72 3y ago
  I found windows to be like this. It has no specific order on primary or secondary. However, occasionally it will latch on to one of them and continue sending several lookups to that one.
nunez 3y ago
def don't do this unless you want dns leaks all over the place. the pi-hole should be the only dns server in its networks. you can also use it as a dhcp server to work around ISP routers blocking DNS modification.
dheera 3y ago
Depends on what you're using it for. If you're trying to block privacy threats like SuperHuman pixels you don't want it to fall back to ISP.
mypastself 3y ago
Have you tried this for yourself? It’s an approach I assumed would work when I did my first setup, but since there’s really no such thing as primary and secondary (or tertiary) resolver, I quickly realized it did not work consistently on most devices.
- uselpa 3y ago
  I did, and according to the man page of /etc/resolv.conf the order is taken into account unless you specifically set the option not to. Which covers macOS, i(Pad)OS and Linux, and afaik also my Windows machine (I haven't checked the latter though).
theshrike79 3y ago
I did this and started to wonder why every web page opened reeaaallly slowly. Turns out the Pi-Hole Raspberry Pi had borked and wasn't answering at all, my computer was waiting for the primary DNS _every_time_ for multiple seconds before trying the secondary one. What it should've done (IMO) is query both and pick the fastest. Swapped to NextDNS and haven't looked back, I set it on my router and mobile devices once and that's it.
vladvasiliu 3y ago
AFAIK that won't work reliably with Windows. It will spray requests to all configured DNS servers and use whichever response comes back the quickest. If you can guarantee that the PiHole will always be fastest, it should be OK. But I'd be curious to see how you'd go about guaranteeing that.
whatsthatabout 3y ago
That will not work. The naming primary/secondary doesn't mean what you think with dns. You should always set only the primary or both the same.

by Narkov 3y ago

malfist 3y ago

That's exactly what I do. Never been concerned about downtime with my pihole, except the odd smart TV is something that won't using the secondary dns

g96alqdm0x 3y ago

The problem is that many devices instantly spill over to the secondary Pi-Hole. And rogue devices bypass the primary altogether once they begin to get blocked for a short period of time. Having a secondary without blocking nearly negates the benefit of having the primary pi-hole, for the devices that it matters for most.

master_crab 3y ago
This is why you need a port 53 ban on your network that blocks all traffic except to your piholes ips. Keeps rogue machines from reaching the internet for queries

josho 3y ago

I did that. Then saw that filtering was inconsistent. It turns out that some systems treat the DNS list as alternatives, not as primary and failover. The spec only says the dns IPs should be specified in preference order. Nothing says to treat it as primary and failover.

geerlingguy 3y ago
Yeah, far too many devices and apps seem to use DNS in a more round robin fashion. Too inconsistent for my liking.
magicalhippo 3y ago
Oh wow that might explain why my SO is sometimes filtered and sometimes not. I've got her on an exclusion list because she just cares about being able to click on Google ads also known as "search results". But I might not have added her on the backup Pihole now that I think of it...

karlshea 3y ago

Quite a few DNS clients don't make any distinction between "primary" and "secondary". You may enter them in order when configuring them but that has no bearing on which ends up being the server queries are sent to.

nirav72 3y ago
I found windows to be like this. It has no specific order on primary or secondary. However, occasionally it will latch on to one of them and continue sending several lookups to that one.

nunez 3y ago

def don't do this unless you want dns leaks all over the place. the pi-hole should be the only dns server in its networks. you can also use it as a dhcp server to work around ISP routers blocking DNS modification.

dheera 3y ago

Depends on what you're using it for. If you're trying to block privacy threats like SuperHuman pixels you don't want it to fall back to ISP.

mypastself 3y ago

Have you tried this for yourself? It’s an approach I assumed would work when I did my first setup, but since there’s really no such thing as primary and secondary (or tertiary) resolver, I quickly realized it did not work consistently on most devices.

uselpa 3y ago
I did, and according to the man page of /etc/resolv.conf the order is taken into account unless you specifically set the option not to. Which covers macOS, i(Pad)OS and Linux, and afaik also my Windows machine (I haven't checked the latter though).

theshrike79 3y ago

I did this and started to wonder why every web page opened reeaaallly slowly. Turns out the Pi-Hole Raspberry Pi had borked and wasn't answering at all, my computer was waiting for the primary DNS _every_time_ for multiple seconds before trying the secondary one. What it should've done (IMO) is query both and pick the fastest. Swapped to NextDNS and haven't looked back, I set it on my router and mobile devices once and that's it.

vladvasiliu 3y ago

AFAIK that won't work reliably with Windows. It will spray requests to all configured DNS servers and use whichever response comes back the quickest. If you can guarantee that the PiHole will always be fastest, it should be OK. But I'd be curious to see how you'd go about guaranteeing that.

whatsthatabout 3y ago

That will not work. The naming primary/secondary doesn't mean what you think with dns. You should always set only the primary or both the same.