4 ms·

> It's also not possible (or not clear) how to have different behavior for different clients There's a menu item for that: Clients. You create a group, add a

> It's also not possible (or not clear) how to have different behavior for different clients There's a menu item for that: Clients. You create a group, add a client to that group, and configure blocking for that group. To have what you want, you create a group that has just one client in it.

paxys 2y ago
It's slightly more complicated. What you are suggesting works if (1) you are using Pi-hole as a DHCP server or (2) all your devices are individually configured to use the Pi-hole IP address for DNS resolution. What's more likely though is that you just point your router's DNS setting to Pi-hole, and in that case there is only one client on the Pi-hole dashboard - your router.
- jimsmart 2y ago
  > What's more likely though is that you just point your router's DNS setting to Pi-hole, and in that case there is only one client on the Pi-hole dashboard - your router. That depends entirely on what capabilities your router has. Many routers have a setting for the DNS info they give to clients via DHCP, which would mean every client is indeed using PiHole directly for DNS resolution. Other less capable routers, only have a setting for which upstream DNS server(s) the router should use, which of course isn't going to allow you to do anything with PiHole's group stuff. But an easy solution is simply to disable the DHCP server on the router, and simply use what is built-in to PiHole. It uses dnsmasq behind the scenes, and as DHCP servers go, it's pretty capable and configurable. This is how I use PiHole on my own network, and have done for years now (with some customised dnsmasq config, because I have strong preferences about my network setup and services). Most routers do nothing particularly special regarding DHCP anyhow, so no big deal to just turn it off, and use PiHole's stuff. FWIW, and tangent to these specific points, my upgrade to the new PiHole 6 earlier today was pretty smooth — with the exception of it defaulting to having its dashboard on port 8080 instead of my previous 80. Plus I had to tweak a couple of settings to ensure it loads my custom dnsmasq config. But no deal breakers at all.
  - master_crab 2y ago
    And if your gateway device is configurable enough you can ban or redirect port 53 requests (DNS) to whatever machine you would like to use to serve up resolution.
    - zaudo 2y ago
      This is exactly what I do with my Unifi router, but still all I see in Pi-hole is the router making the DNS requests.
      - InvertedRhodium 2y ago
        Are you NATing the redirection to the pi hole server? If so, disabling it should let pihole see unique clients.
      - bdavbdav 2y ago
        I think you’ve set the WAN dns to the PiHole. You need to set the DNS in networks.
    - jimsmart 2y ago
      That's kinda janky really. DNS doesn't have redirection like HTTP has, so what you describe can only be implemented using port forwarding (or SSH tunnelling, but I've never seen a router with the ability to tunnel DNS in this fashion?). Port forwarding used like this, won't enable one to use the 'groups' functionality on PiHole — which was the (g)parent thread here — because all requests arriving at the PiHole will come from the same client, i.e. the router. Because port forwarding is more like a proxy than a redirect (to use HTTP terms). The correct solution here if one wishes to use PiHole's groups — and not have a janky network configuration like you describe here (an extra unnecessary hop for local DNS) — is to either (a) use the router's DHCP settings to tell the clients to use the PiHole IP for their DNS, or (b) disable the router's DHCP and simply use the DHCP that PiHole provides, which is at least as good as what most routers provide (and more configurable than most routers also, should one need to)
      - 2y ago
- MyOutfitIsVague 2y ago
  It works for me and I don't use Pi-Hole as a DHCP server or have any of my devices individually configured. I have my router acting as a DHCP server and have it tell clients to use my Pi-hole for DNS. Some routers' default firmwares don't let you do this, but most OpenWRT and Tomato and the like should.
  - sunshine-o 2y ago
    I haven't tried Pi-Hole yet but is there a package for OpenWrt which could offer functionalities equivalent to Pi-Hole? I already run OpenWrt on x86 hardware so I have plenty of RAM and disk.
    - dmsayer 2y ago
      [dead]
    - 31337Logic 2y ago
      Yes. It's called adblock and it's rock solid. I also run mine on an x86. Just set and forget.
- bolster8505 2y ago
  Using clients and groups works fine for me. I'm able to block youtube on my kids' devices, but allow it on others. I have pihole running in a container without being my dhcp server.
  - bilalel 2y ago
    Do you mind sharing your blocklist for youtube? It has been a challenging one so far.
    - 10729287 2y ago
      Not OP but we can assume when he's talking about blocking Youtube, he's in fact blocking youtube for his kids, not Youtube ads. Pi-hole can't block Youtube ads as they are delivered by the same servers as content. Then you can't block one without blocking the other.
      - bilalel 2y ago
        My comment wasn't clear. I was indeed referring to blocking youtube completely, not just ads on youtube.
        jimsmart 2y ago
        Just go to PiHole's "Domains" page, in the box labelled Domain, type youtube.com, enable the checkbox for Add domain as wildcard, then click the button labelled Add to denied domains. Now youtube.com and all of its subdomains are blocked, for all clients. If you wish for it to only be blocked for some clients, then assign your clients to groups, and set the setting appropriately on the domains page.
        bolster8505 2y ago
        The best way is to open up the Query Log, open up the site you want to block, and deny from there, making regex blocks are appropriate.
- sneak 2y ago
  Not all routers proxy DNS; many have DHCP settings so you can give the pi-hole’s address as DNS server to clients via DHCP. I imagine this is how it’s usually done. There’s no reason to double proxy.
- mikestorrent 2y ago
  The better option is to configure DHCP to hand out the Pi-hole as your DNS server. If your router cannot do that, but you want to go deep enough to configure your home network with a Pi-hole, you should probably also invest in either a better router or OpenWRT on your current one to get a few more features. Ideally, you do not run DNS on your router at all, and you also block outbound to 0.0.0.0:53 from anything _except_ the Pi-hole, so that there's no convenient way to get to an unblocked DNS by bypassing it. DNS-over-HTTP is a bit harder to block, and of course malware could have an IP baked in and so bypass this entirely.
- doron 2y ago
  That's my only gripe with the current pi-hole; there is no easy way to configure DHCP options.
aulin 2y ago
I use pihole for dhcp and it's extremely easy with dnsmasq. Hope their settings overhaul does not break this. dhcp-option=tag:nospam,option:dns-server,x.x.x.x dhcp-option=tag:spam,option:dns-server,y.y.y.y dhcp-host=client1...,set:nospam dhcp-host=client2...,set:spam
- jimsmart 2y ago
  Previously, PiHole used /etc/dnsmasq.d/ with best practice being to put one's own additional config, or overrides, in separate file(s) in that folder. PiHole v6 appears to have most of that config built-in, and upgrading to v6 removes all of the previous standard config files, leaving only user-created / user-edited files in /etc/dnsmasq.d/ - and PiHole v6 by default no longer imports anything from this folder (to prevent possible incompatibilities). But it's just a setting, and toggling it brings back the original functionality of importing config from files in that folder. And for me, my custom dnsmasq config worked just the same as it previously did.

paxys 2y ago

It's slightly more complicated. What you are suggesting works if (1) you are using Pi-hole as a DHCP server or (2) all your devices are individually configured to use the Pi-hole IP address for DNS resolution. What's more likely though is that you just point your router's DNS setting to Pi-hole, and in that case there is only one client on the Pi-hole dashboard - your router.

jimsmart 2y ago
> What's more likely though is that you just point your router's DNS setting to Pi-hole, and in that case there is only one client on the Pi-hole dashboard - your router. That depends entirely on what capabilities your router has. Many routers have a setting for the DNS info they give to clients via DHCP, which would mean every client is indeed using PiHole directly for DNS resolution. Other less capable routers, only have a setting for which upstream DNS server(s) the router should use, which of course isn't going to allow you to do anything with PiHole's group stuff. But an easy solution is simply to disable the DHCP server on the router, and simply use what is built-in to PiHole. It uses dnsmasq behind the scenes, and as DHCP servers go, it's pretty capable and configurable. This is how I use PiHole on my own network, and have done for years now (with some customised dnsmasq config, because I have strong preferences about my network setup and services). Most routers do nothing particularly special regarding DHCP anyhow, so no big deal to just turn it off, and use PiHole's stuff. FWIW, and tangent to these specific points, my upgrade to the new PiHole 6 earlier today was pretty smooth — with the exception of it defaulting to having its dashboard on port 8080 instead of my previous 80. Plus I had to tweak a couple of settings to ensure it loads my custom dnsmasq config. But no deal breakers at all.
- master_crab 2y ago
  And if your gateway device is configurable enough you can ban or redirect port 53 requests (DNS) to whatever machine you would like to use to serve up resolution.
  - zaudo 2y ago
    This is exactly what I do with my Unifi router, but still all I see in Pi-hole is the router making the DNS requests.
    - InvertedRhodium 2y ago
      Are you NATing the redirection to the pi hole server? If so, disabling it should let pihole see unique clients.
    - bdavbdav 2y ago
      I think you’ve set the WAN dns to the PiHole. You need to set the DNS in networks.
  - jimsmart 2y ago
    That's kinda janky really. DNS doesn't have redirection like HTTP has, so what you describe can only be implemented using port forwarding (or SSH tunnelling, but I've never seen a router with the ability to tunnel DNS in this fashion?). Port forwarding used like this, won't enable one to use the 'groups' functionality on PiHole — which was the (g)parent thread here — because all requests arriving at the PiHole will come from the same client, i.e. the router. Because port forwarding is more like a proxy than a redirect (to use HTTP terms). The correct solution here if one wishes to use PiHole's groups — and not have a janky network configuration like you describe here (an extra unnecessary hop for local DNS) — is to either (a) use the router's DHCP settings to tell the clients to use the PiHole IP for their DNS, or (b) disable the router's DHCP and simply use the DHCP that PiHole provides, which is at least as good as what most routers provide (and more configurable than most routers also, should one need to)
    - 2y ago
MyOutfitIsVague 2y ago
It works for me and I don't use Pi-Hole as a DHCP server or have any of my devices individually configured. I have my router acting as a DHCP server and have it tell clients to use my Pi-hole for DNS. Some routers' default firmwares don't let you do this, but most OpenWRT and Tomato and the like should.
- sunshine-o 2y ago
  I haven't tried Pi-Hole yet but is there a package for OpenWrt which could offer functionalities equivalent to Pi-Hole? I already run OpenWrt on x86 hardware so I have plenty of RAM and disk.
  - dmsayer 2y ago
    [dead]
  - 31337Logic 2y ago
    Yes. It's called adblock and it's rock solid. I also run mine on an x86. Just set and forget.
bolster8505 2y ago
Using clients and groups works fine for me. I'm able to block youtube on my kids' devices, but allow it on others. I have pihole running in a container without being my dhcp server.
- bilalel 2y ago
  Do you mind sharing your blocklist for youtube? It has been a challenging one so far.
  - 10729287 2y ago
    Not OP but we can assume when he's talking about blocking Youtube, he's in fact blocking youtube for his kids, not Youtube ads. Pi-hole can't block Youtube ads as they are delivered by the same servers as content. Then you can't block one without blocking the other.
    - bilalel 2y ago
      My comment wasn't clear. I was indeed referring to blocking youtube completely, not just ads on youtube.
      - jimsmart 2y ago
        Just go to PiHole's "Domains" page, in the box labelled Domain, type youtube.com, enable the checkbox for Add domain as wildcard, then click the button labelled Add to denied domains. Now youtube.com and all of its subdomains are blocked, for all clients. If you wish for it to only be blocked for some clients, then assign your clients to groups, and set the setting appropriately on the domains page.
        bolster8505 2y ago
        The best way is to open up the Query Log, open up the site you want to block, and deny from there, making regex blocks are appropriate.
sneak 2y ago
Not all routers proxy DNS; many have DHCP settings so you can give the pi-hole’s address as DNS server to clients via DHCP. I imagine this is how it’s usually done. There’s no reason to double proxy.
mikestorrent 2y ago
The better option is to configure DHCP to hand out the Pi-hole as your DNS server. If your router cannot do that, but you want to go deep enough to configure your home network with a Pi-hole, you should probably also invest in either a better router or OpenWRT on your current one to get a few more features. Ideally, you do not run DNS on your router at all, and you also block outbound to 0.0.0.0:53 from anything _except_ the Pi-hole, so that there's no convenient way to get to an unblocked DNS by bypassing it. DNS-over-HTTP is a bit harder to block, and of course malware could have an IP baked in and so bypass this entirely.
doron 2y ago
That's my only gripe with the current pi-hole; there is no easy way to configure DHCP options.

aulin 2y ago

I use pihole for dhcp and it's extremely easy with dnsmasq. Hope their settings overhaul does not break this. dhcp-option=tag:nospam,option:dns-server,x.x.x.x dhcp-option=tag:spam,option:dns-server,y.y.y.y dhcp-host=client1...,set:nospam dhcp-host=client2...,set:spam

jimsmart 2y ago
Previously, PiHole used /etc/dnsmasq.d/ with best practice being to put one's own additional config, or overrides, in separate file(s) in that folder. PiHole v6 appears to have most of that config built-in, and upgrading to v6 removes all of the previous standard config files, leaving only user-created / user-edited files in /etc/dnsmasq.d/ - and PiHole v6 by default no longer imports anything from this folder (to prevent possible incompatibilities). But it's just a setting, and toggling it brings back the original functionality of importing config from files in that folder. And for me, my custom dnsmasq config worked just the same as it previously did.