4 ms·
In case you’re like a lot of folks in HN, read the title, and say to yourself “already have one”, read TFA for the iptables config that fixes those apps and dev
by mikestew 1y ago
In case you’re like a lot of folks in HN, read the title, and say to yourself “already have one”, read TFA for the iptables config that fixes those apps and devices that bypass local DNS. For example, the New York Times app seems to now use its own hard-coded DNS servers. Without having tried it, it looks like TFA has the fix for that.
EDIT: replies indicate that I, a person who is barely competent at many network tasks, might be off-base on this one. Grain of salt, and all.
- ignoramous 1y ago> For example, the New York Times app seems to now use its own hard-coded DNS servers. Without having tried it, it looks like TFA has the fix for that. Those commands in TFA simply reroute traffic on port 53 to Pi-Hole, which isn't enough to prevent apps from doing their own name resolution. For instance, the Telegram app has built-in DNS-over-HTTPS, which those iptables chains could do nothing about.
- shaky-carrousel 1y agoYou can block known DoH servers.
- elashri 1y agoAn increasing number of them also rely on hard coded DoH servers which is harder to block/redirect. You will need to will Pi-Hole/Adguard Home on router to block them based on some curtailed lists (i.e [1]) [1] https://github.com/dibdot/DoH-IP-blocklists https://github.com/dibdot/DoH-IP-blocklists
- rsync 1y agoIn this arms race you are saying a current "move" is a curated list of IPs that correspond to known DoH servers ... and that's fine .. However, if the adversary decides to just query - and answer - DoH requests on the same hostname that you are trying to talk to ... isn't that a winning move ? For instance: If one had an application - or an appliance - that spoke https to endpoint.samsung.com, how would one block DoH requests addressed to the same endpoint.samsung.com ?
- baby_souffle 1y agoThat might work but if your Samsung example is behind cloudflare, you're basically going to have to block any and all access to cloudflare's Network. And if telemetry.example-iot.com belongs to an AWS IP, it could change to another IP in their space at any time so your only recourse would be to limit connectivity to all of AWS which would effectively prevent you from accessing most things on the internet
- pimeys 1y agoI run Zenarmor in addition to Adguard at home, which can detect DoH traffic and intercept it. You have to pay for this enterprise level tool, but if you are worried about DoH, Zenarmor is so far the easiest tool to block it. In our house the only device that tries to use DoH is my partner's iPhone. It tries a few times, fails, then uses the Adguard DNS, which blocks the trackers.
- illiac786 1y agoDo you have documentation of this? My understanding was always that Zenarmor simply maintains a list of known DoH servers.
- toast0 1y agoIf you're really serious about DNS interception, you'd setup something where a) you stop accepting A lookups, because it's 2025 and IPv4 only is dead (let's pretend anyway) b) for each AAAA lookup, return a new IPv6 address that you'll NAT to the real address (you can use this for NAT64 if you want to let clients connect to IPv4 hosts). Then only let clients connect to these IPv6 addresses you setup. If someone smuggles address resolution through, outside of DNS, their clients can't connect. (this is going to be a big PITA, but that's how these things go)
- dullcrisp 1y agoI guess at that point they’d have to establish a tunnel and route ads through the same HTTPS connection as legitimate traffic.
- jeroenhd 1y agoAnd before DoH was a thing, several Chinese apps I've used also used to do plain HTTP for DNS resolution (I only caught them by chanbecause they were doing HTTP). PiHoles only work for apps that stick to the standards and don't mind being caught.
- TacticalCoder 1y agoBrowsers allows corporations to prevent DoH and force DNS through company-owned DNS servers: https://support.mozilla.org/en-US/kb/dns-over-https https://support.mozilla.org/en-US/kb/dns-over-https I use these settings on all my browsers to prevent DoH and make sure traffic goes through my Pi (I run unbound directly on the Pi though, not Pi-Hole: in my experience unbound is a bit harder to set up initially but it's also more powerful than Pi-Hole... For example unbound accepts wildcards in blocklists). It's not incompatible with also blocking, at the firewall level, all known DoH servers of course. Nor is it incompatible with forcing your router to also use your Pi as a DNS.
- silverwind 1y agoApps that open arbritrary UDP/TCP ports? Isn't that something the app store policies should reject?
- epcoa 1y agoWhat is an arbitrary TCP port? Ports in isolation from an IP address aren't inherently arbitrary, they're nothing, and the IP:port pair is arbitrary. Once you allow connections to any host on the internet the port doesn't really matter - you can do whatever nefarious shit over port 80. And not allowing apps to connect to external internet servers seems pretty limiting.
- 01HNNWZ0MV43FF 1y agoThey're not opening listening ports on the local system, they're just ignoring the system's DNS and saying "Take me to this IP and this port" and then doing a DNS lookup themselves
- wang_li 1y ago> read TFA for the iptables config that fixes those apps and devices that bypass local DNS. For example, Don't worry. All the browsers and stuff are bypassing this level of control by moving to DNS-over-HTTPS. You'll either have to deploy a TLS terminating proxy on your network, or give up on this arms race.
- notarealllama 1y agoJokes on you, I do have a fortinet which does this.... Oh wait, only up to TLS 1.1 or something and it's slow. I forgot the name of the software but there used to be a few tools to terminate and reencrypt. But yeah dnssec is it's own challenge
- gbuk2013 1y agoYou need to get an F5 box instead. :)
- gbuk2013 1y agoTo be fair, if you are geeky enough to run a PiHole you will have no trouble finding the config option to turn off DoH in your browser.
- freedomben 1y agoTrue, but I want all the devices on my home network to have DoH disabled too. Most of them I can't change directly.
- int0x29 1y agoDon't turn it off in your browser. If you have control of that setting just install an ad blocker. The point of DNS block lists is to get rid of ads on phones, TVs, and other non configurable things.
- woleium 1y agoAnd then there is amazon sidewalk, which can only be evaded by unplugging the wifi board on your tv
- iugtmkbdfil834 1y agoI was going to say, as a person who used pihole pretty extensively at one point, it may not be enough anymore. I am by no means a network expert, but I do recognize those shortcomings and try to compensate for them. Blanket pihole recommendation may be disservice at this point.
- bongodongobob 1y agoNo, that's not a fix and those iptables settings are on the router. It will only catch DNS requests on port 53. Doesn't catch DoH which you can't do on a router, you need a firewall for that.
- tenacious_tuna 1y agoAlso, doesn't that break the network if the pihole is offline? Before I'd just override DNS on my workstation, but that iptables config would block any "unsanctioned" DNS traffic
- bongodongobob 1y agoIt would, yes
- RachelF 1y agoI've seen Windows 11 ignoring DNS settings too, for Microsoft telemetry, ads and updates.