4 ms·

I run PiHole for years in my home network, I cannot live without it. With the years, I have made small changes to increase my control over it. I have a recursi

I run PiHole for years in my home network, I cannot live without it. With the years, I have made small changes to increase my control over it. I have a recursive DNS setup, PiHole filters everything, and what is left is processed locally via Unbound which in turn, contacts the 13 root nameservers for DNS resolution. I don't use any third party DNS. Add PiHole/Unbound caching capabilities, surfing on the internet is bloody fast. Now, they alone cannot block everything like smartTV with hardcoded DNS, DNS-Over-TLS, DNS-Over-HTTPS, etc. That is where OPNSense comes to play... I have firewall rules in place that nobody but PiHoles can request name resolution. My Samsung smarTV trying to use Google DNS?? Blocked, PiHole takes over. Devices trying to use DoT or DoH??? Blocked, PiHoles take over. You can create dynamic firewall rule with OPNSense so it will only block 443 and 853 if the host match the list which is updated diary. To make everything even better, OPNSense firewall makes sure no IoT can access the local network but I can access them like wireless printer, etc, and if I need to access anything while on road like my cat's cam or my Voron 3D printer camera, WireGuard VPN makes sure of that. No VPN equals no network access. It is just me and my devices, at the time of this writing: * Domains on List: 500k * Total queries: 43k * Queries Blocked: 17k * Percentage Blocked: 39% I run GrapheneOS on my Pixel phone and very limited apps, I prefer web version. The apps themselves are fully controller and 99% of the access blocked. That is why I have a fairly low numbers after purging all the logs a few days ago.

brewdad 1y ago
While there is absolutely value in doing what you are doing and I commend you for fighting the good fight, the fact that 61% of your queries are still going through means your data is still getting out there. Maybe to a lesser degree but that doesn't mean the marketing target isn't being painted it just means you are an impressionistic painting rather than a modernist with straight, accurate lines. I want to know how to become a Pollack painting.
- h4kunamata 1y ago
  I see your point, I have no need to block 99% of everything. For instance, many apps like bank apps use Google to delivery notification (there is a name for it), so if you start blocking everything, you won't use anything. To your credit, I can block more stuff but I haven't bothered. I have spent many nights blocking stuff haha Reddit doesn't work atm home because I blocked static.reddit.com Since the API drama, I never used it again, I used to waste hours of my life everyday there. Couldn't be happier to be honest haha The only fight I gave up is YouTube, I do see value into YouTube Premium. Spotify is dogshit, YouTube Music allows to me listen to music available nowhere else like DJ remix, old music and the the offline music works which Spotify gave me the finger. I watch YT only, TV News are complete useless nowadays. There are solid news channels so anyway, I do pay for it over trying to block its ADs from the free version. I mean, try listening music with ADs, nah thanks haha
vladvasiliu 1y ago
> Devices trying to use DoT or DoH??? Blocked, PiHoles take over. How? I can see you only allowing some ports through the firewall, but presumably TCP 443 is one of those. According to Cloudflare [0] DoH uses that. What if Samsung uses that, or figures DoT on port 443 works better? Do you only allow specific destinations for these devices? I actually use a similar setup, only I removed pihole and just use some lists in my opnsense's unbound (didn't notice much difference). My "smart" TV is pretty awful, so it's just unplugged (which makes it dumb, so now I love it). I've tried putting it on a dedicated VLAN with no internet access so I could try using the built-in Chromecast functionality – didn't have much luck. I've set up the mDNS repeater and allowed ports through, but that doesn't seem enough. [0] https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-https/ https://developers.cloudflare.com/1.1.1.1/encryption/dns-ove...
- h4kunamata 1y ago
  I followed this blog to get the firewall dynamic firewall in place: https://labzilla.io/blog/force-dns-pihole https://labzilla.io/blog/force-dns-pihole Like you said, you cannot just block 443, the dynamic firewall uses a public list, which contains all the public DNS known to man ( the last bit was just to sound a little dramatic haha ) So OPNSense will block anything within that list in both 443 and 853. So my Samsung QLED TV can no longer use Google:443 for DNS resolution. OPNSense blocks it and redirect it to PiHole, a NAT is also required to avoid devices getting mad. I didn't pay a kidney for that smartTV back in 2019 to make it dumb, when it is on, PiHole logs goes brrrrrrrr It is also one of the reason why my whole network was going down, it was making too much request exhausting PiHole 150 concurrent DNS requests, there is a flag to increase that and no more issues. Google:443: DNS request only, not actual 443 request gets blocked Cloudflare:443: DNS request only, no actual 443 request gets blocked etc etc Read that blog I shared to understand it. If I run a dig google.com @8.8.8.8, PiHole terminal shows the request If I run 8.8.8.8:443 on the browser, OPNSense firewall log shows access denied, the same msg when my TV turns on or my Home Assistant goes on. DoT on 853 is simple to block on its own, no much secret there.
  - silon42 1y ago
    Good stuff. As an alternative, has someone tried running http/s proxy on the firewall and blocking the rest of client HTTPS (except maybe for whitelist devices)?
dayone1 1y ago
Is there an updated set of instructions/great guide on how to set up unbound and pihole together along with forced DNS redirection (so all dns requests are forced through unbound/pihole)? I tried to do this a couple of years ago and gave up because of how complicated it was to setup.
- h4kunamata 1y ago
  I shared the link before, we do need to have firewall rules in place to enforce that. I had done it before but was wrong, I could still bypass PiHole. I had to recreate all my firewall rules because of a system crash, the order and place I had the rules created earlier were wrong. I shared the blog link yesterday, that is all you need to follow.

brewdad 1y ago

While there is absolutely value in doing what you are doing and I commend you for fighting the good fight, the fact that 61% of your queries are still going through means your data is still getting out there. Maybe to a lesser degree but that doesn't mean the marketing target isn't being painted it just means you are an impressionistic painting rather than a modernist with straight, accurate lines. I want to know how to become a Pollack painting.

h4kunamata 1y ago
I see your point, I have no need to block 99% of everything. For instance, many apps like bank apps use Google to delivery notification (there is a name for it), so if you start blocking everything, you won't use anything. To your credit, I can block more stuff but I haven't bothered. I have spent many nights blocking stuff haha Reddit doesn't work atm home because I blocked static.reddit.com Since the API drama, I never used it again, I used to waste hours of my life everyday there. Couldn't be happier to be honest haha The only fight I gave up is YouTube, I do see value into YouTube Premium. Spotify is dogshit, YouTube Music allows to me listen to music available nowhere else like DJ remix, old music and the the offline music works which Spotify gave me the finger. I watch YT only, TV News are complete useless nowadays. There are solid news channels so anyway, I do pay for it over trying to block its ADs from the free version. I mean, try listening music with ADs, nah thanks haha

vladvasiliu 1y ago

> Devices trying to use DoT or DoH??? Blocked, PiHoles take over. How? I can see you only allowing some ports through the firewall, but presumably TCP 443 is one of those. According to Cloudflare [0] DoH uses that. What if Samsung uses that, or figures DoT on port 443 works better? Do you only allow specific destinations for these devices? I actually use a similar setup, only I removed pihole and just use some lists in my opnsense's unbound (didn't notice much difference). My "smart" TV is pretty awful, so it's just unplugged (which makes it dumb, so now I love it). I've tried putting it on a dedicated VLAN with no internet access so I could try using the built-in Chromecast functionality – didn't have much luck. I've set up the mDNS repeater and allowed ports through, but that doesn't seem enough. [0] https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-https/ https://developers.cloudflare.com/1.1.1.1/encryption/dns-ove...

h4kunamata 1y ago
I followed this blog to get the firewall dynamic firewall in place: https://labzilla.io/blog/force-dns-pihole https://labzilla.io/blog/force-dns-pihole Like you said, you cannot just block 443, the dynamic firewall uses a public list, which contains all the public DNS known to man ( the last bit was just to sound a little dramatic haha ) So OPNSense will block anything within that list in both 443 and 853. So my Samsung QLED TV can no longer use Google:443 for DNS resolution. OPNSense blocks it and redirect it to PiHole, a NAT is also required to avoid devices getting mad. I didn't pay a kidney for that smartTV back in 2019 to make it dumb, when it is on, PiHole logs goes brrrrrrrr It is also one of the reason why my whole network was going down, it was making too much request exhausting PiHole 150 concurrent DNS requests, there is a flag to increase that and no more issues. Google:443: DNS request only, not actual 443 request gets blocked Cloudflare:443: DNS request only, no actual 443 request gets blocked etc etc Read that blog I shared to understand it. If I run a dig google.com @8.8.8.8, PiHole terminal shows the request If I run 8.8.8.8:443 on the browser, OPNSense firewall log shows access denied, the same msg when my TV turns on or my Home Assistant goes on. DoT on 853 is simple to block on its own, no much secret there.
- silon42 1y ago
  Good stuff. As an alternative, has someone tried running http/s proxy on the firewall and blocking the rest of client HTTPS (except maybe for whitelist devices)?

dayone1 1y ago

Is there an updated set of instructions/great guide on how to set up unbound and pihole together along with forced DNS redirection (so all dns requests are forced through unbound/pihole)? I tried to do this a couple of years ago and gave up because of how complicated it was to setup.

h4kunamata 1y ago
I shared the link before, we do need to have firewall rules in place to enforce that. I had done it before but was wrong, I could still bypass PiHole. I had to recreate all my firewall rules because of a system crash, the order and place I had the rules created earlier were wrong. I shared the blog link yesterday, that is all you need to follow.