13 ms·

I am not familiar with dnsmasq at all (is this machine-local?), but absolutely love my PiHole hardware — you can even create rules which intercept hard-coded-IP

I am not familiar with dnsmasq at all (is this machine-local?), but absolutely love my PiHole hardware — you can even create rules which intercept hard-coded-IP DNS request and/or httpsDNS. You can also hard-code/intercept .TLD to local service IPs. Programs like LittleSnitch never really seem like "enough" for me, because the computer has to boot before DNS filtering comes online. It also has the design error (IMHO) of pre-resolving IP addresses before clicking Accept/Deny(all). A great blockrule for your personal firewalls would be to ban (at top level) icloud.com, apple.com, &c; system updates can then be performed manually using guides like <http://www.mrmacintosh.com http://www.mrmacintosh.com>. Of course: this breaks everything (in exactly the way I prefer to compute).

bombcar 7mo ago
This works great (and I use it) internally but when you want things like your docker domains to work when you're on the go, it's annoying. I have setup a VM running DNS on my laptop before ...
- ProllyInfamous 7mo ago
  It is not too difficult to allow your PiHole to serve you globally (but does requiring opening some ports in your firewall == additional security risk). There is a simple checkbox within the DNS's web interface to `Allow WAN Requests`. You'd then only run into issues of accessing your local IP addresses if those hosts aren't configured correctly within your network rulesets. ---- I am a user, not an expert; by trade, I am a blue collar electrician. I know very little about internet topology except how to use simple open-source hardware. Perhaps what you said makes sense (e.g. that you cannot use outside your network, some service(s)).
  - bombcar 7mo ago
    Yeah that can work, though at that point I start to consider just exposing my "internal" DNS to the world at large - who cares if secret_service.mydomain.net can be seen by everyone to resolve to 192.168.88.4? You can also do VPN tricks, too.
    - ProllyInfamous 7mo ago
      >whocaresif? I think my major concern here would be if people were going to websites which might be considered illegal within their jurisdiction (e.g. guest_DNS_user searches for out of state abortion providers — while you[r DNS] live[s] in Texas). Perhaps the State sees guest_DNS_user's query to plannedparenthood.com, then decides your vehicle tag is worth tracking for potential out-of-state (via e.g. Flock cameræ)... or that you are guilty of facilitating an abortion for someone else... all because your DNS server provided IP resolution for guest_DNS_user to Planned Parenthood Colorado (et.al). ---- This would have been too far-fetched for me to have considered/written, even just a few years ago. It's all reality, now. Are you targetable enough? DNS leaks are another reason I don't care for LittleSnitch (which pre-resolves IP address before the accept/deny pop-up even appears.

bombcar 7mo ago

This works great (and I use it) internally but when you want things like your docker domains to work when you're on the go, it's annoying. I have setup a VM running DNS on my laptop before ...

ProllyInfamous 7mo ago
It is not too difficult to allow your PiHole to serve you globally (but does requiring opening some ports in your firewall == additional security risk). There is a simple checkbox within the DNS's web interface to `Allow WAN Requests`. You'd then only run into issues of accessing your local IP addresses if those hosts aren't configured correctly within your network rulesets. ---- I am a user, not an expert; by trade, I am a blue collar electrician. I know very little about internet topology except how to use simple open-source hardware. Perhaps what you said makes sense (e.g. that you cannot use outside your network, some service(s)).
- bombcar 7mo ago
  Yeah that can work, though at that point I start to consider just exposing my "internal" DNS to the world at large - who cares if secret_service.mydomain.net can be seen by everyone to resolve to 192.168.88.4? You can also do VPN tricks, too.
  - ProllyInfamous 7mo ago
    >whocaresif? I think my major concern here would be if people were going to websites which might be considered illegal within their jurisdiction (e.g. guest_DNS_user searches for out of state abortion providers — while you[r DNS] live[s] in Texas). Perhaps the State sees guest_DNS_user's query to plannedparenthood.com, then decides your vehicle tag is worth tracking for potential out-of-state (via e.g. Flock cameræ)... or that you are guilty of facilitating an abortion for someone else... all because your DNS server provided IP resolution for guest_DNS_user to Planned Parenthood Colorado (et.al). ---- This would have been too far-fetched for me to have considered/written, even just a few years ago. It's all reality, now. Are you targetable enough? DNS leaks are another reason I don't care for LittleSnitch (which pre-resolves IP address before the accept/deny pop-up even appears.