I've just set up my pihole and I'm considering the best way to configure it. Is it a good idea to set the default group to block (almost) all domains and then manually add trusted devices to another group with a "normal" block list? My use case is untrustworthy devices that I don't want phoning home but which might change their IP address.
LazerDickMcCheese 6 points 2 years ago
Not very practical. Find a few curated lists, then start blocking domains 1 by 1. Sounds inefficient, but it's ironically faster in the long run than blocking the whole WWW then backpedaling
Onomatopoeia 1 point 2 years ago
Think you meant VLAN and autoincorrect got you.
Taleya 3 points 2 years ago
most routers allow dual wireless networks now, you should be able to set one that's exclusively for IoT. So you have MyWifi and WifiForThings.
You can then set the WifiForThings to have no actual internet access. This will mean that any apps etc won't work though, so be aware.
chickenf622 3 points 2 years ago
If you're willing to deal with the massive pain in the ass that is, I don't see a reason not to. Maybe write a note next to your computer to check the block list if something isn't working right.
sbv 2 points 2 years ago
My use case is untrustworthy devices that I don't want phoning home but which might change their IP address.
If you're using DHCP, you might be able to tell your router to assign a specific IP to the MAC address.
Alternatively, if you have a few trusted devices on your network, can you add them to an allow list and deny traffic to every other IP?
smeg 1 point 2 years ago
If you're using DHCP, you might be able to tell your router to assign a specific IP to the MAC address.
Hopefully, seems pretty unlikely that the untrusted devices will bother spoofing their MAC addresses
can you add them to an allow list and deny traffic to every other IP?
Yeah that's what I meant by manually adding trusted devices to a group with a normal block list
Darkassassin07 2 points 2 years ago
That's not a terrible idea; though it means extra configuration everytime anything new connects to the network. Friends using your wifi for example.
I just manually assign DHCP reservations for the MAC of each known device. Then they always have the same IP (without requiring static ip config on the devices themselves)
For a bunch of blocklists: https://firebog.net/
napkin2020 2 points 2 years ago
If you want to go through logs and meticulously look for which broke what. There are a lot of things that happen in the background when you visit a webpage(cdn.example.com, cf.example.com...) and *.example.com white-list is pretty stupid(ads.example.com)
Reannlegge 1 point 2 years ago
I tried that once, pihole blocks stuff coming in and not going out. Many “smart” devices will freak out if they can send things out to the internet but cannot receive things back.
Onomatopoeia 1 point 2 years ago
Pihole doesn't block inbound traffic, it has nothing to do with it (as you mention in your later comment, DNS is about address lookups, not routing IP addresses).
PiHole is a DNS server, all it will do is resolve addresses for clients that use it.
Reannlegge 1 point 2 years ago
No it does not go through a DNS on the way out. A DNS, or domain name server, is like a phonebook so people can put in whatever.whereever and get the IP address back.
lagoon8622 3 points 2 years ago
No it can just send stuff to an IP
pihole
@sh.itjust.works
649
35
1
The Pi-hole® is a DNS sinkhole that protects your devices from unwanted content without installing any client-side software.
go to feed...
pihole
@sh.itjust.works
649
35
1
The Pi-hole® is a DNS sinkhole that protects your devices from unwanted content without installing any client-side software.
go to feed...
Untrusted devices should really be on their own VLAN. You will have much better control over them and their ability to reach out to the net, or gather info on your network and other devices. Some IoT devices have their DNS hardcoded, so they will ignore your Pihole anyway - you will need to redirect the DNS with outbound NAT to combat this.
save