Comment by toredash

8 days ago

Is there any DNS based software to do block/allow? Kinda lika what's present in CiliumNetworkPolicies in Kubernetes networking?

5 comments

toredash

Reply
M95D  8 days ago

Yes, PiHole is the most common, but malware can easily bypass that using shared domains, P2P or IP addresses directly.

Use a filtering proxy instead and no gateway / route to the internet.

  • chupasaurus  7 days ago

    1) Dnsmasq, you don't need the whole PiHole for that.

    2) You're advising security through obscurity instead of a network namespace + firewall.

    • M95D  6 days ago

      Please explain #2. How is a filtering proxy security through obscurity?

gus_  8 days ago

OpenSnitch (+ block lists) ;)

or DNS stubs with filtering capabilities.