← Back to context

Comment by ProllyInfamous

3 hours ago

Can one not just use their router's firewall to drop all DNS queries which do not originate from your PiHole?

7 comments

ProllyInfamous

Reply
jen20  1 hour ago

Only if there a) is a DNS request, b) it does not use DNS over HTTPs.

PiHole is not and never has been a reliable way to guarantee anything, regardless of how you configure it - just gets the low-hanging fruit. Plenty of devices hard-code their own DNS servers ("smart" TVs are a good example) and will happily ignore whatever DHCP gives them if they have a route to the internet.

LoganDark  3 hours ago

This does work for unencrypted DNS and DoT over port 853, but it fails for DoT over any other port and DoH, which looks just like a website visit. You can't tell whether a website is acting as a DoH server without TLS inspection, and you can't differentiate between multiple domains on the same IP address either (unless a client is stupid enough to use SNI). Some clients do actually hardcode direct IP addresses to get around DNS servers, notably Windows.

  • ProllyInfamous  3 hours ago

    >notably Windows

    At least they're honest, using host <spynet2.microsoft.com> to replicate Apple's <smoot.> & <security.> subdomains.

    >This does work for unencrypted DNS and DoT over port 853, but it fails for DoT over any other port and DoH

    My task for today is to learn more about this (I'm only doing the unencryptedDNS part) and then implement an entire subnet that is whitelist-only (for all DNS). I think what you wrote will help solve this better, thanks.

    • LoganDark  2 hours ago

      Oh hey, found you in a 2024 HN thread while searching for info on that smoot subdomain. I guess you've been at this for a while.

      FWIW, Microsoft hardcodes many subdomains, not just that one. Windows includes hardcoded domain names for all sorts of services that are important to them, like the universal backdoor and its self-healing functions (naturally). They really wanna make sure nothing stops them from uploading your disk encryption keys to their servers! (or something)

      3 replies →