Infrastructure Series -- Recursive DNS and Adblocking DNS over TLS w/NGINX

(can’t send a DM so I’ll ask here) where do you add your “better to die…” tagline in the discourse UI? Thx.

2 Likes

You have to DM a mod to have it put in for you.

2 Likes

Thanks, I’ll wait until they make me a mod then add it myself :wink:

2 Likes

No problem :slight_smile:

1 Like

Funnily enough I have never opened the webgui.

Uh… How do I do that?

1 Like

its IP address port 80

You can restore via the command line too. RTFM :smiley: :rofl:

1 Like

Same.

2 Likes

Nah I’ll just ask you and then I don’t have to

Ech I have to plug a monitor into the machine anyways god dammit XDDD

1 Like

DO IT…need fun things to read :slight_smile:

Also, I have a samsung phone and TV… the TV is driving my pihole nuts with over 1,000 DNS queries in a second causing a rate limiting error. I also had a few problems with messaging working sometimes, but not others via the Samsung messaging app… Also missed calls. Wife had the same problem with iOS, so if I find what i whitelisted to fix or as a work around I’ll let you know. FYI this was the older list. I need to implement the new one when my wife is working. AND last but not least I had issues with Prime Video. I dont use it much but wife loves it. I’ll try and document all changes I make for review of if they are “safe” or not. I also review the IP’s to see what is safe and suspect. Do you have a site for checking that you prefer? I just google look at two or three sites to see if the IP is supect before I white list.

also @PhaseLockedLoop TAGS… I could kiss you…lol

1 Like

Do you really need your TV connected to the internet, as opposed to having something like a Intel Compute Stick or a Chromecast connected to it? The less IoT in a house, the better…

2 Likes

Yeah she just uses the onboard Smart features…Introducing another controller or “other” way of doing something, let ALONE buying something to plug in would equal wife RAGEEEEEEE…lol

IoT thanks to you is all on its own net :slight_smile:

1 Like

On one hand, it’s nice that at least you can block ads from the TV. On the other, it will be a lot of headache to whitelist legitimate traffic…

1 Like

Im retired and have litterally nothing to do besides cook and clean…nice to do something “manly” and fix something lol.

I can troubleshoot while shes gone and just load the “teleporter” backup that I know works… With me not blocking her phone or laptop anymore my block rate dropped from 30-40% down to 12% currently lol.

1 Like

@PhaseLockedLoop

The error I’m getting on pihole is as follows.
“2022-04-17 20:16:34 RATE_LIMIT Client 192.168.30.1 has been rate-limited (current config allows up to 1000 queries in 60 seconds)”

This IP is my Samsung 65 inch UN65KS8000FXZA.

I had problems as I said with connection to smart services (in particular Amazon Prime Video) using the Smart Hub TV option that’s part of Samsung OS. I will check this on the new revised version you gave us. I can not remember what I white lsited. I basically read the live logs to see what was blocked as I requested the service, then checked the IP for validity via google (is there something better a webpage I should use the check IP’s being accessed?), and white listed to see If I could get it to work.

I’m currently troubleshooting trying to update the TV. When I try to update it comes back with a “not connected to the internet” error despite all my online services and Samsung Account working.

Side note, I also had to whitelist a few IP’s for Kaspersky to get updates to work.

Heres a fast screen shot of the error.

I downloaded and copied the full debug log, I didn’t see anything that might be useful. Theres also a lot of personal info I’m not sure is needed/viable to abuse my network…lol If you need it can send it to you personally I saved it to a text file.

See documentation on rate limiting in the piholes documentation. They talk about it. My rate limiting is disabled as my firewall handles it.

It should be a configurable in the pihole settings inside /etc/pihole

1 Like

I L O V E Y O U… this is amazing work. With the tags I may be able to implement some safety for my wifes devices without disturbing her craving for social media.

I did have to add a few basic address’s to my white list… IE Google.com and Amazon.com… BUT thats all really so far. OH, and one or two for google messanger because wifey uses it to communicate with me…\

Will keep you updated on conflicts I have with devices and what is causing the issues as I go. THANK YOU again for all the work you put in here.

White List Updates-
To get Kaspersky Free to update databases for scans

s05.upd.kaspersky.com
s07.upd.kaspersky.com

still have this error…booo

|2022-04-22 10:47:06|DNSMASQ_WARN|Warning in `dnsmasq` core:

Maximum number of concurrent DNS queries reached (max: 150)|

Im not sure if the problem is Pi-hole, Unbound on Pihole, or dnsmasq on OPNsense…
When I turn off conditional forwarding on pihole it goes away, but then I dont get device hostnames. It stores them once I run it. So once all my devices populate on pihole I’ll run conditional forwarding once then shut it down to get all the hostnames on pihole so I dont have to cross reference with OPN sense all the time.

My Samsung Galaxy has problems with receiving calls and sending receiving messages. I see a few blocked items when I attempt to send a message via messanger.
path2.xtracloud.net also path1*, path2* etc.
people-pa.googleapis.com
instantmessaging-pa-us.googleapis.com

These are all blocked…but service is working now. I’ll have to wait till I have a message that wont send. I had this problem with the old list too. For now though seems to be working.

Samsung smart tv (Newer Q70 model)interface works no issues with Netflix and Amazon service.
HOWEVER- Plex did not work natively. It could not sign in and produced a “Unknown Error” at the plex login screen.

I had a list of seven block DNS queries worked my way through them. The one that needed whitelisting was time.samsungcloudsolution.com

Amazon Firestick TV 4k works amazing, no issues here either.

All in all super happy with the filter settings for pihole. :slight_smile:

rip yeah might have to whitelist those if you use google messages.

You might find this useful.

1 Like

SO… I finally got my OPNsense working (Thanks @ThatGuyB again) as my ONLY DNS fed to my clients via DHCP, which in turn handed off all DNS queries to Pi-hole via dnsmasq. It works flawlessly and forces everything even hardcoded devices that attempt to use a diffrent DNS to use my OPNsense router in turn pihole.

Here’s the rub. It now negates the “Clients” feature in Pi-hole where I could remove my wifes phone (and other devices) from filtering because technically the DNS query is coming from my OPNsense firewall. (I read up on it a bit via Pi-hole forums and other legitimate/reputable sources)
In order for the “Clients” function to work correctly you have to have DNS quires going directly to pi-hole from devices.

I’m now trying to decide if I want to rewrite my rules to send everything to pihole and cut out OPNsense/dnsmasq, (Like the rules set up by @PhaseLockedLoop) or change the few devices DHCP records in OPNsense to feed pihole as the DNS to those few devices vs just using the default (OPNsense-dnsmasq). The drawback would be I’d have to remember those devices have a different DNS record and change them manually is ever pihole goes down to give a working DNS to keep internet functionality on those few devices.

I’m leaning towards changing rules because it would be easier to fix and not have random devices not work if I forget those devices are set to a different DNS in the future (Also, I’m thinking if I had a larger scale system to manage I wouldn’t want these issues to pop up and consume time in a production environment[this is what I’m trying to learn]).
Just my thoughts and a limitation to how I have my network set up I thought I would share here for any who run into this issue.

@PhaseLockedLoop this may be in the wrong place on your Master List of projects… If this should be moved to just the Pi-hole section let me know or have it moved or I can move it. We have been chatting here about it so I’ve kept the conversation here.

2 Likes

I had to amend this… I lost plex fuctionality locally directly on the Samsung TV interface.

Also… pcpartpicker.com was blacklisted?

2 Likes

Its whitelidted on my end. Might be one of those flukes

1 Like