I wish pihole or adguard would add support for change DNS records based on the query subnet. I believe this is called DNS views.

That way my local devices and wireguard devices can get the correct IP for internal services.

That’s why I switched to affairs home but wouldn’t mind switching back

I am using Pi-Hole for about 8 years and can't imagine a world without it.

Another big THANK YOU to all list maintainers out there. You're doing an incredibly useful service to the community.

Obviously the goal is to have your local clients talking to Pihole, but the goal of having remote DNS queries encrypted is to prevent ISP snooping.

Though if you really want to prevent ISP snooping you have all clients using VPN or configure your router to send all outbound traffic to a VPN endpoint.

PiHole v6 appears to have most of that config built-in, and upgrading to v6 removes all of the previous standard config files, leaving only user-created / user-edited files in /etc/dnsmasq.d/ - and PiHole v6 by default no longer imports anything from this folder (to prevent possible incompatibilities).

But it's just a setting, and toggling it brings back the original functionality of importing config from files in that folder. And for me, my custom dnsmasq config worked just the same as it previously did.

This is an extremely uncharitable reading of the preceding comment. The comment is clearly concerned about the national jurisdiction from which the AdGuard binary originates, not the national origin of a human.

American government initiatives against Huawei telecom hardware at critical junctures aren't making a personal statement about Chinese individuals. European regulatory skepticism of American-located cloud services isn't a personal statement about American individuals. Russia and China requiring the on-shoring of data-centers doing business in their internal economies aren't making personal statements about foreigners by doing so.

Whether or not you hold all those governments as roughly equal, none of them mistrusting each others' jurisdictions is "judging people by the country they live in." It is judging the trustworthiness of the governments of those countries. And the people in those countries are inevitably subject to the jurisdictions of the governments that rule them.

If someone actually attacks people on the basis of national origin, have at it, but please don't brow beat individuals for making common-sense risk assessments.

Instruct your Tailscale invitees to download the app and voila, simply toggle it on or off as needed.

Nothing says clients need to confirm to the port requirements, but most companies will be lazy and assume 853 will work.

Embedded device software development quality is usually even worse than webapp software development quality.

And do you use any kind of reference for determining which ranges/countries are wise to block or has this just been something you’ve evolved over time?

Most people either buy a generic box that can be had for ~$250, or recycle an old PC and stick in a network card. You can also buy commercially supported hardware for Opnsense or Pfsense's parent companies, though the value proposition isn't worth it for home users IMO as you will pay a steep premium versus loading up something yourself.

They have some guides and stuff that explains the hardware requirements that might be helpful for you.

ATT apparently removed overriding the DNS for IPv4 and IPv6. I had to double check because I thought I could do IPv4 but no.

There’s supposedly several options around it to use your own router but it’s not really worth setting up and my speed is slower using a second router.

https://www.forbes.com/sites/dimitarmixmihov/2025/02/17/x-is...

But my point wasn't literally to use a Raspberry Pi 2, just that you can get cheap low power devices that beat "smart TV" crap. You can of course get much more recent ARM-based boards that support all the latest HD standards etc. I don't do the hedonic treadmill, though, so I'm still happy with 1080p Blu-ray.

As for the latency - is it really noticeable?

This is my latency (ping.nextdns.io):

  zepto-cph (IPv6)    12 ms  (anycast1, ultralow2)

  zepto-cph           13 ms  (anycast1, ultralow2)

  anexia-cph (IPv6)   15 ms  (anycast2, ultralow1)

That depends entirely on what capabilities your router has.

Many routers have a setting for the DNS info they give to clients via DHCP, which would mean every client is indeed using PiHole directly for DNS resolution.

Other less capable routers, only have a setting for which upstream DNS server(s) the router should use, which of course isn't going to allow you to do anything with PiHole's group stuff.

But an easy solution is simply to disable the DHCP server on the router, and simply use what is built-in to PiHole. It uses dnsmasq behind the scenes, and as DHCP servers go, it's pretty capable and configurable. This is how I use PiHole on my own network, and have done for years now (with some customised dnsmasq config, because I have strong preferences about my network setup and services).

Most routers do nothing particularly special regarding DHCP anyhow, so no big deal to just turn it off, and use PiHole's stuff.

FWIW, and tangent to these specific points, my upgrade to the new PiHole 6 earlier today was pretty smooth — with the exception of it defaulting to having its dashboard on port 8080 instead of my previous 80. Plus I had to tweak a couple of settings to ensure it loads my custom dnsmasq config. But no deal breakers at all.

It's also not subsidized by selling your user data.

Ideally, you do not run DNS on your router at all, and you also block outbound to 0.0.0.0:53 from anything _except_ the Pi-hole, so that there's no convenient way to get to an unblocked DNS by bypassing it.

DNS-over-HTTP is a bit harder to block, and of course malware could have an IP baked in and so bypass this entirely.

I imagine this is how it’s usually done. There’s no reason to double proxy.

No, not weird. The extra stuff is there to show you ads and/or track your behavior, which generates a stream of revenue for the TV maker. W/o the extra stuff, the only revenue comes from the one-time purchase.

Most often those are some embedded linux board running some Android fork, shouldn't there be some TV models on the market that are a good hardware/price deal with firmware that can be replaced?

Even something that just permanently shows HDMI input with no popup overlays would be good, but AOSP + VLC/Jellyfin would be even nicer.

I'm currently using Blocky as my DNS resolver. It works fine and is super fast because of the fine control over caching, but I'm disappointed with its memory footprint. 400MB for a total blocklist of 1.3M domains

I think you would need to explain your definition of 'best' here — I mean: explain why you think it is better.

> making regex blocks are appropriate.

I guess here you actually mean inappropriate?

Perhaps. But I think you misunderstand what I am doing, and how that then works in PiHole.

The method I describe, uses the Domains tab on the Domain Management page — and not the RegEx Filter tab.

The distinction is somewhat of importance, because the implementation of PiHole uses a different code path for exact-match denies/accepts, vs regex denies/accepts. (Type 0 and 1, vs type 2 and 3, detailed here[1]). Adding a domain the way I describe, creates an exact-match type entry in that table, not a regex match type.

But even if it were still using regex, the cost of that isn't as high as one might imagine, due to the fact that subsequent repeat queries to the same domain, do not get checked against regexes again: the result is cached.

As described here [2]: "Our implementation is light and fast as each domain is only checked once for a match. When you query google.com, it will be checked against your RegEx. Any subsequent query to the same domain will not be checked again until you restart pihole-FTL."

In summary: adding a domain the way I describe doesn't create a regex filter anyhow. But PiHole's regex matching isn't a naive implementation, it caches the results, so that it only actually performs the regex matching on first query to a domain not seen before (since last restart).

So really it makes no difference at all if one blocks a domain the way I describe, or the way you describe. They both end up doing the same thing: they insert an exact-match filter entry into the database.

In which case, it's simply down to one's own preference: do you prefer looking through the query log to find the site to block... or do you prefer just typing in a domain name.

[1] https://docs.pi-hole.net/database/domain-database/

[2] https://docs.pi-hole.net/regex/

dnsmasq has grown up a lot in the last few years and does have the ability to redirect domains. It's that time again got to read the man page

Yes. And that's why, in the context of misbehaving devices, carrying their own methods of doing DNS, I mentioned it.

> Now you are talking about browser based DNS systems, apple private relay and other related 443 based solutions.

No, not at all. Anything can use DoH. Doesn't need to be browser-based, nor using Apple private relay, nor anything of the kind. A device simply needs to be coded to make its DNS queries over HTTP. In a similar fashion to how it might have a hard-coded value for its DNS lookups, the developer can simply include a small library to do DoH instead. And that's not going to be so easily filterable by a rule for outgoing traffic / port forwarding.

I have all of my PiHole DNS lookups going over DoH. Have done for years now. Because when I originally setup my secure DNS, DoH was a better choice that DoT, because DoT was very much still in flux. And by comparison, DNS over an existing standardised transport is pretty much a known quantity. So that was my choice. And it works great.

So all of my network's DNS lookup go out over DoH... there's lots of DNS providers that provide DoH nowadays, including plenty of very big providers. My secure DNS proxy cycles between different servers.

DoH functionality is even just built-in to Bind these days.

In reality, DoH isn't in any way restricted just to the services you describe here. Far from it. It can be used anywhere. It's just a protocol. With plenty of destination endpoint support, out there in the real-world.

And if some device wants to control its DNS to that kind of level, then, beyond simply having a hard-coded DNS server value, using DoH is pretty easy.

No browsers needed, no Apple Private Relay needed.