As explained in the beta5 announcement, you can disable 'Deep CNAME inspection', using the setting CNAME_DEEP_INSPECT=false in /etc/pihole/pihole-FTL.conf
There is a warning on the home page that says:
Important: For this list to work at all, the blocking logic needs to wildcard match (domain and all its multi-level subdomains) CNAMEs against the domains in this list.
The question for the developpers:
what is the recommended way to add these CNAME domains?
will adding a dnsmasq (separate config file) entry (random entry from the reffered list) such as
address=/wizaly.com/#
trigger CNAME blocking OR does it require a regex, such as
(\.|^)wizaly\.com$
edit
tried to find the answer myself. apparently, using dnsmasq wildcard syntax (address=/wizaly.com/#) does NOT trigger CNAME detection, regex syntax does trigger CNAME detection.
Still would like confirmation this is the best possible regex to comply to the requirements for CNAME cloaking, usin the entries from the NextDNS article. /edit
There's no magic to "trigger" anything. If a domain query is a CNAME then that CNAME is checked for white/black/block. All domains found in the chain from queried domain to final IP are checked.
Yes, this is expected. If you specify it using a dnsmasq-instruction, you effectively add the domain wizaly.com to dnsmasq's DNS cache. If you query this domain (or any of its subdomains) directly, you will get the reply from the cache. During a CNAME traversal, however, dnsmasq does not look at its cache at all (at least not at if there are parts of it already known).
Black- and whitelists (may it be regex or exact) are an FTL feature and are always checked and are to be used here.
Is this then a correct entry to block all possible CNAME entries for wizaly.com? Or do you recommend something else to achieve blocking the CNAME domains, referred here? I'm asking, since we are all new to CNAME blocking, and probably want to use an entry, matching what the developers intended.
Wildcard block wizaly.com. If it shows up in a direct query, it will be blocked. If it shows up as a CNAME for a different domain query, it will be blocked. There really isn't any behavior to change for CNAMEs, block what you want blocked and let FTL handle the internals.
I hoped so, been busy all afternoon to get this script working, see here. If you have any comments, feel free to shoot. The goal of the script is to read the domains from the file and enter them directly into the database. Tested, works, but comments are expected.
I wrote this, because pihole has no facilities to achieve this.
Yeah, strange as in: I would not have expected it to work.
You script only updated the database but did not made FTL check for new/deleted regex.
As FTL does not compile (= load) the regex at the end of your script. So it probably worked only by chance because you're restarted FTL at some point or did some changes to the lists using either the CLI or the web interface (both will run the reload-lists for you).
I am reasonably good in breaking down a problem into the steps, needed to solve the problem, terrible when turning the steps into code (trial and error, using duckduckgo examples to translate a step into code).
This sometimes ends up in simply rebooting, due to a watchdog trigger (max-load-15), or manual intervention if the system is still responsive.
I'm using this to look at the database, but it's a lousy way to apply massive changes (remove all regex entries to avoid falsifying the test result).
I also tried to remove all blocklists (except one) from the database, but failed (timeout). It even looks like you cannot remove a blocklist from the database, only enable/disable it (can you confirm or deny this?).
Anyway, I rebooted, that caused FTL to read (compile).
Those domains (and many others) all seem to CNAME to ghochv3eng.trafficmanager.net (see https://securitytrails.com/list/cname/ghochv3eng.trafficmanager.net).
We have added it to our CNAME cloaking blocklist (that can be used with Pi-hole):
https://github.com/nextdns/cname-cloaking-blocklist
This comment refers to the blocklist discussed here.
A script, I'm running weekly (cron) to add possible new entries (one this week) to pihole (regex blacklist) can be found here
result, for the new entry, referred in the reddit article:
No it doesn't. You are probably experiencing the copy/paste problems, related to discourse, which changes certain characters, making the copied script fail. You can download the script here.
