Limit access to your Pi-hole with iptables on Ubuntu/Linux

[Coro]

I'm just being cautious here, not trying to say what you do is crap
Only to raise awareness for possible copycats that may not be well-aware of how to handle firewalls properly.

@dormstrain

Just visit http://yourpiholeip/setdnsip.php?secret=supersecret and the ip address you are on will be added to the port 53 allow list so any device there can use your Pi-hole.

@dormstrain

It also makes it easy to update when your ISP changes your ip address.

Just out of personal interest: How do you deal with dynamic IP addresses? Or do they all have static assignments?

So whenever they recognize that DNS is dead, they have to manually navigate to the address quoted above to re-register their IP with your server, right?

Be aware that there is nothing like such a "fallback" as you described here:

@dormstrain

throw the pi-hole on their router dhcp as primary dns with cloudflare as backup

See this excellent explanation:

Primary vs. Secondary DNS

Following the regulations, there is nothing like a primary and secondary DNS server. These indications are quite misleading but many systems adopted it this way. We only list the DNS servers as primary and secondary, because this is what the providers write on their pages. The bad phrasing is supported especially by how Windows handles it. If you look at any Linux distribution, there is usually no separation between primary and secondary, but you can only provide a comma-separated list of DNS se…

My expectations were different, too, but I can only confirm this on all sorts of network hardware I used to own myself.

@DL6ER

Indeed, you can not trust that a primary server will be the only one being used even if it is available all the time. It depends on the implementation in the system you use.

The DNS may leak how you configured it.