Limit access to your Pi-hole with iptables on Ubuntu/Linux

Awesome post and info, thanks.

always respect the order of the servers as in /etc/resolv.conf (this is the true: "if 1 fails, ask 2. If 2 fails, ask 3, etc.")

is this default, or how does one configure this? (sorry if I missed it)

I suppose best bet is to just set the pihole as the singular dns for my home network and set the pihole and an alternate on friends/family and just hope the pihole is faster for them...wonder if I can geo-locate a specific far away Cloudflare resolver...

No,

is the default (hence the "(the default)" :wink: ).

You can get the behavior you want by adding a new config file

/etc/dnsmasq.d/99-dns-order.conf

with the content

strict-order

Quoting the dnsmasq man page:

By default, dnsmasq will send queries to any of the upstream servers it knows about and tries to favour servers that are known to be up. Setting this flag forces dnsmasq to try each query with each server strictly in the order they appear in /etc/resolv.conf

Don't forget to pihole restartdns afterwards.


I'd even say configure the Pi-hole as only server for them. Whenever it does not work, they can click on a stored bookmark. As you said the link is to the static IP of the server, they will not need DNS resolution for this to work. Not perfect, I know, it depends on it they want to be safe or not. With such a fallback, you can never be sure.

No, they all use Anycast. This is implemented by configuring specific routes. Something you cannot circumvent without help of your ISP. And even for them it would be a complex task, I wouldn't believe they will help you with this.

1 Like

default

:facepalm:

strict-order

Awesome, thanks so much. Will set this today.

I'd even say configure the Pi-hole as only server for them

Makes sense. As mentioned, it's very rare for the ISP DHCP leases to change, and a bookmark is a great idea too. I think I'll do as you said.

Anycast

I figured they must be doing something like that, thanks for confirming. I suppose it doesn't matter anyway since I think your idea of just using the pihole as the single dns and using a bookmark is the best idea. If they start complaining about having issues, I'll just set them back to Cloudflares resolvers. Typically for me, the only time I have issues at home is when some random site won't load (usually linked from HN or google news or something), I'm on my phone and will just turn off wifi and use cellular for the page and that works fine for me.

Thanks for all the help in this thread!