My versions: Core v6.3 FTL v6.4.1 Web interface v6.4 My PiHole is running on a raspberry pi 2 without container. My network have two network interface: vlan@eth0 : ULA IPv6 prefix, no IPv4 eth0 : global IPv6 prefix, private IPv4 With IPv6, you can mix slaac and manual configuration. This allo…

[image] wanou: I’ve created a file named 10-listen.conf Dont need to. Can drop those two directives directly into webGUI below: [image] Or via shell: sudo pihole-FTL --config misc.dnsmasq_lines '["listen-address=<IP_ADDRESSES>","bind-interfaces"]' EDIT: Oh for the web part you have belo…

[image] wanou: My dream: make FTLDNS no longer bind to the IPv4 address because DHCP will be shutdown soon. But IPv6 connections are perfectly fine with having their DNS resolved via IPv4 so it would safe you a lot of hassle at this point ?! :wink: But if you want to continue your original p…

You’re perfectly right. DNS works with both protocols, serving A and AAAA record whatever the protocol used to contact the server. The point is there to switch off IPv4 in most of my network so i don’t want to see anymore bind with IPv4 for this unique reason.

You are aware of the fact that there are still many websites and services out there that don’t have IPv6 connectivity ? TL;DR of what i am trying to say : Turning IPv4 off has consequences which you have to be aware of :slight_smile:

[image] wanou: Link local: FTL should never bind to either IPv4 or IPv6 link local addresses because resolution is then the mDNS business with .local names. That's wrong, mDNS does not bind to the loopback address or link-local addresses, nor any unicast address at all. Since DNS and mDNS ar…

I’m aware of the bad behavior of actors like github and many others that refuse to admit IPv6 is the only future of Internet. History will not wait them. To cope with that situation, i have NAT64 and DNS64 in place with tayga and bind9. DNS64 will not work with hard written IPv4 addresses, but it …

Thank you for your answer. I will follow your instructions to get the wanted behavior. That's wrong, mDNS does not bind to the loopback address. Since DNS and mDNS are separate protocols, there is no conflict here. DNS is unicast to port 53, while mDNS uses port 5353 on multicast addresses. And…

[image] wanou: But, it’s not a good practice to have daemons binding on all addresses of all network interfaces. Most all packages bind to all OOTB: $ sudo netstat -nltup Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State …

Many bad practices comes from the call for ease of use from users but it is still bad to do so. None of my services is listening on all OOTB. Any service that can not restrict binds is defective for me. Reducing services number and listening addresses is a good practice, like shutting down telnet …

I agree about tightening security but for a home setup like most of us, the OOTB binding to all is secure enough. And as noted before, you can tighten security as much as you like. You cant always please everyone especially with some of the edge cases. No one size fits all :wink:

I understand this is a Feature Request and we try our best to implement new features, but feature requests alone are not enough to result in a new development. To be considered for development, a feature request needs at least: enough people voting for the request (Currently your feature request …

Pi-hole Userspace

Need a restriction on FTL binding

Feature Requests

show post in topic

Home
Categories
Guidelines
Terms of Service
Privacy Policy

Powered by Discourse, best viewed with JavaScript enabled