Using dnsmasq addn-hosts for adblocking and avoid DNS bypassing

Help Community Help
1

Hello,

has anyone used this before with Pi-Hole? I know it's an option in an OpenWrt Adblocker which solves the problem when connections ignore using the DNS from the adblocker by simply adding all the blocked entries as hosts via DHCP.

2

In the past there was a custom.list file that contained all the Local DNS Records and could have been used for the same purpose.

However...

  • When you do that on your OpenWRT Router you basically NULL ROUTE the specific DNS Servers for your whole network.
  • When you do that on your Pi-Hole you only NULL ROUTE them for your Pi-Hole.

And if you want to do that like most people do then you need to have the option to create custom DNAT/SNAT DNS Redirection Rules on your Router which a lot of OpenWRT users also do :wink:

3

In my OpenWRT router, I have added a redirect firewall rule to redirect port 53 requests back to the address of my Pi-hole device. This prevents various devices from using their own. Use caution though. You could establish a loop. For example, my set up only redirects address 'greater than or equal to' .10. This means all my network devices, including the Pi-hole host, which are 'less than' .10 are free to use what ever external DNS they like.

4

Wouldn't iptables suffice?

Example: I use this dnsmasq docker container ( GitHub - dockur/dnsmasq: Dnsmasq in a Docker container. · GitHub ) and hook it up with iptables.

Although I ordered a dual NIC card anyway now.

5

Yes Pi-hole did in the past:

Now the domains to be blocked are stored as a B-tree structure in a dbase file.
Way faster than searching trough a long list of domains.

Ps. I dont see how this addn-hosts directive is related to clients bypassing Pi-hole?

6

@deHakkelaar from my understanding (or thats how adblock-fast for OpenWrt says it) it "writes" the entries in the hosts with localhost to DHCP leases so it doesn't matter which DNS any lease uses.

7

Could you rephrase that as I have no clue what you mean?

You linked the dnsmasq man page in the OP, but again here is what that directive does:

$ man dnsmasq
[..]
       -H, --addn-hosts=<file>
              Additional hosts file. Read the specified file  as  well  as
              /etc/hosts.  If --no-hosts is given, read only the specified
              file. This option may be repeated for more  than  one  addi‐
              tional  hosts  file.  If a directory is given, then read all
              the files contained in that directory in alphabetical order.

I dont see how that is related to DHCP or clients bypassing Pi-hole.

8

You do it with IPTables/NFTables on Linux based Routers indeed :slight_smile:

I think he is basically talking about blocking DoH/DoT Servers which are used by Clients via domainnames instead of IP addresses ?!

Or maybe he is just confused and is mixing two things that do the same in the end...

9

Hosts file approach does let you skip the firewall layer entirely if you just wanna handle it all in dnsmasq. Worth knowing though — big blocklists can get memory-heavy, so you're trading iptables complexity for different overhead.

10

Actually I found another solution for me. I used a configuration in which pi-hole uses a macvlan like before, but also a bridge in a different subnet. I then specify the DNS of the container as well. Same goes for unbound. This has the nice effect that I can route the host of the Container through Pi-Hole as well and my tv and my phone, which only did a connection test request through Pi-Hole and then vanished with their requests.

I will post the guide from GitHub soon. I don't even know why I didn't stumble earlier about this guide. I can't imagine how many people are using Pi-Hole wrong.