Using PiHole with existing VPN provider?

[morteng85]

Hi all,

I was pointed in the direction of PiHole and it looks very promising, definetly want to give it a spin

One question does arise (probrably more later on): Today im using a VPN provider (ExpressVPN) and their Windows/iOS for setting VPN location. Is this setup still possible if i introduce a PiHole box as a DNS? Im not that network-smart, so please excuse me if the question is dumb, i couldn't find a similar question in here.

Thanks!

[deHakkelaar]

The problem with VPN dialers is that they override DNS settings on the clients and configure the clients to use the DNS server(s) provided by the VPN provider instead of Pi-hole's DNS.
There are ways to break out but this depends on the dialer and OS used on the clients.

A while ago, I searched to find a solution for a Windows client but am not sure if works (at least you have some pointers if read whole thread):

IPVanish & Pihole

Nice you could fix it with the router firmware and is way better solution. But if you are not able to do this with your router firmware, this guy with handle Ashly Ross explains alternative using that netsh commmand: I don't believe there is a way to prevent it from happening, apart from statically assigning the DNS servers on the VPN connection. To change the order in which DNS servers are queried, one is supposed to be able to change the interface binding order as per https://superuser…

EDIT: Or ask "ExpressVPN" if its possible to use your own local DNS server on the LAN ... maybe they have quick answer.

EDIT2: Just realized this bit: "iOS",
if on the road, you'll be needing two VPN dialers if want everything encrypted.
One for ExpressVPN and another to dial into home with OpenVPN where Pi-hole is probably located.

[morteng85]

Hi deHakkelaar,

Thanks for your quick and thorough reply, much appreciated

I have just been in contact with ExpressVPN support and was told that i can use whatever DNS i want. On iOS i would have to setup VPN manually and not use their app though, but thats okay.

So if i understand correctly, since i can set DNS my self with the VPN i should be ready to go and be able to use PiHole and the VPN together?

[lunorian]

Some people worry about DNS Leaks which is why the providers do this however the majority of ISPs only monitor their own DNS Servers, they don't poison other servers, plus with DNSCrypt it's not as big of an issue. Comp > Pi-hole > DNS/DNSCrypt

[deHakkelaar]

Yeah I believe so with some tinkering.
But there are many things to consider.
Like when a client connects to the VPN, the DNS queries going through Pi-hole wont be encrypted when Pi-hole forwards the query to like for example GoogleDNS through the regular route.
And do you only want to redirect blacklisted domains to 0.0.0.0 ... or redirect to the Pihole IP address so Pi-hole can return a blank page/frame instead of an ad.
And do you want to dial into that ExpressVPN when on the road and at same time have Pi-hole do the DNS part.
If on the road, you'll be needing two VPN dialers like pointed out in my previous posting.
Or maybe even if your router supports it, have the router dial into ExpressVPN so all devices on the LAN get routed through the VPN including the DNS queries that Pi-hole forwards upstream.
Am sure there are few other considerations that I didnt think of

[Brighi]

Have you succeeded to configure pihole with expressvpn?