Comment by obituary_latte | Hacker News Reader

Comment by obituary_latte | Hacker News Reader

Parent Full thread

I have run pi-hole on the cheapest tier of Rackspace cloud server for 2+years now with great success. It’s wonderful. Just configure my routers dhcp to set my pi ip for dns and no ads anywhere (YouTube, streaming [except Hulu unfortunately], and general browsing). It’s especially nice now that it seems every company is offering their own streaming apps with ads. Recent example was I wanted to watch an action sports video and firetv had it with the redbull app. Ten or so minutes in and the video was interrupted with “here’s some ads” stinger and then the video immediately resumed. Kinda caught me off guard but produced an instant smile.

One thing to consider though is becoming a dns resolver for any random thing on the net. What I did for this was create a bash script that adds the visiting ip to iptables whitelist. Created an impossible-to-guess php page (pi admin uses php so it’s already installed and ready to go) which takes the REMOTE_ADDR and passes it to the bash script to add to iptables. Makes it super easy to allow ip’s when isp changes address or when visiting family/friends and they want to use it.

"One thing to consider though is becoming a dns resolver for any random thing on the net. What I did for this was create a bash script that adds the visiting ip to iptables whitelist. Created an impossible-to-guess php page (pi admin uses php so it’s already installed and ready to go) which takes the REMOTE_ADDR and passes it to the bash script to add to iptables."

I hesitate to mention this, as it causes heads to explode, but the problem you're describing is nicely solved with port-knocking. Might be easier than setting up the php page, etc. ...

How would that work? How could I set up, for instance, my iPhone to port knock to allow port 53 access to the server from an unknown remote ip?

Edit: found this guide https://www.inmotionhosting.com/support/website/ssh/how-to-u...

Looks like I could just create some bookmarks for the ports and open them sequentially.

I think overall this is a much better solution than messing with php/bash - good idea and thanks!

Pardon my ignorance: can you recommend a good learning material on port knocking?

Here’s an example: https://www.inmotionhosting.com/support/website/ssh/how-to-u... But just search googs for “port knocking” and you’ll find a ton of info.

What's your reasoning on running it on a VPS as opposed to a raspi on your local network?

Because it’s available everywhere e.g. work/family/friends etc. and I can share it with family/friends as well. It’s a lot of fun to see people’s reactions when they see what the net can be like without all of the ads.

I run mine at home but have opened it up to be accessible remotely (just port 53 remotely) so I can use it whilst out and about.

Please do not open port 53. Without proper counter-measures, open resolvers contribute to DNS Amplification attacks. If you have an open resolver, I guarantee that it is being used maliciously. Please close your port 53 and use a VPN to securely access your pihole.

DNS Amplification Attacks: https://www.us-cert.gov/ncas/alerts/TA13-088A

didn't know about that. I'll give that a read later.

Its pretty simple:

> A Domain Name Server (DNS) amplification attack is a popular form of distributed denial of service (DDoS) that relies on the use of publically accessible open DNS servers to overwhelm a victim system with DNS response traffic.

DNS queries are much smaller then DNS responses. Making a huge amount of queries uses less bandwidth then uses to respond - making it a prime candidate for DDOS attacks. Look at your logs, no doubt you will see a large number of requests for various hosts. This is your system being used to attack people. Please close the port.

Reply on news.ycombinator.com