Hacker News Reader

Comment by iou | Hacker News Reader

Alternatively for MAX_lazyness and convenience I've been using https://nextdns.io, does all the same stuff and is the alternative to cloudflare in Firefox for DNS-over-Https (DOH)

View on HN

Too bad in my country all ISPs are required by the government to intercept (or block) all dns requests except their own dns server to block any domain listed in the national domain blocklist database. DNS on port other than 53 is still working though, so I have set up my pihole to use an upstream dns server that accept connection on a higher port and a cloudflare DoH server as a fallback (not sure why but DoH is really slow here).

Out of curiosity, which country is that (if you're comfortable sharing)? That's a surprising policy I'd not heard of before.

Indonesia. The blocklist mostly contains porn sites, but the government often use it to force foreign companies to comply with their requests (e.g. putting whatsapp on the block list until they comply with the new censorship rule, etc), and also used to censor any websites that offend the government (mostly communist and anti-islamist sites). Even websites that remotely contains nsfw contents end up getting blocked. Reddit and Vimeo is still blocked, tumblr was blocked (until they banned nsfw content recently), and most surprisingly, readthedocs.org was blocked for quite a while before (I'm not even sure why it was blocked in the first place).

The block list database can be accessed here, you can query a domain to see if they're blocked in Indonesia: https://trustpositif.kominfo.go.id/

They could've at least intercepted the requests and applied their blacklist while leaving unblacklisted requests pass through as-is (so you can still use a custom server for the non-banned domains). Not saying I'm in favour of these shenanigans at all but at least if you are forced to do it then better do it with the minimum level of interference possible.

Then you can have your client lookup blacklistedsite.com.yourdomain.com and have yourdomain.com return the record of blacklistedsite.com to bypass filtering.

Just like you could register your own domain and return the record of a blacklisted website?

Of course, but presumably the censoring dns server would never return a censored ip, regardless of domain. Whereas if you were to passthrough all non-blacklisted queries you wouldn't be able to block that, which is why no censor would ever implement it that way.

Which is why you'd end up implementing tunneling for your DNS requests like cloudflared provides.

Presumably you can just VPN through to a VPS with pihole on it?

Is there an advantage in sending all of your DNS queries to a for-profit company vs. setting up your own Pi-hole?

Their privacy policy seems legit[0] but why trust them at all when Pi-hole is an option?

[0] https://nextdns.io/privacy

max laziness and convenience ;)

^^ this

though they do also have some additional security protections for typosquatting, safebrowsing, homoglyphs, threat-intelligence which is also nice. All of which could be done on a pihole though not out of the box when I last used it ~2 years ago.

Also, unless you go through the trouble of setting up unbound, your requests would need to go to an upstream server anyway, so might as well send them to one with the best privacy policy.

No additional hardware required, you can use it to provide some protection to your family without having to worry about remote access to the Pi-Hole to configure things, works for your devices on the go, cheaper than running pi-hole in the cloud yourself unless.

Pricing wise it’s over 2 years worth of service for the price of an original Pi, a good SD card and a case.

The only circumstances where Pi Hole is unquestionably superior is if you are on a network that redirects all DNS requests there are still some ISPs that do that however if you are on such network you probably want to either get off it ASAP or use a VPN.

Interesting, thanks!

I've been thinking about running a Pi-hole at home and redirecting all my phone traffic through it via WireGuard.

I do exactly that, though I run my VPN in the cloud (a scaleway instance which is only 3 euro per month). Using algo for the vpn: https://github.com/trailofbits/algo . I can highly recommend it! Though I had some issues with play store updates being blocked but that's resolved now. Unfortunately google play services are essentially one big spyware collection so it makes sense for it to block them.

I also had to manually provision my Android phone on IKEv2 (ipsec), Algo used to provide a strongswan config but unfortunately they dropped this in favour of wireguard. But you can still set it up manually (and on Samsung devices you don't even need strongswan). Wireguard is faster, yes, but my work blocks pretty much every port they don't know, except IKEv2/ipsec because many contractors use it to connect to their work :)

FWIW, pihole is not tied to any particular hardware. For example:

https://github.com/pi-hole/docker-pi-hole

And in addition you can do other stuff on the pi/device.

One should always have a spare Pi around.

I know I mentioned you can run it in the cloud/hosted, however for most home installations unless you have a dedicated VM server that is always on it does requires additional hardware.

I run pi-hole on my qnap nas at home since it’s always on anyhow.

You can also just install it on Debian. I have it in a VM.

Their install script is at https://install.pi-hole.net

Docs: https://docs.pi-hole.net/main/basic-install/

Yeah that docker is great! Though it lags behind a bit, it's still on 4.2.2.

v5.0 image was released minutes after the main v5.0 release. I've personally not tried :latest, but I am told that works. I prefer to use named tags

I don't think it's live on latest. I just did a fresh pull again (I did it a couple hours ago too) but I don't see the new bar graphs nor the local DNS option.

Edit: Oops I didn't wipe the container. Works now!

I use a smart DNS to unblock streaming web sites that are geo-locked.

It’s a great service but only the first 300k queries are free, then you are no longer offered any of the benefits unless you pay $1.99 per month

Is that not a trivial amount for hands off DNS recursion services? Consider the cost to purchase a Raspberry Pi, set it up, electricity, wear and tear on flash storage, etc

If you point me at a checkout page for $2/month to not even have to think about plugging a Pi in, I’m going to pull my credit card out in a heartbeat. A single coffee costs me more. Think about your time!

Price-wise it'll probably be a no-brainer. Even though a pi can come as cheap as 2 or 3 coffees. A zero is sufficient for pi-hole.

But it's about taking control too. Personally I wouldn't like taking a service even if it were free, over hosting something myself, especially when it's made as easy as Pi-hole does.

> Think about your time!

Pi-hole is a tool to improve your privacy. Handing all your DNS requests to a 3rd party is the exact opposite. Now you have to deal with their privacy policy, track whether that company got hacked or bought etc.

Installing and maintaining pi-hole takes very little time.

Where do you think pi-hole sends your DNS queries?

Nextdns pings are bad for me in south India. Like 8x slower than Cloudflare and 10x slower than Google. So sticking with PiHole at home setup for now and Windscribe VPN outside home.

Reply on news.ycombinator.com