Comment by kingsloi | Hacker News Reader

Comment by kingsloi | Hacker News Reader

Parent Full thread

I used a Pi-Hole for all devices in my house, including my work MacBook. They manage their MacBooks with JamF, so most things are pretty locked down (including DNS settings in System Preferences). Sudo access is only possible if you open up the Self Service app, login, and issue yourself sudo/admin access for 6 hours. Once it expires, you have to issue yourself admin/sudo access again. No sudo = no changing DNS.

I set it and forgot it, until I went to Estes Park, Colorado over the Christmas holidays one year. I travelled with my MacBook just in case anything popped off... and it did. I logged into my MacBook, but quickly realised although I could connect to WiFi as normal, no DNS would resolve (it was pointed to 192.168.1.100 of my home network), and I couldn't connect to anything - including logging in the Self Service app to re-issue sudo access, to change the DNS. I had to walk a new colleague how to handle the scandal over the phone, driving through the mountains... thank goodness for good cell service!

The trick is to have the pi-hole in your home network, and have your router's DHCP server give it out as the DNS server.

That way when you're home, you get the pi-hole, but when on the road, you get whatever DNS is given for the network you're connected to.

The best config I've found is to have the pihole use NextDNS as its upstream server and have the DHCP server on the router hand out the pihole's ip as the DNS server. Have tailscale set up on the pihole as a subnet router so it gives you access to your home network on the move. Then have your tailscale dns point to the tailscale ip of your pihole.

All machines on your local net now use the pihole as dns as handed out by the router, and when you roam tailscale routes your dns to your pihole.

If you're travelling overseas though, it makes sense to reconfigure tailscale to use NextDNS directly so its faster.

Why have pihole at all if you have NextDNS?

Mainly because you can set it to hand out a configured TTL - I set it to provide a min value of 2400 (40 mins) so the frequency of queries reduces and most other queries from across the LAN get answered locally from the pihole cache

Well... If you trust NextDNS and Tailscale. Basically you add man-in-middle to your DNS queries.

You shouldn’t trust your upstream provider if you use a major ISP. Most collect data not only from their own DNS servers but also unencrypted traffic over port 53 and then sell that data.

Using NextDNS allows you to use encrypted DNS upstream (supported out the box with AdGuardHome, unlike pi-hole), meaning your ISP can’t as easily snoop on you. Of course, they still may be monitoring the hosts you connect to and the non-encrypted SNI requests, but that’s a lot more effort and most of the major US ISPs don’t do that at scale. DNS snooping does almost as well and is way easier.

ISP is payed and contracted service. NextDNS is free (300k queries/month) and Tailscale too. Who do you think most likely sell your data to make business?

Yes, this. Although it's not so much a trick and more managing your home network so it's like any other. Computers connected to the network should automatically detect everything they need to work normally, so no manual settings are needed.

Otherwise, as the parent poster realized, moving the device to another network will require manual changes. And then changes again when you get back.

The real trick is to run WireGuard and always be on your home network, benefiting from PiHole

MikroTik's Router OS is able to have pi-hole in container directly on router, as well as Wireguard that is now in OS by default.

I'm just not able to configure custom upstream in pi-hole (ie Unbound or NetDNS). Probably some firewall rule or anything related to setting of container to work with pihole.

Wireguard has now been in the kernel for OpenWRT releases since 20.xx (maybe earlier?) so you don't even need a Pi if you have a decently robust router that will take OpenWRT. Netgear R7800s are a sweet spot for this setup, dual core 1.9ghz ARM A15 and they even have an eSATA port.

I've been meaning to look into WireGuard!

Then you lose all your blocking/filtering when you're least equipped to deal with the noise. I use NextDNS via DoH which a) works the same everywhere and b) encrypts the DNS traffic out of the machine.

This is why I have my rpi4 set up as 1) a Pi-hole, 2) Wireguard VPN host and 3) DHCP DNS server on on my home network. That as long as I am connected to the VPN from my phone I get no ads. If there's any kind of network issue at my house I can just disable the VPN on my phone. This also has a side benefit that I can use my phone's wi-fi hotspot to remote into my work machine at home as needed.

And if you use Pi-VPN too, you can connect back to your home network and get the same network experience on the road :D

Sounds awful, most consumer connections have restricted upstream (like 1200/25 Mbps). Instead just take a travel router (GL-Inet makes nice ones) with you setup to use Wireguard and Mullvad and to internally serve DNS from NextDNS

I take your point. But how do you power this travel router? Also, does it have a 4G/LTE/5G SIM card? Otherwise, what is its modem; i.e. how does it route?

I realized late that you'd asked how it's powered. Most of them are powered from USB-C, so you can use a battery bank to power it or just plug it in.

It connects to wired or WiFi connections and bridges it to a separate internal network and routes all traffic across its VPN tunnel. These are common devices for security conscious travelers. Yes, some support cellular either directly or via USB LTE modems.

That was always on my to do list!

I treat my work laptop as a hostile entity on my network. It connects to a dedicated Wi-Fi network with client isolation enabled and on a dedicated VLAN with no access to other VLANs, just egress to the internet. DHCP serves 8.8.8.8 as DNS.

On the trusted VLAN I use Technitium as DNS and DHCP. I don't use any block lists, though, because I had too many complains from other network users. Technitium is mostly just because it's easy to manage DHCP hostnames and other DNS records in the same UI.

As a person who manages workplace malwar^Wdevice management software, this is a wise choice. You can gather so much information from home networks, just by passively listening.

Care to share any concrete examples on "useful" information that has been gathered this way?

Also, FWIW, I'm assuming this hypothetical software is clever enough to only function in jurisdictions where that would be legal? Spying on your employees home network is a massive no-no here, you'd need some very deep pockets if you wanted to attempt it, because when you are found out you'll be paying a lot of compensation for privacy violations.

In America, if you are using company property at home on your personal network and the company tunnels in and scans your home network for "security" reasons, there's not much recourse.

You would have a very difficult time even proving that they did it unless they told you that it happened or if you were the kind of person whom, bordering on certifiable paranoia, kept logs of all of your home internet traffic.

Even then, the only thing you could do would be to sue the company, a very expensive process with no guarantee of success and that would take years to see any small measure of justice. They would only be liable for the damages you suffered as a result of their theoretically justifiable intrusion into your home network unless they tampered with your systems or downloaded files from your other computers, in which case you may have a criminal complaint against your company, but even with the Federal laws (like 18 U.S.C. § 1030 federal computer hacking) you not only have to prove that they accessed your personal computers without your permission but also that they did so with the "intent to cause harm".

If they did this and then fired you because of what they found, then you might have the slimmest of chances with a good lawyer to both federally prosecute the company and also sue for damages, but you first have to keep a flawless and undebatable log of all network activity on your personal network, bring a work computer to your home, join it to your network, and have someone acting in an official capacity from the company (because some rogue I.T. guy poking around doesn't represent the company and would thus be personally liable for the damages, absolving the company of any guilt) use that computer to access your personal network, snoop around, and download your personal files or data AND cause you some verifiable injury for what was found.

To say that is a tall order is such an understatement it's like saying Mar's Mons Olympus is a pretty big pile of dirt.

Organizations with savvy legal and security teams are going to either not do this in jurisdictions where it's not legal, not do it at all, or be very quiet about it.

I'm not a security professional so take this with a grain of salt but, if I were going to do this I would be listening for things that could conceivably be trying to pop equipment in employee possession. So malicious mDNS advertisements, nmap scans, that kind of thing.

A couple examples:

1. Using tcpdump passively to collect multicast, broadcast, etc with, for example, information such as identity information and in some cases what you're watching on your streaming box. This isn't always encrypted.

2. Using tools to sniff Bluetooth and Wi-Fi information. macOS and Windows includes such tools by default.

Sorry, I am being deliberately vague on purpose.

Treating it as a hostile entity is definitely the right way to go.

Could you please explain what router/access point hardware or software you use to accomplish these VLAN separated WIFIs? Thank you!

Sure! I use TP-Link Omada access points and a mix of managed L2 switches (TP-Link, Unifi, Brocade, Mikrotik). My router is VyOS running on a used commodity SFF box.

I know you can accomplish the same thing with Unifi access points and security gateway and of course Ruckus, Cisco, Aruba, etc will as well. I don't know of any residential equipment that will but I haven't used residential Wi-Fi gear for almost a decade.

The setup is:

- traffic on a particular SSID gets tagged with a VLAN at the AP

- That VLAN is tagged on all of the switch ports between the AP and the router

- the router's firewall is configured to block the guest subnet from the other local subnets and allow internet egress

How do you move files over from work laptop if you want to keep something on homenet?

My bet would be that if they're quarantining their work device, they also don't use it for anything other than work, and don't use any other device for work. If that's the case this would never come up.

Yep, this. No personal stuff on work laptop, with the sole exception of my Spotify login. No work stuff on personal machines other than my payroll login.

Files don't leave my work laptop. If I need to get files into my work laptop (very rarely, usually slack emojis) I email them to my work account or share a Google Drive folder with my work account. These methods are traceable and auditable for my company and, importantly, don't open any of my personal accounts to legal discovery from the company's side as far as I can tell.

how about Hacker News?

Nope. When I want to take a break I flip my KVM over to my personal machine or take my phone out (which dies not participate in BYOD)

Nope, I have a perfectly good personal laptop for that.

Interesting! I should do the same!

Wait, your work laptop only lets you perform administrative tasks on the local machine if it can connect over the internet to corporate, and that includes being unable to modify certain network settings without first having a working network uplink? That sounds like something that was always guaranteed to break in an awkward way, not a particular problem with the DNS server that you happened to be using that day.

Yeah exactly! Just once (every x hours) but always required for anything sudo, and it's really buggy, too. Restarting stuff, installing some stuff with brew sucks especially, even updating some apps all require sudo. I've resulted to stack the prompts in my lower right corner until I have to do to

That's why I ultimately stopped using my pi-hole. It works great most of the time, but there are enough exceptions that other users on my network (wife and kids) weren't able to address. I now use the adguard public DNS service and am quick to toggle it off when connecting to other networks when out and about.

This is why I recommend folks instead use NextDNS and a DoH resolver proxy on their edge device. Plus Pis have poor resilience to power issues which are commonplace.

Using NextDNS you are getting the same capability served by a global anycasted network of resolvers and it can work even on your phone while away from home (because the mobile web is even more gross).

I love, use, and subscribe to NextDNS, but round trip times from my house to their nearest Anycast address are large enough to notice a substantial difference loading webpages, over using a local caching DNS server (or 8.8.8.8 Anycast, for that matter).

Yes, that is true. They don’t have as many PoPs as Google and CloudFlare do. Thus is why I use a local caching resolver in front of it. If you use Firefox on desktop and configure it to use DoH it also internally caches which greatly helps performance.

The benefits outweigh the downsides, and at least in North America the performance is good.

Have you tried adding yourself to the Sudoers file? My work didn’t see that workaround and now I always have sudo permissions.

hate to be "that guy" but you may want to look into the employee consequences of knowingly circumventing the intent of a security control.

You could set up a VPN for cases like that. Just VPN into your home network to have all your usual services and dns

Wouldn't help here, since most people have to use DDNS to connect back home since residential IPs change constantly. And with no DNS resolver, no DDNS lookup, no phone home.

Best way to handle it is to just reconfigure your router to hand out the pihole dns server to all the clients on your network. That way it's automatic when at home, and doesn't override anything when you're away.

Another option is to make your pi-hole semi-public, so you can see it what-ever network you are on. You don't want the world and his dog's flees using your DNS resolver though, so you'd have to arrange some for of port-knocking or other authentication solution to temporarily open up the relevant ports to you (or at least just the network local to you) and not everyone.

Another hack to consider is running pi-hole in a VM or container on the laptop itself, and have it act as a filtering cache for a more public resolver. Though this imparts an administrative load, you no longer have a single pi-hole so either need to configure it separately or arrange for it to be able to sync with config on your main instance.

Both these arrangements will have trouble if you find yourself on a network that blocks DNS requests to anything other than its local resolvers (though for the pi-hole-on-laptop you can always reconfigure pi-hole to look at the local resolvers if/when needed), so the VPN option is better where available. If you have no static IP at your base of operations, there is always the option of a cheap VPS somewhere to be the VPN endpoint – essentially my first paragraph but your “port knocking” is connecting to the VPN, with pi-hole either on that machine or a machine also connected to the same VPN to get around its lack of fixed public address. Though back to the adversarial local network problem: if the network blocks DNS queries to non-local resolvers it is not unlikely to try block VPNs too.

I think tailscale could handle this problem pretty well: https://tailscale.com/kb/1114/pi-hole/

You can configure the default DNS for devices when they connect to tailscale. This way, pi hole is opt in for users who want to set up tailscale.

Disclaimer: I haven't tried this myself since I have Mullvad ad blocking setup and I'm lazy

You could just use Tailscale.

My method is to set up wireguard from my home network to a cheap VPS. I can then VPN into that VPS and get into my home network since the VPS has a static IP

But as others mention tailscale also works

To solve this exact problem PI-Hole is setup as the DNS server on my home router. Hence when out and about the DNS is not bound to Pi-Hole. When I am out I use Tailscale to tunnel my DNS queries to Pi-Hole at my home. Easy and reliable ad blocking on the go.

Reply on news.ycombinator.com