Hacker News Reader

Comment by chanandler_bong | Hacker News Reader

If your router can do it, have it route all of your DNS queries to your (pi-hole|adguard|nextdns). Doesn't matter if they are hardcoded to 8.8.8.8, anything to port 53 goes through the blocker.

Asus Merlin firmware handles this nicely.

View on HN

I finally ended up setting up my own router with opnsense which you can do for pretty cheap. Either a pc with two ports, a vm on a server if you are into that , or going dedicated hardware like mentioned above. If you really want to understand what goes on your network this is the way to go.

That brings up the question of what is the best router these days. Mine is getting long in the tooth.

I recently upgraded to an ZenWiFi Pro XT12. Expensive, but I have zero wifi issues now, and with the Merlin firmware, nearly infinite control.

The only downside of the XT12 is that there are no USB ports, so you cannot have external storage. Definitely WTF, but an OK trade-off for me.

Was considering this but concerned it’ll break company laptop dns functionality

If your blocking solution supports it, you can define per-client rules for what is routed to your blocker, or bypasses it.

My work systems bypass everything and I route them to Quad9. If that breaks my work stuff, then the IT department has some splainin to do.

I did exactly this to see how often my chromecast is signaling home. You know how often it contacts google? Over 10.000 times per day.

That's because it's blocked so it tries more often.

Reply on news.ycombinator.com