What dns do you use on your home router? My isp is faster but most people recommend a public one like cloudflare and Quad9.
This is r/selfhosted after all. Why trust other DNS providers when you can be your own?!
PiHole is for filtering ads I suppose, not familiar with Unbound, but what's dnsmasq for? Feels like unnecessary element here.
It's my DHCP server and it automatically updates its DNS with the DHCP clients.
Pihole uses DNSMASQ under the hood.
You can just configure pihole to be your DHCP server
We don’t do anything easy around here.
I don't want to rely on a 5 year old 5 volt wallwart and an SDCard for my DHCP Server.
I also don't want to rely on Linux for my DHCP server.
My Router is a FreeBSD machine so it made sense to install DNSMASQ on the Router instead.
I also don't want to rely on Linux for my DHCP server.
Interesting, why?
Probably because he keeps breaking it.
But seriously, the best solution factors in what you're comfortable with, play with things in a lab, but use what works in production.
I mean, if someone prefers freebsd over linux - I doubt it's because of inability to configure linux properly.
When someone says "FreeBSD based router" , 90% odds they mean pfSense.
Which isn't a bad way to go, rock solid and friendly clicky UI.
But bare Linux can be rock solid too if you're comfortable with managing it directly.
Or Opnsense. The interface on pfsense leaves a lot to be desired… even though it’s what I use.
It's not pfsense. Not opnsense either. Plain FreeBSD.
Fair enough, could be that too.
Lol!
I wonder if he's installing directly or using something like docker.
Down thread he replies that he's just more familiar and comfortable with FreeBSD, which is fair, I use Linux because I'm more familiar and comfortable with Linux.
Because the Linux distros I have used have a track record of pulling weird things with their repositories and software versions.
Not that it hasn't happened on FreeBSD before, I'm just more comfortable fixing it. Also, I can easily switch my ports tree to a different commit or even a different branch to roll back a breaking change.
I am also very comfortable working with FreeBSDs source code and have made changes to the kernel sources before, although not on my router.
i like to segregate services as much as possible... if i replace my router i don't want to have to sort out all my dhcp reservations for example..
I take regular snapshots of all my jails, VMs and the router to send them over to a backup NAS. The hardware is all completely replaceable.
I'm not planning to change to another type of router anytime soon.
And if I do I'll just have the DHCP as a seperate FreeBSD machine with the same Configs as before.
So for me my setup works and has been running like this ever since I've moved into this place half a year ago.
I wanted to be fancy and all showing you my routers' uptime but I have rebooted it a few days ago:
nils@wesel1:/home/nils/$uptime
9:16PM up 5 days, 9:55, 1 user, load averages: 0.22, 0.09, 0.07
The pihole looks better though:
nils@pihole:~ $ uptime
23:18:29 up 101 days, 22:32, 1 user, load average: 0,08, 0,06, 0,02
Edit: apparently I forgot to set my routers' timezone to UTC+2
My Router is a FreeBSD machine so it made sense to install DNSMASQ on the Router instead.
You can install pihole on your router
I’m running 3 piholes at home. Two on unraid docker containers and 1 on a physical pihole as a backup.
But you'd rely on it for all your DNS resolution?
I can live without DNS for the 2 minutes it takes me to switch to a different upstream.
I can't live without DHCP.
Are you chaining them this way, or are PiHole and Unbound upstreams of dnsmasqs?
My DNSMASQ uses the pihole as upstream and the pihole uses Unbound as upstream. I could have my clients use the pihole directly but I like the automatic DNS updates via DHCP and the ability to use a custom /etc/hosts on the DNSMASQ machine.
yeah, I too like the automatic DNS update via DHCP, but I've configured them both as upstreams of dnsmasq. This way, if pihole breaks for whatever reason, Unbound is here to save the day.
But what do you use upstream 😋
Unbound.
Upstream from unbound
Unbound is a recursor. It talks to the authoritative DNS servers directly.
Thanks, that’s a good answer. You can also use unbound to enable DoT, that’s why I asked.
I’ve had trouble with that, does recursive DNS run well?
From where does the Unbound get the IP address of for example Reddit.com is what they mean
Unbound can block the same stuff that piHole does... no need to use piHole and Unbound
Unbound as a recursive DNS server hides your upstream DNS requests so only ISP can see. There is a use case as outlined in the pihole documentation itself.
Using it as ad block or authoritative server are different functions that I agree are less useful.
Quick question. What is the advantage of using dnsmasq rather than pihole (or in my case adguard's home) built in cashing?
For me it makes sense to have the DHCP server setup on my router. I also use the "expand-hosts" option so that DNSMASQ uses my /etc/hosts as a DNS repository.
I use Unbound with Pi-Hole.
I have it pointed to my domain controller which is set up for root hints and will fall back to my ISP if necessary, as well as caches previous requests within their TTL. This makes DNS insta fast and reliable.
I don't use DNS for filtering as I found it's increasingly becoming a fools errand to the point that I dont prioritize it as something to invest a lot of time into.
Not sure about Apple, but Android won't even use the local DNS specified by DHCP unless you go into the settings and tell it to and sure as shit any decent IOT device will also not use whatever DNS is specified by DHCP, but dial back home to DNS servers provided by the IOT device.
Even blocking outbound 53 or 853 is going to become useless because devices and software intent on serving ads will use secure DNS over HTTPS or change the port. You would have to research every device/software and block 443 to specific IP addresses and A records as well as any other shenanigans.
Just like Roku with the patent for serving ads over top of HDMI inputs on Roku TV's where it's determined that the source is paused (static image) and then it analyzes said paused image to try to find and serve a relevant ad....
Therefore, I wall off IOT devices to their own VLAN and carefully choose what devices I use. For personal computing, I invest effort into things like uBlock Origin and the like for other devices.
They are gonna find a way.... there's only so much cat and mouse I'll do.
devices and software intent on serving ads will use secure DNS over HTTPS
This is, unfortunately, going to spell the end of DNS filtering. DNS over HTTPS is simply impossible to control without resorting to allowlists, which are unworkable for the vast majority of home users.
It's also going to spell the end of ISPs snooping on their customers.
You can use any tool for good or evil.
So instead of multiple ISP's, all differing per county snooping on their own customers on the scale of a single nation, we'll have googles and cloudflares doing it on global scale. I know there are countries where the first one is a really horrible scenario, but there is also a whole lot of them where it's preferably over the second scenario.
Yeah. It makes provisioning local services with the same dns name as the external service a real PITA.
That’s the point.
It’s only a matter of time before Chrome will do it to protect Adsense and Google profit.
At that point I'm going to take another look at HTTPS inspection for the home. It would have to be leaky and it would fail to protect IoT and guest devices, but at least I can give my laptop / desktop / tablet a fighting chance.
Chrome has already started clamping down on certificates. Not allowing self signed certificates for public IP’s isn’t far off.
I don’t think MITM is going to be effective at that point.
This will break a ton of schools. And Chrome is big in schools and will do whatever it takes to stay there.
No it won’t. Schools have mostly switched to device side enforcement and MDM for compliance anyway. Thats how Chrome in particular is designed to work.
Well funded schools perhaps. GoGuardian has the majority of the market, but Linewize is big as well. And Google admin has a lot of functionality where a filter is not even needed. But that changes nothing on the under funded districts stuck in a 5 year iBoss contract. And it is a lot. At least most of the Rocket filters are gone.
I agree - just to add that you can re-write outbound DNS requests to force the use of a given DNS server, even in cases where something else it hard coded. Its not ideal, but for those looking to extend the use of DNS filtering tools it's an option worth mentioning.
Not with DNS over https.
I don't use DNS for filtering as I found it's increasingly becoming a fools errand to the point that I dont prioritize it as something to invest a lot of time into.
It takes less than 10 minutes to pull a pihole container, and while you have some solid points about DNS over HTTPS, at least right now, things like pihole are hugely effective for very little effort.
And if you run openwrt on your main router, it's as simple as installing a package.
About the DNS over HTTPS thing. This why I used to host a TLS Proxy on my firewall. Still trying to fetch a good ngfw for that same purpose.
Use proper application filtering and decrypt TLS. Anyone whining about "man in the middle" can go their own way, I will terminate TLS on my firewall, look at what is in the packets and block what I don't want. If you don't want to, then don't.
I don't use DNS for filtering as I found it's increasingly becoming a fools errand to the point that I dont prioritize it as something to invest a lot of time into.
I use it as an ad filter, but also a product filter. Any product that fights me too hard over who really owns it, is on my do not buy list. Sadly, all TVs are there now so they are simply NEVER connected to the network. I use a Linux box for my TV streams.
Two instances of technitium running as resolvers with blocklists.
Same here! Currently have them serving off my primary and secondary NAS units in containers and it’s been working well.
PiHole (router, blocklist, dns cache) -> Unbound (recursive dns, cache) -> ISP (TLD lookup).
After just a very short while, nearly all of my DNS queries are served from cache, which is super fast.
2x AdGuard Home instances that only relays DNS requests to NextDNS through QUIC
Mind if I ask for your host specs for the two Adguard instance.
I have one running but got into high CPU alert 3 times over the last 2 days. And sometimes it freeze and my home router lost connection to the internet.
I run a MS Azure 1GB 1vCPU
It runs fine on a PiZero. You may have appliances that send a lot of blocked requests. I have a Samsung Smart TV I‘ve outsourced to Blahdns.
I've got 1 VM with 2 CPUs 2GB RAM and 1 container with the same limits, but barely reaching out the limits
I am ashamed to admit that I got rid of all DNS and DHCP stuff. I like to break things a bit too much and that meant that if the server was offline because I broke something I'd have no DNS or DHCP in the network. I tried to solve this by running DHCP on my router but my Fritz Box actually only allows one DNS server in its network settings so if the server went offline, DNS was gone.
Since I own the domain I use internally, I just put a wildcard A record on my domain and that points to the private IP of my server. And then I just use the Google DNS servers.
However, I'm thinking about putting a raspberry pi up for adguard. I have home assistant on a pi as well so that I can't fuck up the smart home when I mess with the server.
I use NextDNS. It's not self hosted and maybe costs $20 per year. It provides virtually all the benefits of self hosting but I can install the app on my phone and other devices for encrypted DNS, adblocking, custom lookups, logging and more. Plus it's always up even when my home servers are down.
Adguardhome which allows you to choose block lists to use. Upstream I'm using quad9
NextDNS
I ended up on next DNS. Turns out routing all the traffic. Over slow ass 4g using tailscale to a pihole wasn't the greatest idea. I do wanna go back to self hosted for my DNS but that requires internet upgrades
DNSMASQ -> Unbound on OPNSense -> 2 piholes
I could configure unbound to do ad blocking but pihole just makes it so easy
NextDNS.
Also NextDNS. I pay for the annual plan because it's a cheap and worthwhile investment.
I'm doing the same. I have different profiles set up for my Tailscale network and my home LAN. It just works.
Ditto. I have no idea why you're being downvoted so hard but this is the way to do it.
Same here. Easily worth the money.
What makes it worth the money?
The only difference between free and paid is the monthly DNS query limit. The product itself is good enough to not need a free tier IMO, I'm happy to support them.
Someone has to maintain that list of threats and keep the infrastructure running. If you aren't paying cash, the company is making you pay in other ways. Google and CloudFlare run "free" services, for example, by monetizing your data.
Basically, the entire point of being self hosted.
Worth using alongside self-hosted Technitium?
Not sure what that is sorry, I don't use it.
DNS+Adblocking on my home network - similar to AdGuard Home or Pihole
It'll be a similar function then, just upstream of your network. Depends at what point in the chain you want the DNS and filtering to happen.
1.1.1.2,9.9.9.11 as you can see I prefer some degree of filtering
I don't run this on a router but I have two BIND9 servers that cache/forward requests to two load balanced VMs running blocky. I also proxy (shown in this diagram ) all http/https requests to these VMs which is where 80% of DNS requests take place.
I really like this configuration with blocky because:
- 70%+ requests are cached (prefetched)
- requests are distrubuted (doh/dot) across 18 upstream resolvers
- all requests pass through rotating VPNs (multiple providers)
- cache is shared between each blocky resolver via redis
- metrics are abundant and (out of the box) easy to collect / visualize
I've tested this for resiliency by shutting down both (random) portions and the entirety of the components --services return consistently upon recovery.
Depends on the vlan, usually pihole>dot/doh to cloudflare/Google some items use ISP, some use lancache>isp.
My main wifi, I use Pihole to unbound.
My kid VLAN, I use pihole to nextdns. NextDNS makes the parental control stuff easier.
Poor kids, glad that my parents didn't know what a DNS was when I was in that age lol
I just look at it as giving them problem solving skills for their future. Lol
Blocky -> DNS over HTTPS to Cloudflare and Google.
Works great!
Blocky is absolutely perfect, lightweight and easy to setup
I really like it. Custom DNS entries are awesome too. Set it and forget it.
Pihole -> Mikrotik ->Quad9
I also block 53 and 853 destination ports on WAN and have drop rule on connections to popular DoH servers to stop devices from bypassing pi-hole.
This did create some problems when I first set it up, but now it it's pretty much error free.
I also have separate unfiltered_network VLAN which does not have access to any other vlans, but also does not block any dns queries to external servers. This is useful for troubleshooting and for WFH devices.
9.9.9.9, it isn't worth running a dns ad blocker imo. Ublock is sufficient.
Used to have pihole but switched to NextDNS and never looked back.
Don't have to think about it and can use it anywhere. Plenty of built in features, more convenient and more use use cases for the average user. No need to think about security risks or networking wizardry.
But you know... YOU CAN USE BOTH, why NOT? Perfect for the power users who tend to have homelabs or users who are very tech leaned.
Both have valid use cases and usability for example on your mobile it's much easier this way since it has built in support on Android as well. Also no need to come up with some weird networking setup back home (VPN or whatever networking virtual magic tricks you can come up with!) to reach your instance while keeping your network safe ( don't open your DNS ports people or any random ports for that matter without appropriate security ! )
It is also a matter of reliability and uptime.
PowerDNS Recursor.
Pi-Hole > Unbound > Root DNS Servers (to avoid French ISP censorship)
Adguard Home to NextDNS
Split Horizon DNS for local devices with SSL for Public DNS - NextDNS with filtering
all local requests a rerouted to local DNS and NextDNS
DoT and DoH is blocked locally
I prefer Cloudflare because it's somewhere in the middle between privacy and speed. If you want even more privacy with the cost of slower speed use Quad9. For both I highly recommend setting up a DNS over TLS proxy in your local network.
DoT via Unbound > cloudflare
Two instances of Adguard Home (AGH), synced using adguardhome-sync.
Using upstream DNS servers (DoT and DoH) like Cloudflare and Google.
Well Australia so can't use the ISP one without censoring. I just use Cloudflare 1.1.1.1 typically, use to use Google by CF is noticeably faster and probable/maybe less tracky ¯_(ツ)_/¯
Anything DNS Australia based sucks. Also there always super slow for some unknown reason. ISP's suck
use namebench to find the fastest dns for your location specifically
Using Nextdns
blocky with DoH to quad9
Ping from the device and you will be able to see which is best for you
Blocky in a cluster of three nodes using DNS over https, with a shared Redis cache. I seem to get ~4ms on average for a request.
Use whomever you are comfortable having the knowledge of your browsing habits, and the ability to block your access.
I use my own root-resolving servers.
I currently have a couple of my local servers running Bind9, with forwarders currently set to GoogleDNS. I have also in the past used Hurricane Electric's DNS servers. Those also host a local domain for local servers.
Originally, I just used plain Bind9, and let it query the root servers itself. Then I found out that, at least with my WAN connection the time, there was a noticeable delay when first resolving a domain. Evidently, running down the chain from root servers to the appropriate server over the WAN connection was slow enough to be noticeable. Better to have the Bind9 servers local (for cached resolves), but forward to a server on the other side of the WAN to handleresolving addresses over a much faster network.
Why Bind9? I learned it over 20 years ago when I first started putting together a home network, and I've had no need to change since.
Unbound that forwards to Cloudflare via DoTLS along with my own blocking rules. I tried PiHole for a while but the automatic blocklists were too problematic and broke too many things - it was a constant battle to whitelist things PiHole had blocked that it shouldn’t have.
I had the same problem. A lot of weird problems started to appear, and it turned out to be Pi-Hole. Took some time before I found that out :’)
My ISP's default DNS server. Don't really see a need to change it.
This should be the answer for most people. The DNS infrastructure was built to be hierarchical and, unless you have a specific need, you should use your upstream server.
The biggest problem with ISP DNS servers is that most of the block specific sites that for example may not be 100% legal. Also they will probably log everything and keep that data forever.
AdGuard > bind(auth) > bind(resolver). Sub 5ms latency thanks to huge caches on the resolver (256GB RAM each).
Ive got NextDNS on all my stuff, it ended up just being easier than self hosting pihole and such. Plus DNS over HTTPS is quite important for privacy.
I have both, Pi-Hole and NextDNS.
Https does nothing when your client uses the ip which dns just provided, isp can easily view it.
“User connected to IP address owned by X company” (most likely Cloudflare or AWS) leaves a lot more to the imagination than “User connected to www.sexytimes.com”
It really depends to be honest, if you are going through a VPN for all your web traffic too, all your ISP is going to see is encrypted DNS requests and then encrypted requests to a VPN server.
I was talking about DoH. For privacy from isp vpn is the only way
My ISP DSN, 1.1.1.1 and 8.8.8.8
As you can see here, people didn't understand your question.
You can always use GRC's | DNS Nameserver Performance Benchmark to see what's best for you. But sticky with your ISP DNS and be happy.
As you can see here, people didn't understand your question.
I'm trying to figure out where you think people are misunderstanding the question
Agreed, looks to me like every comment is talking about their current DNS server. Which as I understood is what was asked 🤔
Exactly. Someone replied to me (and then deleted it) saying "OP was asking about router dns not dhcp" but even then, you can still have your router pointed at an internal DNS.
Lol you are a magnet for dumb people, I responded to a thread yesterday where someone couldn't handle being disagreed with so they blocked you 🤦🏼♂️. At least I think that was you...
edit...yeah it was you with the 321 backup guy...he downvoted me telling him you were right, then blocked me too 😆. This sub loves to get on a mountain shouting 3-2-1 backup as the Holy Grail but skip all of the pieces in between to make your life easier. Backup is the last lines of defense, making your life simpler for simple common problems is adding intelligence to the process. It's why I usually shout back the oft overlooked "cold archives" for important static personal items like tax returns and photos.
Thanks for the support, and sorry you caught some flack for it.
I find many of the homelab, and Synology subs parrot the same things repeatedly without thinking more critically.
Hah no worries on the "flack" I voluntarily put myself in the crossfire and, well, you were right and that guy was spouting nonsense to sound important, just like this top commenter here in this chain.
You can't trust your ISP DNS.
OpenNIC a censorship resistant alternative DNS root.
1.1.1.1 aka cloudflare. my isp dns sucks especially with .me and .xyz TLDs i use them the most so probably haven’t noticed the many more that probably have problems
i use pihole, but i set it up per device instead of on my router, since rhat works best for my home setup and I don’t expose my home server externally at all.
Adguard Home -> lancache -> Google DNS w/ DNSSEC, DoH and DoT
Adguard+ Cloudflare zero trust
pihole + unbound
AdGuard Home with encrypted upstream from various providers.
Next dns for router with lite protection and AdGuard for other devices more protection
ControlD for sure.
Redundant Adguard Home + unbound for interactive devices, Quad9 for everything else.
Dnsmasq -> CF or Mullvad
Free IPA. 3 replicated instances of IPA. Ipa1 acts as the dynamic dns updater used by DHCP(kea). Ipa2&3 act as the primary & secondary for all clients
Pfsense running BIND DNS server.
Adguard
Quad9
NSD+Unbound on the network, and unbound on my laptop (for dns forwarding across multiple networks and blocking).
Note that I manage the zonefiles the classical way, with vi :)
Adguard + traefik
WireGuard running on a separate network for testing and troubleshooting
1: adguard 2: nextdns(since guest wifi can't see adguard)
I use dnsmasq (which makes /etc/hosts entries available to all apps over local dns) and bind (as a local caching bind server and to have the option to go full dns server if desired).
Cloudflare's my backup, but I self-host my primary DNS.
Pihole is my primary DNS for the network, and that resolves out to Cloudflare.
Pihole > OPNsense > Root Servers
I don't use any forwarders. I have bind setup as a recursive resolver, which starts from the root. https://www.internic.net/domain/named.root
CoreDNS for local zone + blocky for filtering
Im using openwrt, with stubby. In that, DNS over TLS, with five diferent public DNS servers that rotates automatically.
Windows ADDNS -> pihole -> cloudflare
Unbound with AdGuard Home
PowerDNS recursor and authoritative. One for LAN, one for tailscale. Managed using DNSControl. I don't really need DNS level adblocking because ublock origin just worked much better, and it didn't block any ads on my TV for some reason anyway.
I ran a replicated AdguardHome setup for many years, forwarding to 1.1.1.1 and 9.9.9.9 - But a few weeks ago, I started experimenting with ControlD.. and I've gone full-tilt with it, even for my internal DNS. I can set-up profiles, and have a specific one that is only available to my house and holiday home routers, so I've even started using it for my internal DNS... I can do split-horizon, without the drama.
my AGH containers are still running, but I'll shut them down once I get back home in a few weeks.
So yeah my edge fw (pfsense) is my dns and it’s forwarder is google but there is also openvpn for the web filter and whatnot
I'm running Technitium with upstream servers.
Used blahdns, but it tended to be somewhat unreliable from time to time.
Used quad9, right until it, along with several other large providers, dropped government sites on the day of presidential elections. (That's how you get fractured internet, BTW)
Currently using local national provider. Setting fully recursive DNS is too much bother for me right now
Pi-holes -> bind 9 -> DNS over TLS to cloudflare (because my ISP decided to inject ads into browsers using DNS)
Adguard home with unbound
Unbound + pfblockerng > cloudflare DOT
ISC DHCP server plus bind9 with DNS black-holing.
NextDNS. We use it on our phones as well, super easy admin, that way without having to configure tailgate + exit node. I like it
Cloudflare / openDNS > Pihole x2. I force every device to use my piholes via masquerading and with tasker automated private dns in android in to my one of my piholes, for when I leave the house, too lazy to use a VPN, I like my internet speed.
I'm too lazy to host my own DNS server, I tried unbound and what a mess, last time I used bind9 I didn't have any issues... Maybe now that I'm getting a new hypervisor machine I might consider it XD
Quad 9, all the way
Mullvad, base.dns.mullvad.net.
Pihole x 2
Pi-hole + DNSCrypt Proxy
Run Technitium for internal DNS, use NextDNS for external forwarders with several block lists. This has served me well.
Pi-hole -> BIND 9
dnsmasq
Opendns - free version of Cisco umbrella. faster than my ISP, I can see my stats with an account, and configure my own filters for my home.
Bind as I need pxe boot. Pihole as adblocker.
10.10.9.2
My own, I configured pfsense to just talk directly to the root DNS servers.
Everything else just uses the pfsense as the dns server.
AdGuard home
points to a pair of bind9 ( local zones & other work'y poc nonsense ) fwd'ing to cloudflared then DoH to 1.1.1.1/1.0.0.1
All of my DHCP ranges provide my clients with my 2 Pi-hole instances (1 on Proxmox node 1 and the other on node 2, both running as LXC containers with Gravity sync for HA)
Each Pi-hole forwards onto Cloudflare for DNS
I could go straight to the root servers, but my current setup is fine
CloudFlare on TLS 1.1.1.1
My pihole, 192.168.178.100 and my second pihole 192.168.178.101. But as I'm using tailscale MagicDNS adds 100.100.100.100 as primary.
After that I don't care :-)
I'm not sure what your goal is?
two adguard home machines one vm and another physical machine and using quad 9 as the upstream.
Pihole + Google DNS over TLS
CloudFlare DNS
Mostly use my own self-hosted DNS, of course.
I run dnsmasq-full with DNSSEC and stubby to route everything in DNS over TLS. My ISP sees just encrypted traffic to ports 853. I don't use ISP's nor Spoogle DNS servers.
I run my own BIND server that uses stubby for upstream requests. STUBBY is configured to make TLS request in round-robin fashion between Cloudflare, Google, and Quad9.
NextDNS
Local recursor with powerdns recusor :)
Unbound 😊
Local adguardhome instance backed by cloudflare and quad9 via DoH
Pihole with a mixture opensource upstream DNS. Most people here suggest unbound, which is easy to set up, but in security I go with the bear attack philosophy: if I’m faster than someone else, the bear won’t attack me. So pihole is fine for now.
Pihole, with upstream of Quad9 and CleanBrowsing's "security" filter.
8 missing replies
DNSMASQ -> PiHole -> Unbound