Do you use one or several providers ?

Do you use it at Browser, Device/OS, Router level ?

What’s your configuration ?

  • ssm@lemmy.sdf.org
    link
    fedilink
    arrow-up
    4
    ·
    edit-2
    4 months ago

    /etc/unwind.conf

    block list "/var/db/unwind_blocklist"
    forwarder { X.X.X.X port X DoT X.X.X.X port X DoT }
    preference { DoT }
    

    unwind_blocklist is generated with this script I wrote:

    #!/bin/sh
    # Blocklists for unwind(8)
    
    blocklist=/var/db/unwind_blocklist
    [ ! -f $blocklist ] && \
            (umask 117; touch $blocklist && chgrp _unwind $blocklist)
    
    {
            ftp -V -o - \
                https://blocklistproject.github.io/Lists/alt-version/everything-nl.txt \
                http://winhelp2002.mvps.org/hosts.txt \
                http://sysctl.org/cameleon/hosts \
                https://s3.amazonaws.com/lists.disconnect.me/simple_tracking.txt \
                https://s3.amazonaws.com/lists.disconnect.me/simple_ad.txt \
                https://raw.githubusercontent.com/Perflyst/PiHoleBlocklist/master/android-tracking.txt
            echo twitter.com
            echo www.twitter.com
            echo www.x.com
            echo x.com
            echo facebook.com
            echo www.facebook.com
    } | awk -safe '
            !/^M|#|(^|\.)[[:blank:]]*$|^definitely_not_porn$/ {       
                    if ($1 ~ /127\.0\.0\.1|0\.0\.0\.0/) {
                            $0 = $2
                    }
                    if ($0 ~ /[[:upper:]]/) {
                            print tolower($0)
                    } else {
                            print $0
                    }
            }
    ' | sort -u >$blocklist
    rcctl restart unwind
    

    Regenerates occasionally with cron.

  • Darkassassin07@lemmy.ca
    link
    fedilink
    English
    arrow-up
    3
    ·
    edit-2
    4 months ago

    Two piholes at home (redundancy). Those both translate all regular DNS requests to DoH using Cloudflared which rotate through 4 non-isp upstream DoH providers.

    The router is set to block all port 53 traffic from leaving the network and handout the 2 pihole IPs to dhcp clients for dns. If a LAN device wants regular dns, it MUST use the lan servers or it’ll get no response. (or it can use its own DoH setup and/or vpn out of the network). This enforces the ad/telemetry/malware blocking lists pihole uses without having to configure dns on everything.

    Those piholes also keep lists/records in sync using Gravity-Sync. Should I change ad lists or add/remove lan dns records, I don’t have to do it on both.

  • BlackEco@lemmy.blackeco.com
    link
    fedilink
    arrow-up
    2
    ·
    edit-2
    4 months ago

    PiHole with unbound (it’s its own recursive DNS resolver so you don’t depend on Cloudflare, Quad9 and others) set on my local network DHCP, plus AdGuard’s DNS Proxy to use PiHole outside my home on my phone through DNS over TLS.

    • N0x0n@lemmy.ml
      link
      fedilink
      arrow-up
      1
      ·
      4 months ago

      That’s something I have to look into. I think I gave it a try but failed. Having everything on a old spare laptop doesn’t help either (docker, vpn, dns resolver, pihole,firewall…).

      Can’t wait to put my n100 as router into my network and give it a second try :)))

  • communism@lemmy.ml
    link
    fedilink
    arrow-up
    1
    ·
    4 months ago

    I just use Mullvad VPN’s default DNS servers (with ad blocking, tracker blocking, and malware blocking)

  • Andromxda 🇺🇦🇵🇸🇹🇼@lemmy.dbzer0.com
    link
    fedilink
    English
    arrow-up
    1
    ·
    4 months ago

    When using the network-wide VPN configuration of my firewall, I also use OPNSense to enforce that all devices connect to my self-hosted Pi-Hole, including redirecting DNS packets that are sent to DNS servers other than my Pi-Hole IP. There’s a pretty cool guide for this: https://forum.opnsense.org/index.php?topic=9245.0

    When running a VPN client on a device, I just use the VPN to manage DNS settings.
    Both Mullvad and IVPN have very solid DNS settings within their desktop clients. Proton VPN unfortunately lacks behind in this regard. That’s why I never use any Proton VPN clients on desktop, and rely on OPNSense, if I want to use Proton.

  • donkeystomple@lemmy.ml
    link
    fedilink
    English
    arrow-up
    1
    ·
    4 months ago

    I use NextDNS. I use it network wide on my home internet and also have it installed on all my devices.

  • shortwavesurfer@lemmy.zip
    link
    fedilink
    arrow-up
    1
    ·
    4 months ago

    I use Control-D, both on Android, through DNS over TLS, and at the router level, so that I’m protected from ads and malware, no matter whether I’m on cellular data or on Wi-Fi.

  • x@niwego.com
    link
    fedilink
    arrow-up
    0
    arrow-down
    1
    ·
    4 months ago

    @Freuks I use pfsense and force all users to use the DNS that I set on the router, this allows me to use pfblockerNG to block ads, telemetry, etc. Instead, users who use the VPN (MULLVAD) will use the MULLVAD DNS to avoid DNS Leak