mirror of
https://github.com/pi-hole/docs.git
synced 2024-12-06 19:27:12 +01:00
Pi-hole corrected, other notes added
Signed-off-by: Tom Daykin <tdaykin@live.co.uk>
This commit is contained in:
Tom Daykin
@@ -1,3 +1,5 @@
|
||||
**This is an unsupported configuration created by the community**
|
||||
|
||||
A lot of the Exit Nodes configure their DNS Server to support DNSSEC. You can [test here](https://dnssec.vs.uni-due.de/) whether DNSSEC is enabled for your current DNS Servers.
|
||||
If you want to test again by refreshing the site, please be aware of the notes on the site:
|
||||
|
||||
@@ -6,7 +8,7 @@ A lot of the Exit Nodes configure their DNS Server to support DNSSEC. You can [t
|
||||
1. Flush the DNS cache of your OS (Windows: ipconfig /flushdns)
|
||||
2. Restart browser or clear browser cache
|
||||
|
||||
Note: Flushing Browser/DNS Cache here means restarting pihole (DNS Server), restarting the browser and ideally opening the site in private/incognito mode.
|
||||
Note: Flushing Browser/DNS Cache here means restarting Pi-hole (DNS Server), restarting the browser and ideally opening the site in private/incognito mode.
|
||||
|
||||
#### Alternatives
|
||||
* An alternative would be using [DNSCrypt](https://github.com/pi-hole/pi-hole/wiki/DNSCrypt), but this leaves you in a position where you have to trust the [DNSCrypt resolver](https://dnscrypt.org/dnscrypt-resolvers.html) since your IP is not anonymized - [unless you configure DNSCrypt to route over Tor](https://github.com/jedisct1/dnscrypt-proxy/issues/399#issuecomment-214329222).
|
||||
|
||||
@@ -1,10 +1,9 @@
|
||||
**This is an unsupported configuration created by the community**
|
||||
|
||||
If you want to protect your - unencrypted by default - DNS requests from easily being collected by your ISP or another Adversary between you and your DNS server, you can easily setup pihole to use [Tor](https://www.torproject.org) for hostname resolving. Using DNS over Tor anonymizes your IP by using [Onion-Routing](https://en.wikipedia.org/wiki/Onion_routing).
|
||||
If you want to protect your - unencrypted by default - DNS requests from easily being collected by your ISP or another Adversary between you and your DNS server, you can easily setup Pi-hole to use [Tor](https://www.torproject.org) for hostname resolving. Using DNS over Tor anonymizes your IP by using [Onion-Routing](https://en.wikipedia.org/wiki/Onion_routing).
|
||||
|
||||
#### Contribute to the Tor project
|
||||
If you got spare resources consider [running a Tor Relay](https://www.torproject.org/docs/tor-doc-relay.html.en) (or [Exit](https://blog.torproject.org/tips-running-exit-node)) Node to contribute back to the Tor Network. The default installation doesn't do either of these. And/Or consider [donating](https://donate.torproject.org).
|
||||
\ No newline at end of file
|
||||
|
||||
***
|
||||
### ⚠️ Warnings & Considerations
|
||||
|
||||
@@ -1,3 +1,5 @@
|
||||
**This is an unsupported configuration created by the community**
|
||||
|
||||
You're constantly using new DNS Servers that are located all over the world, so it might happen that sometimes hostname resolving is slow or might not work at all for certain domains. In this cases you have to wait some minutes until you switch to another Tor circuit or configure Tor to accept control connections and send a command that tells Tor to [switch circuits immediately](https://superuser.com/a/139018).
|
||||
|
||||
You could set `ExitNodes` in your torrc to a specific set of Exit nodes that are reliable for you or use only Exit nodes in a [specific country](http://www.b3rn3d.com/blog/2014/03/05/tor-country-codes/) (on Debian derivatives you need to have the `tor-geoipdb` package installed for that to work) and thus avoid problems with DNS lookups to some extend.
|
||||
@@ -26,13 +28,13 @@ This is not recommended, but here are some things you can do:
|
||||
sudo service tor restart
|
||||
```
|
||||
|
||||
**Note:** Using this approach you put strain on Tor Relays in the selected countries only and increase your security vulnerability. It's not nice and not recommended. Also be aware that this change also affects which Exit Nodes are used if you [Route Your Browser Traffic](#your-browser) over the pihole host Tor SocksPort.
|
||||
**Note:** Using this approach you put strain on Tor Relays in the selected countries only and increase your security vulnerability. It's not nice and not recommended. Also be aware that this change also affects which Exit Nodes are used if you [Route Your Browser Traffic](#your-browser) over the Pi-hole host Tor SocksPort.
|
||||
|
||||
##### Solution 2 - Only use specific Exit Nodes
|
||||
1. Navigate to [atlas.torproject.org Top Relays](https://atlas.torproject.org/#toprelays).
|
||||
2. Click on two Relays out of the list.
|
||||
3. Make sure the relay allows Port `53` in his `IPv4 Exit Policy Summary` (and/or `IPv6 Exit Policy Summary` if you want to resolve IPv6 AAAA queries).
|
||||
4. As root copy the `Fingerprint` (Top Right under Relay Details) of those two Relays to the end of your `/etc/tor/torrc` file on the pihole host in the following format:
|
||||
4. As root copy the `Fingerprint` (Top Right under Relay Details) of those two Relays to the end of your `/etc/tor/torrc` file on the Pi-hole host in the following format:
|
||||
|
||||
```
|
||||
ExitNodes Fingerprint1,Fingerprint2
|
||||
@@ -47,20 +49,20 @@ This is not recommended, but here are some things you can do:
|
||||
|
||||
If DNS requests stop resolving at all, you might need to repeat this procedure because the Relays you chosen might've went down.
|
||||
|
||||
**Note:** Using this approach you put strain on single Tor Relays and increase your security vulnerability. It's not nice and not recommended. Also be aware that this change also affects which Exit Nodes are used if you [Route Your Browser Traffic](#your-browser) over the pihole host Tor SocksPort.
|
||||
**Note:** Using this approach you put strain on single Tor Relays and increase your security vulnerability. It's not nice and not recommended. Also be aware that this change also affects which Exit Nodes are used if you [Route Your Browser Traffic](#your-browser) over the Pi-hole host Tor SocksPort.
|
||||
|
||||
**Hint:** You can combine both Solutions and have country codes and fingerprints as `ExitNodes`.
|
||||
|
||||
#### IPv6
|
||||
DNS over Tor only partially supports IPv6 as of now. This is only a problem if your Router or your ISP don't support IPv4 or you want only IPv6 traffic for another reason - if you have both IPv4 and IPv6 available and you don't plan to visit a IPv6 only service, this is no problem at all.
|
||||
|
||||
In general, [if you made sure that you configured your pihole to support IPv6](https://www.reddit.com/r/pihole/comments/7e0jg9/dns_over_tor/dq4wbry/), resolving IPv6 addresses will sometimes work and sometimes not. The reason for this is that Tor Exit nodes only resolve IPv6 queries if they have `IPv6Exit 1` set in their configuration. Tor is [working on a fix](https://trac.torproject.org/projects/tor/ticket/21311) for that - but until that is done and the Tor exit nodes switched to the fixed version, you will run into situations where IPv6 addresses aren't resolvable despite being available in the responsible nameserver. To check whether your current Exit node resolves IPv6 correctly you can run `dig example.com aaaa` (Linux) or `nslookup -q=aaaa example.com` (Windows) on your client.
|
||||
In general, [if you made sure that you configured your Pi-hole to support IPv6](https://www.reddit.com/r/Pi-hole/comments/7e0jg9/dns_over_tor/dq4wbry/), resolving IPv6 addresses will sometimes work and sometimes not. The reason for this is that Tor Exit nodes only resolve IPv6 queries if they have `IPv6Exit 1` set in their configuration. Tor is [working on a fix](https://trac.torproject.org/projects/tor/ticket/21311) for that - but until that is done and the Tor exit nodes switched to the fixed version, you will run into situations where IPv6 addresses aren't resolvable despite being available in the responsible nameserver. To check whether your current Exit node resolves IPv6 correctly you can run `dig example.com aaaa` (Linux) or `nslookup -q=aaaa example.com` (Windows) on your client.
|
||||
|
||||
If you're dependent on IPv6 and can't use IPv4 at all, your only chance is to configure `ExitNodes` in your torrc to only point to Exit nodes that resolve IPv6 correctly. But keep in mind that this approach increases the correlation attack vulnerability if you only have a small amount of `ExitNodes` set.
|
||||
|
||||
Also you can't (afaik) change the internal IPv4 Tor DNS address on the pihole host to an IPv6 one since `DNSPort` doesn't support that - so you need at least internal IPv4 on your pihole host, which is the default on most host systems.
|
||||
Also you can't (afaik) change the internal IPv4 Tor DNS address on the Pi-hole host to an IPv6 one since `DNSPort` doesn't support that - so you need at least internal IPv4 on your Pi-hole host, which is the default on most host systems.
|
||||
#### Exit node fingerprints
|
||||
To get the fingerprint of your current Exit node, you can configure `SocksPort 0.0.0.0:9050` in your torrc, restart tor, point your Browser to use your piholes IP and port 9050 as Socks5 proxy, visit e.g. [check.torproject.org](https://check.torproject.org/) to get your Exit Node IP, search for that IP on [atlas.torproject.org](https://atlas.torproject.org), click on one of the results and it will show the Fingerprint top right under details.
|
||||
To get the fingerprint of your current Exit node, you can configure `SocksPort 0.0.0.0:9050` in your torrc, restart tor, point your Browser to use your Pi-holes IP and port 9050 as Socks5 proxy, visit e.g. [check.torproject.org](https://check.torproject.org/) to get your Exit Node IP, search for that IP on [atlas.torproject.org](https://atlas.torproject.org), click on one of the results and it will show the Fingerprint top right under details.
|
||||
|
||||
These fingerprints can be set as comma separated value for `ExitNodes`. Don't forget to remove the `SocksPort` option and restart tor if you don't need it anymore. Also it should be noted that the Exit node you get over `SocksPort` is not necessarily the same as the one you get when issuing DNS requests over the `DNSPort`, since Tor internally keeps multiple circuits open. Again, setting `ExitNodes` manually is not recommended.
|
||||
|
||||
|
||||
@@ -1,3 +1,5 @@
|
||||
**This is an unsupported configuration created by the community**
|
||||
|
||||
This guide should work for most recent Debian derivatives (raspbian, Ubuntu). Alternatively you can follow a Tor Installation Guide for your Host System.
|
||||
```
|
||||
sudo apt install tor
|
||||
@@ -10,25 +12,25 @@ DNSPort 127.0.10.1:53
|
||||
|
||||
Restart Tor with: `sudo service tor restart`
|
||||
|
||||
Change your pihole upstream DNS server to use `127.0.10.1` in the pihole WebGUI (Settings) under "Upstream DNS Servers" and click "Save".
|
||||
Change your Pi-hole upstream DNS server to use `127.0.10.1` in the Pi-hole WebGUI (Settings) under "Upstream DNS Servers" and click "Save".
|
||||
|
||||
**Note:** It's currently not possible to change the Upstream DNS Server directly in the `/etc/pihole/setupVars.conf` file, the pihole DNS Server won't pick up the change.
|
||||
**Note:** It's currently not possible to change the Upstream DNS Server directly in the `/etc/Pi-hole/setupVars.conf` file, the Pi-hole DNS Server won't pick up the change.
|
||||
|
||||
If you want a recognizable hostname for the Tor DNS in your pihole GUI statistics, edit `/etc/hosts` as root, include the following line at the end and save the changes
|
||||
If you want a recognizable hostname for the Tor DNS in your Pi-hole GUI statistics, edit `/etc/hosts` as root, include the following line at the end and save the changes
|
||||
```
|
||||
127.0.10.1 tor.dns.local
|
||||
```
|
||||
Restart pihole DNS Server for the `/etc/hosts` changes to take effect
|
||||
Restart Pi-hole DNS Server for the `/etc/hosts` changes to take effect
|
||||
```
|
||||
sudo pihole restartdns
|
||||
sudo Pi-hole restartdns
|
||||
```
|
||||
## Testing your configuration
|
||||
|
||||
To see which DNS servers you're using, you can use a DNS Server Leak Test. Some of them don't work with DNS over Tor, [this one](https://dns-leak.com/) does work tho. It should show random DNS Servers. Tor rotates the circuit approximately every 10minutes in default configuration, so it might take 10minutes for you to see a new set of random DNS servers in the Leak Test.
|
||||
|
||||
You can also check the "Forward Destinations over Time" Graph (enabled per default) in your pihole WebGUI - the latest Forward Destinations should only include "local" and "tor.dns.local" (if you updated the `/etc/hosts` file).
|
||||
You can also check the "Forward Destinations over Time" Graph (enabled per default) in your Pi-hole WebGUI - the latest Forward Destinations should only include "local" and "tor.dns.local" (if you updated the `/etc/hosts` file).
|
||||
|
||||
To absolutely make sure that you always use the pihole as DNS Server and to make sure that it handles IPv4 and/or IPv6 blocking if you configured it to do so, you should check which DNS Servers your client is using: `nmcli device show <interface> | grep .DNS` (Linux) or `ipconfig /all` (Windows, and look for **DNS Servers** on your **LAN Adapter**). You should then issue a IPv4 (A) and/or IPv6 (AAAA) DNS query to every IPv4 and/or IPv6 DNS Server that shows up:
|
||||
To absolutely make sure that you always use the Pi-hole as DNS Server and to make sure that it handles IPv4 and/or IPv6 blocking if you configured it to do so, you should check which DNS Servers your client is using: `nmcli device show <interface> | grep .DNS` (Linux) or `ipconfig /all` (Windows, and look for **DNS Servers** on your **LAN Adapter**). You should then issue a IPv4 (A) and/or IPv6 (AAAA) DNS query to every IPv4 and/or IPv6 DNS Server that shows up:
|
||||
|
||||
For Linux:
|
||||
```dig @<IPv4/6-dns-server-address> api.mixpanel.com <A/AAAA>```
|
||||
@@ -36,7 +38,7 @@ sudo pihole restartdns
|
||||
For Windows:
|
||||
```nslookup -server=<IPv4/6-dns-server-address> -q=<A/AAAA> api.mixpanel.com```
|
||||
|
||||
That should give you the pihole IPv4 and/or IPv6 address as Answer and show up as "Pi-holed" in the WebGUI Query Log (assuming you have the default blocklist, otherwise replace `api.mixpanel.com` with any domain on your blocklist).
|
||||
That should give you the Pi-hole IPv4 and/or IPv6 address as Answer and show up as "Pi-holed" in the WebGUI Query Log (assuming you have the default blocklist, otherwise replace `api.mixpanel.com` with any domain on your blocklist).
|
||||
|
||||
If any of the queries doesn't show up in the Query Log you should make sure to configure your pihole/network setup properly ([this thread might help](https://www.reddit.com/r/pihole/comments/7e0jg9/dns_over_tor/dq4kkvg/)).
|
||||
If any of the queries doesn't show up in the Query Log you should make sure to configure your Pi-hole/network setup properly ([this thread might help](https://www.reddit.com/r/Pi-hole/comments/7e0jg9/dns_over_tor/dq4kkvg/)).
|
||||
|
||||
|
||||
@@ -1,27 +1,29 @@
|
||||
**This is an unsupported configuration created by the community**
|
||||
|
||||
To enhance your privacy you might want to route all or part of your Browser Traffic over Tor.
|
||||
## Tor Browser
|
||||
The easiest and most reliable solution would be to use the [Tor Browser](https://www.torproject.org/projects/torbrowser.html.en). Though that won't use your pihole DNS Server out of the box. You can however disable `Proxy DNS when using SOCKS v5` in Tor Browsers Preferences -> Advanced -> Network -> Settings and [make sure](#make-sure-it-works) to point your system to use pihole with DNS over Tor activated.
|
||||
## Your Browser
|
||||
Edit `/etc/tor/torrc` on your pihole as root, include the following line at the end and save the changes
|
||||
### Tor Browser
|
||||
The easiest and most reliable solution would be to use the [Tor Browser](https://www.torproject.org/projects/torbrowser.html.en). Though that won't use your Pi-hole DNS Server out of the box. You can however disable `Proxy DNS when using SOCKS v5` in Tor Browsers Preferences -> Advanced -> Network -> Settings and [make sure](#make-sure-it-works) to point your system to use Pi-hole with DNS over Tor activated.
|
||||
### Your Browser
|
||||
Edit `/etc/tor/torrc` on your Pi-hole as root, include the following line at the end and save the changes
|
||||
```
|
||||
SocksPort 0.0.0.0:9050
|
||||
```
|
||||
**Note:** You should make sure that only your LAN devices are able to access your pihole on port 9050.
|
||||
**Note:** You should make sure that only your LAN devices are able to access your Pi-hole on port 9050.
|
||||
Restart Tor
|
||||
```
|
||||
sudo service tor restart
|
||||
```
|
||||
Point your browser to use your pihole IP or Hostname (e.g. `pi.hole`) and `Port 9050` as Socks5 Proxy. Do not enable `Proxy DNS when using SOCKS v5` and [make sure](#make-sure-it-works) to point your system to use pihole with DNS over Tor activated.
|
||||
Point your browser to use your Pi-hole IP or Hostname (e.g. `pi.hole`) and `Port 9050` as Socks5 Proxy. Do not enable `Proxy DNS when using SOCKS v5` and [make sure](#make-sure-it-works) to point your system to use Pi-hole with DNS over Tor activated.
|
||||
|
||||
* For Chrome you can either use e.g. the [Proxy SwitchyOmega Extension](https://chrome.google.com/webstore/detail/proxy-switchyomega/padekgcemlokbadohgkifijomclgjgif) or start Chrome with [command-line parameters](https://www.chromium.org/developers/design-documents/network-stack/socks-proxy).
|
||||
|
||||
* For Firefox you can either use e.g. the [FoxyProxy Add-on](https://addons.mozilla.org/en-US/firefox/addon/foxyproxy-standard/) or configure the Socks5 Proxy directly in the Firefox Preferences.
|
||||
If you use a Proxy Add-on/Extension you can also e.g. route everything per default over Tor and only whitelist some sites that you need to perform really good.
|
||||
#### Accessing .onion addresses
|
||||
If you want to access .onion addresses with this kind of setup you have to activate [Transparent Access to Tor Hidden Services](https://www.grepular.com/Transparent_Access_to_Tor_Hidden_Services) on the pihole host.
|
||||
If you want to access .onion addresses with this kind of setup you have to activate [Transparent Access to Tor Hidden Services](https://www.grepular.com/Transparent_Access_to_Tor_Hidden_Services) on the Pi-hole host.
|
||||
***
|
||||
#### Notes
|
||||
* Don't define other regular Upstream DNS Servers than the Tor one if you want to avoid that your pihole makes plaintext DNS requests.
|
||||
* Don't define other regular Upstream DNS Servers than the Tor one if you want to avoid that your Pi-hole makes plaintext DNS requests.
|
||||
* From the [Tor Manual](https://www.torproject.org/docs/tor-manual.html.en) regarding `DNSPort`:
|
||||
```
|
||||
This port only handles A, AAAA, and PTR requests
|
||||
|
||||
Reference in New Issue
Block a user