From 60bb89a8c30f864db719328a35b749a6d9e82d25 Mon Sep 17 00:00:00 2001 From: Sascha Moser <28950736+xopez@users.noreply.github.com> Date: Thu, 23 Dec 2021 16:53:58 +0100 Subject: [PATCH 1/8] Include configuration for Debian Bullseye --- docs/guides/vpn/wireguard/internal.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/docs/guides/vpn/wireguard/internal.md b/docs/guides/vpn/wireguard/internal.md index 429b8bd..4fdbd4a 100644 --- a/docs/guides/vpn/wireguard/internal.md +++ b/docs/guides/vpn/wireguard/internal.md @@ -44,6 +44,22 @@ PostDown = iptables -w -t nat -D POSTROUTING -o eth0 -j MASQUERADE; ip6tables -w Substitute `eth0` in the preceding lines to match the Internet-facing interface. This may be `ens2p0` or similar on more recent Ubuntu versions (check, e.g., `ip a` for details about your local interfaces). + +!!! warning "**Important:** Debian Bullseye (Debian 11) and Raspian 11" + Debian Bullseye doesn't include iptables per default and uses nftables. The iptables commands can be easily implemented since the package will automatically translate and import them to nftables. First you need to install iptables: + ```bash + apt install iptables + ``` + + After that you have to set following rules for PostUP and PostDown: + ```bash + PostUp = iptables -w -t nat -A POSTROUTING -o eth0 -j MASQUERADE; ip6tables -w -t nat -A POSTROUTING -o eth0 -j MASQUERADE + PostDown = nft flush ruleset + ``` + + **Be careful with the PostDown command since it will flush all rules!** + + `PostUp` and `PostDown` defines steps to be run after the interface is turned on or off, respectively. In this case, iptables is used to set Linux IP masquerade rules to allow all the clients to share the server’s IPv4 and IPv6 address. The rules will then be cleared once the tunnel is down. From f9a52432b9a3ef65cb823b9a2afb20b15c6fefa4 Mon Sep 17 00:00:00 2001 From: Sascha Moser <28950736+xopez@users.noreply.github.com> Date: Fri, 24 Dec 2021 15:19:37 +0100 Subject: [PATCH 2/8] Add sudo to command --- docs/guides/vpn/wireguard/internal.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/guides/vpn/wireguard/internal.md b/docs/guides/vpn/wireguard/internal.md index 4fdbd4a..757bc5b 100644 --- a/docs/guides/vpn/wireguard/internal.md +++ b/docs/guides/vpn/wireguard/internal.md @@ -48,7 +48,7 @@ PostDown = iptables -w -t nat -D POSTROUTING -o eth0 -j MASQUERADE; ip6tables -w !!! warning "**Important:** Debian Bullseye (Debian 11) and Raspian 11" Debian Bullseye doesn't include iptables per default and uses nftables. The iptables commands can be easily implemented since the package will automatically translate and import them to nftables. First you need to install iptables: ```bash - apt install iptables + sudo apt install iptables ``` After that you have to set following rules for PostUP and PostDown: From 9d8371782429b69656dd99226afcf78b159562de Mon Sep 17 00:00:00 2001 From: mibere Date: Sat, 3 Oct 2020 16:01:04 +0200 Subject: [PATCH 3/8] Update unbound.md Adjust edns-buffer-size (DNS Flag Day 2020), see also https://github.com/NLnetLabs/unbound/commit/b6d04f500bb0f021938d87871f995bc85ca619bf Signed-off-by: DL6ER --- docs/guides/dns/unbound.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/guides/dns/unbound.md b/docs/guides/dns/unbound.md index 3756929..a8e6162 100644 --- a/docs/guides/dns/unbound.md +++ b/docs/guides/dns/unbound.md @@ -111,9 +111,9 @@ server: # see https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378 for further details use-caps-for-id: no - # Reduce EDNS reassembly buffer size. - # Suggested by the unbound man page to reduce fragmentation reassembly problems - edns-buffer-size: 1472 + # DNS Flag Day 2020 recommends a message size of 1232 bytes to avoid IP + # fragmentation while minimizaing the use of TCP + edns-buffer-size: 1232 # Perform prefetching of close to expired message cache entries # This only applies to domains that have been frequently queried From d5d6a106bb5c6709b2afed07148c1fad03e57b57 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Tue, 28 Dec 2021 09:56:01 +0100 Subject: [PATCH 4/8] Add details to EDNS buffer size choice in unbound guide. Also reduce suggested EDNS buffer size in dnsmasq warnings discussion. Signed-off-by: DL6ER --- docs/ftldns/dnsmasq_warn.md | 4 ++-- docs/guides/dns/unbound.md | 25 +++++++++++++++++++++++-- 2 files changed, 25 insertions(+), 4 deletions(-) diff --git a/docs/ftldns/dnsmasq_warn.md b/docs/ftldns/dnsmasq_warn.md index 5d8f6e5..d65f659 100644 --- a/docs/ftldns/dnsmasq_warn.md +++ b/docs/ftldns/dnsmasq_warn.md @@ -130,10 +130,10 @@ Warnings commonly seen in `dnsmasq`'s log file (`/var/log/pihole.log`) and the P You can get rid of the warning by adding a config file like `/etc/dnsmasq.d/99-edns.conf` and adding ``` plain - edns-packet-max=1280 + edns-packet-max=1232 ``` - After running `pihole restartdns` your Pi-hole will not even try larger packet sizes (the default is 4096). + After running `pihole restartdns` your Pi-hole will not even try larger packet sizes (the default is 4096). Check out our [unbound guide](../guides/dns/unbound.md) for a comment about the particular value of `1232`. !!! warning "Ignoring query from non-local network" diff --git a/docs/guides/dns/unbound.md b/docs/guides/dns/unbound.md index a8e6162..790e801 100644 --- a/docs/guides/dns/unbound.md +++ b/docs/guides/dns/unbound.md @@ -111,8 +111,21 @@ server: # see https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378 for further details use-caps-for-id: no - # DNS Flag Day 2020 recommends a message size of 1232 bytes to avoid IP - # fragmentation while minimizaing the use of TCP + # Reduce EDNS reassembly buffer size. + # IP fragmentation is unreliable on the Internet today, and can cause + # transmission failures when large DNS messages are sent via UDP. Even + # when fragmentation does work, it may not be secure; it is theoretically + # possible to spoof parts of a fragmented DNS message, without easy + # detection at the receiving end. Recently, there was an excellent study + # >>> Defragmenting DNS - Determining the optimal maximum UDP response size for DNS <<< + # by Axel Koolhaas, and Tjeerd Slokker (https://indico.dns-oarc.net/event/36/contributions/776/) + # in collaboration with NLnet Labs explored DNS using real world data from the + # the RIPE Atlas probes and the researchers suggested different values for + # IPv4 and IPv6 and in different scenarios. They advise that servers should + # be configured to limit DNS messages sent over UDP to a size that will not + # trigger fragmentation on typical network links. DNS servers can switch + # from UDP to TCP when a DNS response is too big to fit in this limited + # buffer size. This value has also been suggested in DNS Flag Day 2020. edns-buffer-size: 1232 # Perform prefetching of close to expired message cache entries @@ -143,6 +156,14 @@ dig pi-hole.net @127.0.0.1 -p 5335 The first query may be quite slow, but subsequent queries, also to other domains under the same TLD, should be fairly quick. +You should also consider adding + +``` plain +edns-packet-max=1232 +``` + +to a config file like `/etc/dnsmasq.d/99-edns.conf` to signal FTL to adhere to this limit. + ### Test validation You can test DNSSEC validation using From 0a3e46244b671c82efc200185c7335665317f47e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christian=20K=C3=B6nig?= Date: Thu, 30 Dec 2021 20:41:40 +0100 Subject: [PATCH 5/8] Add note how to add comments to pihole-FTL.conf MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Christian König --- docs/ftldns/configfile.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/ftldns/configfile.md b/docs/ftldns/configfile.md index 81b2685..5f38732 100644 --- a/docs/ftldns/configfile.md +++ b/docs/ftldns/configfile.md @@ -1,5 +1,7 @@ You can create a file `/etc/pihole/pihole-FTL.conf` that will be read by *FTL*DNS on startup. +Note: comments need to start with `#;` + Possible settings (**the option shown first is the default**): --- From e77c5b2a9002e46654761698a12764157b0143d4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christian=20K=C3=B6nig?= Date: Fri, 31 Dec 2021 09:44:01 +0100 Subject: [PATCH 6/8] Add explaination why comments should have this syntax MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Christian König --- docs/ftldns/configfile.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/ftldns/configfile.md b/docs/ftldns/configfile.md index 5f38732..75eee83 100644 --- a/docs/ftldns/configfile.md +++ b/docs/ftldns/configfile.md @@ -1,6 +1,6 @@ You can create a file `/etc/pihole/pihole-FTL.conf` that will be read by *FTL*DNS on startup. -Note: comments need to start with `#;` +Note: comments need to start with `#;` to avoid issues with PHP and `bash` reading this file. (See [https://github.com/pi-hole/pi-hole/pull/4081](https://github.com/pi-hole/pi-hole/pull/4081) for more details) Possible settings (**the option shown first is the default**): From 061d4ee2ccb09330cf1d7f77b78c9a56a37d5006 Mon Sep 17 00:00:00 2001 From: Sascha Moser <28950736+xopez@users.noreply.github.com> Date: Fri, 31 Dec 2021 13:35:30 +0100 Subject: [PATCH 7/8] Update internal.md --- docs/guides/vpn/wireguard/internal.md | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/docs/guides/vpn/wireguard/internal.md b/docs/guides/vpn/wireguard/internal.md index 757bc5b..91d9713 100644 --- a/docs/guides/vpn/wireguard/internal.md +++ b/docs/guides/vpn/wireguard/internal.md @@ -46,18 +46,13 @@ PostDown = iptables -w -t nat -D POSTROUTING -o eth0 -j MASQUERADE; ip6tables -w !!! warning "**Important:** Debian Bullseye (Debian 11) and Raspian 11" - Debian Bullseye doesn't include iptables per default and uses nftables. The iptables commands can be easily implemented since the package will automatically translate and import them to nftables. First you need to install iptables: - ```bash - sudo apt install iptables - ``` + Debian Bullseye doesn't include iptables per default and uses nftables. After that you have to set following rules for PostUP and PostDown: ```bash - PostUp = iptables -w -t nat -A POSTROUTING -o eth0 -j MASQUERADE; ip6tables -w -t nat -A POSTROUTING -o eth0 -j MASQUERADE - PostDown = nft flush ruleset + PostUp = nft add table ip wireguard; nft add chain ip wireguard wireguard_chain {type nat hook postrouting priority srcnat\; policy accept\;}; nft add rule ip wireguard wireguard_chain oifname "eth0" counter packets 0 bytes 0 masquerade; nft add table ip6 wireguard; nft add chain ip6 wireguard wireguard_chain {type nat hook postrouting priority srcnat\; policy accept\;}; nft add rule ip6 wireguard wireguard_chain oifname "eth0" counter packets 0 bytes 0 masquerade + PostDown = nft delete table ip wireguard; nft delete table ip6 wireguard ``` - - **Be careful with the PostDown command since it will flush all rules!** `PostUp` and `PostDown` defines steps to be run after the interface is turned on or off, respectively. In this case, iptables is used to set Linux IP masquerade rules to allow all the clients to share the server’s IPv4 and IPv6 address. From 083c7b3a7c5208c7b6817b1c1428e95dfc181923 Mon Sep 17 00:00:00 2001 From: Sascha Moser <28950736+xopez@users.noreply.github.com> Date: Fri, 31 Dec 2021 13:39:56 +0100 Subject: [PATCH 8/8] Update internal.md --- docs/guides/vpn/wireguard/internal.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/guides/vpn/wireguard/internal.md b/docs/guides/vpn/wireguard/internal.md index 91d9713..4fef88d 100644 --- a/docs/guides/vpn/wireguard/internal.md +++ b/docs/guides/vpn/wireguard/internal.md @@ -48,7 +48,7 @@ PostDown = iptables -w -t nat -D POSTROUTING -o eth0 -j MASQUERADE; ip6tables -w !!! warning "**Important:** Debian Bullseye (Debian 11) and Raspian 11" Debian Bullseye doesn't include iptables per default and uses nftables. - After that you have to set following rules for PostUP and PostDown: + We have to set following rules for PostUP and PostDown: ```bash PostUp = nft add table ip wireguard; nft add chain ip wireguard wireguard_chain {type nat hook postrouting priority srcnat\; policy accept\;}; nft add rule ip wireguard wireguard_chain oifname "eth0" counter packets 0 bytes 0 masquerade; nft add table ip6 wireguard; nft add chain ip6 wireguard wireguard_chain {type nat hook postrouting priority srcnat\; policy accept\;}; nft add rule ip6 wireguard wireguard_chain oifname "eth0" counter packets 0 bytes 0 masquerade PostDown = nft delete table ip wireguard; nft delete table ip6 wireguard