From b67537f7a055253a5b83b94de550df778098887e Mon Sep 17 00:00:00 2001 From: DL6ER Date: Thu, 24 May 2018 14:11:18 +0200 Subject: [PATCH 1/3] Add IP-AAAA-NODATA description Signed-off-by: DL6ER --- docs/ftldns/blockingmode.md | 25 +++++++++++++++++++++++++ docs/ftldns/configfile.md | 4 ++-- 2 files changed, 27 insertions(+), 2 deletions(-) diff --git a/docs/ftldns/blockingmode.md b/docs/ftldns/blockingmode.md index b3b5ab4..4bcfe80 100644 --- a/docs/ftldns/blockingmode.md +++ b/docs/ftldns/blockingmode.md @@ -21,6 +21,31 @@ doubleclick.net. 2 IN AAAA fda2:2001:4756:0:ab27:beff:ef37: ##### Advantage - Shows blocking page from which blocked webpages can be whitelisted +##### Disadvantages +- Requires a webserver to run on your Pi-hole +- May cause time-outs for HTTPS content even with properly configured firewall rules +- May cause problems with alternating prefixes on IPv6 addresses (see `IP-AAAA-NODATA`) + +## Pi-hole's IPv6 NODATA blocking +`/etc/pihole/pihole-FTL.conf` setting: +``` +BLOCKINGMODE=IP-AAAA-NODATA +``` + +Queries will be answered with the local IP addresses of your Pi-hole (as configured in your `setupVars.conf` file) +``` +;; QUESTION SECTION: +;doubleclick.net. IN ANY + +;; ANSWER SECTION: +doubleclick.net. 2 IN A 192.168.2.11 +doubleclick.net. 2 IN AAAA fda2:2001:4756:0:ab27:beff:ef37:4242 +``` + +##### Advantage +- Shows blocking page from which blocked webpages can be whitelisted +- Serves IPv4-only replies and hence mitigates issues with rotating IPv6 prefixes + ##### Disadvantages - Requires a webserver to run on your Pi-hole - May cause time-outs for HTTPS content even with properly configured firewall rules diff --git a/docs/ftldns/configfile.md b/docs/ftldns/configfile.md index f660f06..695f309 100644 --- a/docs/ftldns/configfile.md +++ b/docs/ftldns/configfile.md @@ -72,9 +72,9 @@ Which privacy level is used? Should `FTL` ignore queries coming from the local machine? ### BLOCKINGMODE -`BLOCKINGMODE=IP|NXDOMAIN` +`BLOCKINGMODE=IP|IP-AAAA-NODATA|NXDOMAIN|NULL` -Should `FTL` reply queries to blocked domains with IPs or `NXDOMAIN`? +How should `FTL` reply to blocked queries? **[More details](blockingmode.md)** From fae77f4fde1a2e0f4713a9b647e3ad9ff5bec291 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Sat, 26 May 2018 20:42:45 +0200 Subject: [PATCH 2/3] Improve Pi-hole's IPv6 NODATA blocking description according to review comments Signed-off-by: DL6ER --- docs/ftldns/blockingmode.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/docs/ftldns/blockingmode.md b/docs/ftldns/blockingmode.md index 4bcfe80..70f07be 100644 --- a/docs/ftldns/blockingmode.md +++ b/docs/ftldns/blockingmode.md @@ -32,14 +32,13 @@ doubleclick.net. 2 IN AAAA fda2:2001:4756:0:ab27:beff:ef37: BLOCKINGMODE=IP-AAAA-NODATA ``` -Queries will be answered with the local IP addresses of your Pi-hole (as configured in your `setupVars.conf` file) +Queries will be answered with the local IPv4 addresses of your Pi-hole (as configured in your `setupVars.conf` file). AAAA queries will answered with `NODATA-IPV6` and clients will only try to reach your Pi-hole over your static IPv4 address ``` ;; QUESTION SECTION: ;doubleclick.net. IN ANY ;; ANSWER SECTION: doubleclick.net. 2 IN A 192.168.2.11 -doubleclick.net. 2 IN AAAA fda2:2001:4756:0:ab27:beff:ef37:4242 ``` ##### Advantage From 4920f0b6f73c2fb3422d8f31b4d868ae032e24b2 Mon Sep 17 00:00:00 2001 From: Mark Drobnak Date: Mon, 28 May 2018 17:06:53 -0400 Subject: [PATCH 3/3] Fix BLOCKINGMODE value for IPv6 NODATA blocking Signed-off-by: Mark Drobnak --- docs/ftldns/blockingmode.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/ftldns/blockingmode.md b/docs/ftldns/blockingmode.md index 70f07be..d243287 100644 --- a/docs/ftldns/blockingmode.md +++ b/docs/ftldns/blockingmode.md @@ -29,7 +29,7 @@ doubleclick.net. 2 IN AAAA fda2:2001:4756:0:ab27:beff:ef37: ## Pi-hole's IPv6 NODATA blocking `/etc/pihole/pihole-FTL.conf` setting: ``` -BLOCKINGMODE=IP-AAAA-NODATA +BLOCKINGMODE=IP-NODATA-AAAA ``` Queries will be answered with the local IPv4 addresses of your Pi-hole (as configured in your `setupVars.conf` file). AAAA queries will answered with `NODATA-IPV6` and clients will only try to reach your Pi-hole over your static IPv4 address