PiHole network wide WITHOUT router access

[SEAL62]

Hi everyone,

 

so as the titel says I would like to use PiHole (runing on a raspberry) networkwide. However I would like the PiHole to work WITHOUT having to set it as a DNS server i my router. Let's say I'm at my friends house and want protection without having to access the router or maybe he even doesn't know his credentials for the router but would like to test the features of PiHole. Other "services" like eblocker do just that so it has to be possible somehow. So can anyone think of a solution to route the trafiic through pihole without setting aything up inside the router.

 

Thanks in advance

 

[AbydosOne]

3 minutes ago, SEAL62 said:

So can anyone think of a solution to route the trafiic through pihole without setting aything up inside the router.

Based on my understanding, no.

 

You could set your computer's DNS server IP to the local IP of the RasPi once it's been assigned an IP, but it's impossible to force every computer on a network to use a specific DNS without either the router (automatically) or you (manually) telling them to.

[duncannah]

Install PiHole on your computer and set the DNS setting on your computer to 127.0.0.1 (localhost). Here's a guide: https://pawelurbanek.com/pihole-local-computer

[SEAL62]

@AbydosOne@duncannah

Yes I know that I could use the DNS locally on my machine but I'm trying to get the networkwide traffic through it.

Eblocker (as an example) does just that. It needs a couple of minutes upon first setup in your network and after that you can just toggle the devices that should use eblocker in their menu withour ever accessing the router or installing/configuring something on your machine.

So, somehow it has to work

[BuckGup]

There are three elegant solutions. One is make a VPN alongside the PiHole and use the PiHoles DNS for your VPN. Downside is you need to connect to the VPN all the time to use the PiHole. Second is setup wiregaurd and use the pihole as it's DNS. This is much faster and accommodates devices like smartphones better as it doesn't drop a connection even if you are roaming between cell towers. Again this requires an encrypted tunnel so some services may block it. You could swap ports to 443 instead of 1164 and use a stunnel to bypass these blocks but the third option might work best for you. Thirdly and finally you could use a DNS proxy and just set it to your pihole. This won't give you any protection but will also have the least amount of issues and highest throughput speeds. There are even apps on IOS for DNS proxies so you should have full devices support too. Only thing sketch about that is you need to open your pihole externally so you'll need to research a lot into securing it.

[SEAL62]

4 minutes ago, BuckGup said:

There are three elegant solutions. One is make a VPN alongside the PiHole and use the PiHoles DNS for your VPN. Downside is you need to connect to the VPN all the time to use the PiHole. Second is setup wiregaurd and use the pihole as it's DNS. This is much faster and accommodates devices like smartphones better as it doesn't drop a connection even if you are roaming between cell towers. Again this requires an encrypted tunnel so some services may block it. You could swap ports to 443 instead of 1164 and use a stunnel to bypass these blocks but the third option might work best for you. Thirdly and finally you could use a DNS proxy and just set it to your pihole. This won't give you any protection but will also have the least amount of issues and highest throughput speeds. There are even apps on IOS for DNS proxies so you should have full devices support too. Only thing sketch about that is you need to open your pihole externally so you'll need to research a lot into securing it.

But those three options would (again) require a configuration on the client. I'm trying to sort of force it onto the users without them having to consent or a way to bypass it.

[BuckGup]

Just now, SEAL62 said:

But those three options would (again) require a configuration on the client. I'm trying to sort of force it onto the users without them having to consent or a way to bypass it.

Then you are going to have to change the option on the router. Even then many IoT devices use hard coded DNSes so they will continue using what they had before

[SEAL62]

1 minute ago, BuckGup said:

Then you are going to have to change the option on the router. Even then many IoT devices use hard coded DNSes so they will continue using what they had before

 

8 minutes ago, SEAL62 said:

Yes I know that I could use the DNS locally on my machine but I'm trying to get the networkwide traffic through it.

Eblocker (as an example) does just that. It needs a couple of minutes upon first setup in your network and after that you can just toggle the devices that should use eblocker in their menu withour ever accessing the router or installing/configuring something on your machine.

So, somehow it has to work

 

[Levent]

There are no elegant solutions for that. 

1. You would have to run a MITM attack on your own network to capture all DNS requests and process them on your pihole (not sure how you one would go about doing that)
2. If your network is mainly wireless, you can also do a Evil Twin Attack.
3. Create a separate network on your pihole device.

[SEAL62]

2 minutes ago, Levent said:

There are no elegant solutions for that. 

1. You would have to run a MITM attack on your own network to capture all DNS requests and process them on your pihole (not sure how you one would go about doing that)
2. If your network is mainly wireless, you can also do a Evil Twin Attack.
3. Create a separate network on your pihole device.

That's actually a good point. MITM might just be what I need for that didn't think about that yet.

[Alex Atkin UK]

On 9/15/2021 at 4:21 PM, SEAL62 said:

That's actually a good point. MITM might just be what I need for that didn't think about that yet.

Without physically putting a device between the router and the network (which you can't do reliably if the clients are connecting to the router over WiFi), its just not possible.  If it was possible, hacking a network would be a whole lot easier which obviously we don't want.

Plus I don't think you can catch anything using encrypted DNS such as DNS over HTTPS or DNS over TLS, as that's the entire point of those technologies.