Ubuntu/Bespin/PiHole - Revision history

Unknown user at 05:18, 19 August 2020

2020-08-19T05:18:48Z

← Older revision		Revision as of 05:18, 19 August 2020
Line 3:		Line 3:
	Previous: [[Ubuntu/Bespin/DNS]]		Previous: [[Ubuntu/Bespin/DNS]]

	Next: [[Ubuntu/Bespin/~~Dnsmasq~~]]		Next: [[Ubuntu/Bespin/Iptables]]

	Running PiHole via Docker on Ubuntu 18.04		Running PiHole via Docker on Ubuntu 18.04

Unknown user at 05:18, 19 August 2020

2020-08-19T05:18:36Z

← Older revision		Revision as of 05:18, 19 August 2020
Line 1:		Line 1:
	Up: [[Ubuntu/Bespin]]		Up: [[Ubuntu/Bespin]]

	Previous: [[Ubuntu/Bespin/~~PIA~~]]		Previous: [[Ubuntu/Bespin/DNS]]

	Next: [[Ubuntu/Bespin/Dnsmasq]]		Next: [[Ubuntu/Bespin/Dnsmasq]]

Unknown user: /* Disabling System DNS */

2020-08-19T05:13:13Z

Disabling System DNS

← Older revision		Revision as of 05:13, 19 August 2020
Line 7:		Line 7:
	Running PiHole via Docker on Ubuntu 18.04		Running PiHole via Docker on Ubuntu 18.04

	==~~Disabling~~ System DNS==		==System DNS==

	Note that this guide assumes you have already disabled your systemd-resolvd DNS service		Note that this guide assumes you have already disabled your systemd-resolvd DNS service.

	==Notes on Networking and Ports==		==Notes on Networking and Ports==

Unknown user: /* Notes on Networking and Ports */

2020-08-19T05:12:59Z

Notes on Networking and Ports

← Older revision		Revision as of 05:12, 19 August 2020
Line 6:		Line 6:

	Running PiHole via Docker on Ubuntu 18.04		Running PiHole via Docker on Ubuntu 18.04

			==Disabling System DNS==

			Note that this guide assumes you have already disabled your systemd-resolvd DNS service

	==Notes on Networking and Ports==		==Notes on Networking and Ports==

Unknown user: /* Configure dnsmasq to use PiHole as Upstream DNS */

2020-08-19T04:57:22Z

Configure dnsmasq to use PiHole as Upstream DNS

← Older revision		Revision as of 04:57, 19 August 2020
Line 269:		Line 269:

	==Configure dnsmasq to use PiHole as Upstream DNS==		==Configure dnsmasq to use PiHole as Upstream DNS==

			Note: the improved version of a dnsmasq config file is covered in [[Ubuntu/Bespin/Dnsmasq]]

	Edit <code>/etc/resolv.conf</code> to contain one DNS server, the PiHole:		Edit <code>/etc/resolv.conf</code> to contain one DNS server, the PiHole:

Unknown user: /* Configure Packet Forwarding for Outbound PiHole DNS */

2020-08-19T04:56:46Z

Configure Packet Forwarding for Outbound PiHole DNS

@@ Line 247: / Line 247: @@
 ==Configure Packet Forwarding for Outbound PiHole DNS==
-Now that we have the PiHole services listening on the correct ports (53), devices (lo:1), and interfaces (127.53.0.1), we want to configure the lo:1 loopback device to be able to forward packets to the VPN tunnel device, in case it has an outgoing DNS request.
+Now we have a PiHole service listening on the right port <code>53</code>, device <code>lo:1</code>, and interface <code>127.53.0.1</code>
-If we leave out this step, then dnsmasq will forward DNS queries to the PiHole DNS service, but the PiHole will have no way of sending DNS queries to its upstream servers.
+Next we want to configure the PiHole loopback device <code>lo:1</code> to be able to forward packets to the VPN tunnel, so that DNS requests will be sent through the VPN tunnel and kept secure.
-We will set iptables rules to forward packets from the loopback device that the PiHole is using, through a VPN tunnel, to keep DNS queries secure.
+If we leave out this step, then dnsmasq will forward DNS queries to the PiHole DNS service, but the PiHole will have no way of sending DNS queries to its upstream servers, so it will be a DNS dead end.
 Here is the stanza we'll add to our existing iptables script:
@@ Line 264: / Line 266: @@
      $ipt -A FORWARD -p ${PROTOCOL} -i ${TUN} -o ${DNS} --dport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT
 done
 </pre>

Unknown user at 04:51, 19 August 2020

2020-08-19T04:51:46Z

← Older revision		Revision as of 04:51, 19 August 2020
Line 32:		Line 32:
	* But you can ALSO use any in the CIDR block <code>127.0.0.0/8</code> to create a new loopback IP address. That's a lot of IPs.		* But you can ALSO use any in the CIDR block <code>127.0.0.0/8</code> to create a new loopback IP address. That's a lot of IPs.

	The plan is still the same: set up the PiHole running on <code>127.0~~.10~~.1</code>, and set <code>127.0~~.10~~.1</code> as the only upstream DNS server for dnsmasq to use in <code>/etc/resolv.conf</code>.		The plan is still the same: set up the PiHole running on <code>127.53.0.1</code>, and set <code>127.53.0.1</code> as the only upstream DNS server for dnsmasq to use in <code>/etc/resolv.conf</code>.

	Now, if a client on the AP requests "github.com", the request will go via port 53 to dnsmasq on bespin. dnsmasq will not find it in <code>/etc/hosts</code> so it will look up the upstream nameserver in <code>/etc/resolv.conf</code> (the PiHole at <code>127.0~~.10~~.1</code> port 53) and will pass the DNS request on to the PiHole. The PiHole will determine what to do, and will pass the DNS request upstream if it cannot resolve it.		Now, if a client on the AP requests "github.com", the request will go via port 53 to dnsmasq on bespin. dnsmasq will not find it in <code>/etc/hosts</code> so it will look up the upstream nameserver in <code>/etc/resolv.conf</code> (the PiHole at <code>127.53.0.1</code> port 53) and will pass the DNS request on to the PiHole. The PiHole will determine what to do, and will pass the DNS request upstream if it cannot resolve it.

	===Diagram===		===Diagram===
Line 50:		Line 50:
	\| \| +------+ \|		\| \| +------+ \|
	\| \| \| port \| 4a. PiHole is bound to the loopback interface, \|		\| \| \| port \| 4a. PiHole is bound to the loopback interface, \|
	\| \| \| 53 \| address 127.0~~.10~~.1 port 53, so the client \|		\| \| \| 53 \| address 127.53.0.1 port 53, so the client \|
	\| +----------------+---+-++ DNS request is received by the PiHole. \|		\| +----------------+---+-++ DNS request is received by the PiHole. \|
	\| ^ \| \|		\| ^ \| \|
Line 69:		Line 69:
	\| \| \| ^ 2b. dnsmasq cannot fulfill the request, so it \| OpenVPN \| \|		\| \| \| ^ 2b. dnsmasq cannot fulfill the request, so it \| OpenVPN \| \|
	\| \| \| \| forwards the request to the upstream server \| \| \|		\| \| \| \| forwards the request to the upstream server \| \| \|
	\| \| \| \| in /etc/resolv.conf, 127.0~~.10~~.1 \| (+encryption) \| \|		\| \| \| \| in /etc/resolv.conf, 127.53.0.1 \| (+encryption) \| \|
	\| \| \| \| \| \| \|		\| \| \| \| \| \| \|
	\| \| \| +-------------------------+ +------------+-------+ \|		\| \| \| +-------------------------+ +------------+-------+ \|
Line 81:		Line 81:
	\| \| \| v \| \| \| \| \| wifi card v \| \| \| \| \| \|		\| \| \| v \| \| \| \| \| wifi card v \| \| \| \| \| \|
	\| +----+-------+-----+--------+ +----------+------+ +----------------+-+ +--+---------+----+ \|		\| +----+-------+-----+--------+ +----------+------+ +----------------+-+ +--+---------+----+ \|
	\| \| 127.0~~.10~~.1 \| 127.0.0.1 \| \| 192.168.10.1 \| \| 192.168.0.199 \| \| 10.8.0.17 \| \|		\| \| 127.53.0.1 \| 127.0.0.1 \| \| 192.168.10.1 \| \| 192.168.0.199 \| \| 10.8.0.17 \| \|
	+----------+------------+--------------+--------+---------+-------+---------+----------------+-+-----+-----------------+---------+		+----------+------------+--------------+--------+---------+-------+---------+----------------+-+-----+-----------------+---------+
	^ \|		^ \|
	3. The request is passed \| \|		3. The request is passed \| \|
	from loopback 127.0.0.1 \| \| 6. VPN traffic is encrypted and sent		from loopback 127.0.0.1 \| \| 6. VPN traffic is encrypted and sent
	to loopback 127.0~~.10~~.1 \| 1. A client on the AP asks \| out via wlan0 to the VPN server,		to loopback 127.53.0.1 \| 1. A client on the AP asks \| out via wlan0 to the VPN server,
	\| for DNS info for a domain, \| which handles the DNS requests on		\| for DNS info for a domain, \| which handles the DNS requests on
	\| e.g., "github.com" \| the other side of the tunnel		\| e.g., "github.com" \| the other side of the tunnel
Line 131:		Line 131:
	==Create Loopback Device==		==Create Loopback Device==

	Define a non-standard loopback IP address <code>127.0~~.10~~.1</code> in <code>/etc/network/interfaces</code> so it will be persistent across reboots.		Define a non-standard loopback IP address <code>127.53.0.1</code> in <code>/etc/network/interfaces</code> so it will be persistent across reboots.

	There are two ways to create a new non-standard loopback IP address:		There are two ways to create a new non-standard loopback IP address:
Line 139:		Line 139:
	2. Create a whole new loopback device, called lo:0, that has the specified loopback IP address		2. Create a whole new loopback device, called lo:0, that has the specified loopback IP address

	~~===Approach 1===~~		We use approach 2

	~~Edit the configuration for the loopback device to include an up and down command:~~

	~~TBA~~

	===Approach 2===		===Approach 2===

Unknown user at 04:49, 19 August 2020

2020-08-19T04:49:24Z

← Older revision		Revision as of 04:49, 19 August 2020
Line 1:		Line 1:
	~~{{Main\|~~Ubuntu/Bespin}}		Up: [[Ubuntu/Bespin]]

			Previous: [[Ubuntu/Bespin/PIA]]

			Next: [[Ubuntu/Bespin/Dnsmasq]]

	Running PiHole via Docker on Ubuntu 18.04		Running PiHole via Docker on Ubuntu 18.04

Unknown user: /* Configure Packet Forwarding for Outbound PiHole DNS */

2020-07-08T20:42:55Z

Configure Packet Forwarding for Outbound PiHole DNS

← Older revision		Revision as of 20:42, 8 July 2020
Line 250:		Line 250:

	If we leave out this step, then dnsmasq will forward DNS queries to the PiHole DNS service, but the PiHole will have no way of sending DNS queries to its upstream servers.		If we leave out this step, then dnsmasq will forward DNS queries to the PiHole DNS service, but the PiHole will have no way of sending DNS queries to its upstream servers.

			We will set iptables rules to forward packets from the loopback device that the PiHole is using, through a VPN tunnel, to keep DNS queries secure.

			Here is the stanza we'll add to our existing iptables script:

			<pre>
			# Forward outgoing DNS traffic from lo:1 (PiHole) through PIA tunnel
			DNS="lo:1"
			TUN="tun1"
			PROTOCOLS="udp tcp"
			for PROTOCOL in PROTOCOLS; do
			$ipt -A FORWARD -p ${PROTOCOL} -i ${DNS} -o ${TUN} --dport 53 -j ACCEPT
			$ipt -A FORWARD -p ${PROTOCOL} -i ${TUN} -o ${DNS} --dport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT
			done
			</pre>

			So now the iptables script should look like this:

			<pre>
			#!/bin/bash
			set -e

			ipt="sudo /sbin/iptables"

			# start by flushing all rules and setting defaults
			$ipt -F
			# should we do this?
			#$ipt -P INPUT DROP
			#$ipt -P FORWARD DROP
			$ipt -P INPUT ACCEPT
			$ipt -P FORWARD ACCEPT
			$ipt -P OUTPUT ACCEPT
			$ipt -t nat -F
			$ipt -t mangle -F
			$ipt -F
			$ipt -X

			##################################
			# PIA VPN Tunnels

			# These are PIA tunnels that handle traffic from APs
			PIA_AP_TUNNELS="tun1"
			for TUN in TUNNELS; do
			# Accept all traffic coming in from tunnel
			$ipt -A INPUT -i ${TUN} -j ACCEPT
			# Masquaerade outgoing traffic leaving via the tunnel
			$ipt -t nat -A POSTROUTING -o ${TUN} -j MASQUERADE
			done

			##################################
			# AP-PIA Tunneling

			# Forward outgoing traffic for APs through tunnel
			AP="wlan1"
			TUN="tun1"
			$ipt -A FORWARD -i ${AP} -o ${TUN} -j ACCEPT
			$ipt -A FORWARD -i ${TUN} -o ${AP} -m state --state ESTABLISHED,RELATED -j ACCEPT

			##################################
			# DNS Tunneling

			# Forward outgoing DNS traffic from lo:1 (PiHole) through PIA tunnel
			DNS="lo:1"
			TUN="tun1"
			PROTOCOLS="udp tcp"
			for PROTOCOL in PROTOCOLS; do
			$ipt -A FORWARD -p ${PROTOCOL} -i ${DNS} -o ${TUN} --dport 53 -j ACCEPT
			$ipt -A FORWARD -p ${PROTOCOL} -i ${TUN} -o ${DNS} --dport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT
			done

			# Make rules persistent
			sudo netfilter-persistent save
			</pre>

	==Configure dnsmasq to use PiHole as Upstream DNS==		==Configure dnsmasq to use PiHole as Upstream DNS==

Unknown user: /* Configure dnsmasq to use PiHole as Upstream DNS */

2020-07-08T02:35:28Z

Configure dnsmasq to use PiHole as Upstream DNS

← Older revision		Revision as of 02:35, 8 July 2020
Line 252:		Line 252:

	==Configure dnsmasq to use PiHole as Upstream DNS==		==Configure dnsmasq to use PiHole as Upstream DNS==

			Edit <code>/etc/resolv.conf</code> to contain one DNS server, the PiHole:

			<code>/etc/resolv.conf</code>

			<pre>
			nameserver 127.53.0.1
			</pre>

			Edit the dnsmasq configuration file and update the <code>server=</code> option:

			<code>/etc/dnsmasq.conf</code>

			<pre>
			server=127.53.0.1
			</pre>

	==Create a PiHole Startup Service==		==Create a PiHole Startup Service==