Is there a way to set up login-accessible DNS using something like Pi-hole?

wh33t · 08-15-2019, 03:24 PM

So I was thinking I'd like to set up a Pi-hole dns service for ad and tracker blocking and I'd like to let friends and family use it as well but only them. Is there a way to somehow limit who can connect to it that is mostly straight forward?

permaroot · 08-15-2019, 07:22 PM

Quote:

Originally Posted by wh33t

So I was thinking I'd like to set up a Pi-hole dns service for ad and tracker blocking and I'd like to let friends and family use it as well but only them. Is there a way to somehow limit who can connect to it that is mostly straight forward?

Just don’t tell anyone else what the IP address is and tell the people you want to use it the IP so they can manually enter its IP as their DNS server

wh33t · 08-15-2019, 07:30 PM

Quote:

Originally Posted by permaroot

Just don’t tell anyone else what the IP address is and tell the people you want to use it the IP so they can manually enter its IP as their DNS server

I'll keep that as an option, but is it possible to make it only access with a login of some sort?

permaroot · 08-15-2019, 07:38 PM

Quote:

Originally Posted by wh33t

I'll keep that as an option, but is it possible to make it only access with a login of some sort?

Not with a sign in option afaik. But you can make an arptables rule on it to only allow certain Mac addresses to access port 53

wh33t · 08-15-2019, 07:41 PM

Quote:

Originally Posted by permaroot

Not with a sign in option afaik. But you can make an arptables rule on it to only allow certain Mac addresses to access port 53

So I would want the mac address of their home routers or their individual devices?

permaroot · 08-15-2019, 07:52 PM

Ohhhh you mean you want them to access it from another network? Not via your router? You’d have to have a static public IP (if you can acquire one from your ISP, and it’ll be extra money) and then port forward traffic to your internal private IP of the pi hole. A lot of work lol

phil.d.g · 08-15-2019, 07:56 PM

wh33t,

Quote:

Not with a sign in option afaik. But you can make an arptables rule on it to only allow certain Mac addresses to access port 53

This won't work for your use case unfortunately. Not if these friends and family members aren't in your house using your wifi.

Can your friends and family get static IP addresses for their home routers? If they can, the easiest way is with iptables. Failing that you could look into DNS over TLS or HTTPS (these are existing things) and then do client authentication with PKI. I'm not sure what software would support such a setup. Failing that a VPN, just don't use the VPN as a default gateway.

wh33t · 08-15-2019, 08:02 PM

Quote:

Originally Posted by phil.d.g

wh33t,

This won't work for your use case unfortunately. Not if these friends and family members aren't in your house using your wifi.

Can your friends and family get static IP addresses for their home routers? If they can, the easiest way is with iptables. Failing that you could look into DNS over TLS or HTTPS (these are existing things) and then do client authentication with PKI. I'm not sure what software would support such a setup. Failing that a VPN, just don't use the VPN as a default gateway.

Ahh, thank you!