Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.


timmmay

16528 posts

Uber Geek

Trusted
Subscriber

#255682 23-Aug-2019 15:07
Send private message

I'm on 2degrees and just enabled IPv6 at the router / OS level. I'd like to make sure ad blocking will continue be effective. Does the PiHole (v4.3) do this by default, or do I need to do something to enable it?

 

I can see this in my pihole logs, which suggests it is seeing IPv6 DNS requests.

 

 

 

 

2019-08-23 15:00:28

 

AAAA

 

e.crashlytics.com

 

192.168.1.12

 

Blocked (gravity)

 

 

 

2019-08-23 15:00:28

 

A

 

e.crashlytics.com

 

192.168.1.12

 

Blocked (gravity)

 

 

 

 

 

 

I guess that since DNS queries are by domain name the version of IP being used is largely irrelevant?

 

 


View this topic in a long page with up to 500 replies per page Create new topic
 1 | 2
mentalinc
2044 posts

Uber Geek

Trusted
Subscriber

  #2304850 23-Aug-2019 17:01
Send private message

I have a "helper script".

 

Posting here so I can paste the code later





CPU: Intel 3770k| RAM: F3-2400C10D-16GTX G.Skill Trident X |MB:  Gigabyte Z77X-UD5H-WB | GFX: GV-N660OC-2GD gv-n660oc-2gd GeForce GTX 660 | Monitor: Qnix 27" 2560x1440

 

 


mentalinc
2044 posts

Uber Geek

Trusted
Subscriber

  #2304903 23-Aug-2019 20:05
Send private message

And here is the helper script I use, note the crontab addition to have it auto update.

 

https://github.com/stevejenkins/pihole-utils/blob/master/pihole_ipv6_check





CPU: Intel 3770k| RAM: F3-2400C10D-16GTX G.Skill Trident X |MB:  Gigabyte Z77X-UD5H-WB | GFX: GV-N660OC-2GD gv-n660oc-2gd GeForce GTX 660 | Monitor: Qnix 27" 2560x1440

 

 


 
 
 
 


timmmay

16528 posts

Uber Geek

Trusted
Subscriber

  #2304909 23-Aug-2019 20:34
Send private message

Thanks Mr Mental. Looks like the script adds the IPv6 address to the PiHole config. Why is that helpful?


timmmay

16528 posts

Uber Geek

Trusted
Subscriber

  #2304920 23-Aug-2019 21:24
Send private message

Oddly, I'm getting a LOT more advertising on stuff.co.nz since I enabled IPv6. I checked a few other sites, no problem.

 

I enabled that script, but it said nothing needed changing. It's on cron now.


nzkc
900 posts

Ultimate Geek


  #2304941 23-Aug-2019 22:07
Send private message

I'm a 2degrees customer using Pihole with IPv6. I let the router do the all the dhcp. All I (believe I) had to do was enable the dns advertisement in IPv6. All works as you'd expect.

Afraid I'm away from home right now. But I'll post my config tomorrow if you haven't got it sorted.

timmmay

16528 posts

Uber Geek

Trusted
Subscriber

  #2304984 24-Aug-2019 06:40
Send private message

nzkc: I'm a 2degrees customer using Pihole with IPv6. I let the router do the all the dhcp. All I (believe I) had to do was enable the dns advertisement in IPv6. All works as you'd expect.

Afraid I'm away from home right now. But I'll post my config tomorrow if you haven't got it sorted.

 

Can you tell me about this please?

 

I have DHCP set to return the pi-hole as the DNS server. That way every device on the network automatically uses pi-hole. Using a Fritzbox 7390.

 

I suspect (maybe) some IPv6 sites are going direct to ISP DNS rather than via pi-hole. Obviously I want to block ads that way too.

 

It's odd that stuff ads are showing (they weren't yesterday). Stuff is definitely on IP6, NZHerald definitely isn't.


ANglEAUT
1237 posts

Uber Geek

Trusted

  #2305113 24-Aug-2019 10:36
Send private message

timmmay:

 

I have DHCP set to return the pi-hole as the DNS server. That way every device on the network automatically uses pi-hole. Using a Fritzbox 7390.

 

...

 

It's odd that stuff ads are showing (they weren't yesterday). Stuff is definitely on IP6, NZHerald definitely isn't.

 

 

No Stuff ads for me.

 

Double check the basics:

 

* Is your Pi-hole configure to block IPv6 ads? (I don't have the web interface, but you can run pihole reconfigure from the command line to set everything up again. Also try pihole -a interface all)

 

* On your Fritzbox, have you set both your IPv4 and IPv6 DNS servers?
Click to see full size
...
Click to see full size

 

* Also, in what order is your client using the DNS servers? Seems like mine is using IPv6 first
Click to see full size
Click to see full size






Please keep this GZ community vibrant by contributing in a constructive & respectful manner.


 
 
 
 


timmmay

16528 posts

Uber Geek

Trusted
Subscriber

  #2305127 24-Aug-2019 11:06
Send private message

I haven't configured IP6 DNS server. My pihole has a what I guess is a dynamic IP 6 address, so if it changes I would have to reconfigure the Fritzbox manually. Can I assign a static IP 6 address to my pi hole? Or am I missing something?

toejam316
991 posts

Ultimate Geek

Trusted
Lifetime subscriber

  #2305177 24-Aug-2019 11:33
Send private message

I'm INCREDIBLY rusty on IPv6 (I keep trying to forget it), but you should have a static link-local address on your server hosting pihole, so if you configure your router to forward all IPv6 DNS requests to THAT IPv6 address, and then configure the pihole with your provider's public IPv6 DNS, and enable IPv6 filtering, you should start seeing results.

 

Without going and doing any reading, there's a bunch of IPv6 addresses on an interface based on the interfaces MAC address, including a link-local, and if there's an IPv6 prefix being provided (which your ISP is providing), then you should have an address based on that. If your ISP is providing you with static IPv6, then your IPv6 addresses for your network will also be static, IIRC. Damn it, now I'm going to go read IPv6 documentation.

 

The reason you're seeing ads is because you'll be running in dual stack mode, and most IPv6 aware software prefers IPv6 over IPv6 when available, so you're just running standard public DNS with no filtering for anything that has a DNS AAAA record for IPv6, and filtering on everything else that uses IPv4 A records.





Anything I say is the ramblings of an ill informed, opinionated so-and-so, and not representative of any of my past, present or future employers, and is also probably best disregarded.


timmmay

16528 posts

Uber Geek

Trusted
Subscriber

  #2305181 24-Aug-2019 11:37
Send private message

Thanks toejam. I guess I have to do some reading on ip6 and local link addresses to get this working.

nzkc
900 posts

Ultimate Geek


  #2305208 24-Aug-2019 11:59
Send private message

ANglEAUT:

* On your Fritzbox, have you set both your IPv4 and IPv6 DNS servers?
Click to see full size
...
Click to see full size


* Also, in what order is your client using the DNS servers? Seems like mine is using IPv6 first
Click to see full size
Click to see full size




Pretty sure this will be what you are missing. Set it to your network local IPv6 address (fe80...... from memory) for your Pihole.

I guess the alternative would be to disable the IPv6 dns. Your pihole will still respond with IPv6 (AAAA) addresses to your clients.

timmmay

16528 posts

Uber Geek

Trusted
Subscriber

  #2305213 24-Aug-2019 12:10
Send private message

Thanks, I will try that later.

timmmay

16528 posts

Uber Geek

Trusted
Subscriber

  #2305471 24-Aug-2019 21:09
Send private message

Ok, I've made some progress. Things aren't working quite yet, I'm still seeing ads on stuff, but I understand this a bit more and I'm close.

 

First, the fc00::/7 is a "unique local address" (ULA), which is for private networks. This includes fc00::/8 and fd00::/8. fe80::/8 is the "local link address". The difference is spelled out here.

 

  • I've worked out the IPv6 local link address for my pi.hole, I've configured it in setupVars.conf, and I've run pihole -g to apply it. I'm not sure if I should use this fe80 or an fd00 really.
  • I've configured IPv6 on the Fritz. It has a 2406:: prefix which I believe is a public IPv6 address.
  • I've told the Fritz to "always assign ULA addresses" (which is probably why I have one of those on the pi-hole)
  • I've told the Fritz to Enable DHCPv6 server in the FRITZ!Box for the home network --> Only assign DNS server
  • I've enabled "Also announce DNSv6 server via router advertisement (RFC 5006)" and I've put in the fe80:: local link address for my pi-hole.

When I run ipconfig /all on my PC

 

DNS Servers . . . . . . . . . . . : fd00::9ec7:a6ff:xxxx:xxxx (this is the ULA for my Fritzbox)
                                       192.168.1.x (IPv4 for my pi-hole)
                                       fe80::9b16:3f9c:xxxx:xxx%16 (IPv6 local link address for my pi-hole)
                                       fd00::9ec7:a6ff:xxxx:xxxx (this is the ULA for my Fritzbox again)

 

 

 

TLDR: So it looks like DCHPv6 is sending the IPv6 local link of the pi-hole out, but it's behind the Fritzbox in the order of DNS servers, which means it's not used. When I set the pi-hole as the IPv6 DNS server on my PC it works fine, but I would like it handed out by DHCP so all computers on the network benefit from ad-blocking.

 

Question: Any idea how to get the pi-hole to the top of the list of Fritzbox IPv6 DNS servers?


timmmay

16528 posts

Uber Geek

Trusted
Subscriber

  #2305570 25-Aug-2019 07:15
Send private message

For now I've gone into Internet -> Account information -> DNS Server (tab) and set "use other DNS servers" to my Fritzbox fe80 address, with the 2degrees DNSv6 address as the second address. I might change the second to use the fd00 ULA address if ad-blocking isn't reliable. DNS servers seem to be used round robin rather than first and second.

 

The only downside to this I can think of is if my pi-hole fails I'll have to manually change DNS servers back to ISP supplied.


nzkc
900 posts

Ultimate Geek


  #2305703 25-Aug-2019 13:17
Send private message

I'm not using my Fritz 7390 anymore, however, it sounds like you've got it to where I had it. Although I didn't manually change any IPv6 addresses anywhere. Including the pihole. Can't see it being an issue though.

Happy to dig out the fritz and grab some screenshots if you need them.

 1 | 2
View this topic in a long page with up to 500 replies per page Create new topic





News »

Nanoleaf enhances lighting line with launch of Triangles and Mini Triangles
Posted 17-Oct-2020 20:18


Synology unveils DS16211+
Posted 17-Oct-2020 20:12


Ingram Micro introduces FootfallCam to New Zealand channel
Posted 17-Oct-2020 20:06


Dropbox adopts Virtual First working policy
Posted 17-Oct-2020 19:47


OPPO announces Reno4 Series 5G line-up in NZ
Posted 16-Oct-2020 08:52


Microsoft Highway to a Hundred expands to Asia Pacific
Posted 14-Oct-2020 09:34


Spark turns on 5G in Auckland
Posted 14-Oct-2020 09:29


AMD Launches AMD Ryzen 5000 Series Desktop Processors
Posted 9-Oct-2020 10:13


Teletrac Navman launches integrated multi-camera solution for transport and logistics industry
Posted 8-Oct-2020 10:57


Farmside hits 10,000 RBI customers
Posted 7-Oct-2020 15:32


NordVPN starts deploying colocated servers
Posted 7-Oct-2020 09:00


Google introduces Nest Wifi routers in New Zealand
Posted 7-Oct-2020 05:00


Orcon to bundle Google Nest Wifi router with new accounts
Posted 7-Oct-2020 05:00


Epay and Centrapay partner to create digital gift cards
Posted 2-Oct-2020 17:34


Inseego launches 5G MiFi M2000 mobile hotspot
Posted 2-Oct-2020 14:53









Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.


Support Geekzone »

Our community of supporters help make Geekzone possible. Click the button below to join them.

Support Geezone on PressPatron



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.