Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.




15241 posts

Uber Geek

Trusted
Subscriber

# 255682 23-Aug-2019 15:07
Send private message quote this post

I'm on 2degrees and just enabled IPv6 at the router / OS level. I'd like to make sure ad blocking will continue be effective. Does the PiHole (v4.3) do this by default, or do I need to do something to enable it?

 

I can see this in my pihole logs, which suggests it is seeing IPv6 DNS requests.

 

 

 

 

2019-08-23 15:00:28

 

AAAA

 

e.crashlytics.com

 

192.168.1.12

 

Blocked (gravity)

 

 

 

2019-08-23 15:00:28

 

A

 

e.crashlytics.com

 

192.168.1.12

 

Blocked (gravity)

 

 

 

 

 

 

I guess that since DNS queries are by domain name the version of IP being used is largely irrelevant?

 

 


View this topic in a long page with up to 500 replies per page Create new topic
 1 | 2
1752 posts

Uber Geek

Trusted

  # 2304850 23-Aug-2019 17:01
Send private message quote this post

I have a "helper script".

 

Posting here so I can paste the code later





CPU: Intel 3770k| RAM: F3-2400C10D-16GTX G.Skill Trident X |MB:  Gigabyte Z77X-UD5H-WB | GFX: GV-N660OC-2GD gv-n660oc-2gd GeForce GTX 660 | Monitor: Qnix 27" 2560x1440

 

 


1752 posts

Uber Geek

Trusted

  # 2304903 23-Aug-2019 20:05
Send private message quote this post

And here is the helper script I use, note the crontab addition to have it auto update.

 

https://github.com/stevejenkins/pihole-utils/blob/master/pihole_ipv6_check





CPU: Intel 3770k| RAM: F3-2400C10D-16GTX G.Skill Trident X |MB:  Gigabyte Z77X-UD5H-WB | GFX: GV-N660OC-2GD gv-n660oc-2gd GeForce GTX 660 | Monitor: Qnix 27" 2560x1440

 

 


 
 
 
 




15241 posts

Uber Geek

Trusted
Subscriber

  # 2304909 23-Aug-2019 20:34
Send private message quote this post

Thanks Mr Mental. Looks like the script adds the IPv6 address to the PiHole config. Why is that helpful?




15241 posts

Uber Geek

Trusted
Subscriber

  # 2304920 23-Aug-2019 21:24
Send private message quote this post

Oddly, I'm getting a LOT more advertising on stuff.co.nz since I enabled IPv6. I checked a few other sites, no problem.

 

I enabled that script, but it said nothing needed changing. It's on cron now.


702 posts

Ultimate Geek


  # 2304941 23-Aug-2019 22:07
One person supports this post
Send private message quote this post

I'm a 2degrees customer using Pihole with IPv6. I let the router do the all the dhcp. All I (believe I) had to do was enable the dns advertisement in IPv6. All works as you'd expect.

Afraid I'm away from home right now. But I'll post my config tomorrow if you haven't got it sorted.



15241 posts

Uber Geek

Trusted
Subscriber

  # 2304984 24-Aug-2019 06:40
Send private message quote this post

nzkc: I'm a 2degrees customer using Pihole with IPv6. I let the router do the all the dhcp. All I (believe I) had to do was enable the dns advertisement in IPv6. All works as you'd expect.

Afraid I'm away from home right now. But I'll post my config tomorrow if you haven't got it sorted.

 

Can you tell me about this please?

 

I have DHCP set to return the pi-hole as the DNS server. That way every device on the network automatically uses pi-hole. Using a Fritzbox 7390.

 

I suspect (maybe) some IPv6 sites are going direct to ISP DNS rather than via pi-hole. Obviously I want to block ads that way too.

 

It's odd that stuff ads are showing (they weren't yesterday). Stuff is definitely on IP6, NZHerald definitely isn't.


1008 posts

Uber Geek

Trusted

  # 2305113 24-Aug-2019 10:36
Send private message quote this post

timmmay:

 

I have DHCP set to return the pi-hole as the DNS server. That way every device on the network automatically uses pi-hole. Using a Fritzbox 7390.

 

...

 

It's odd that stuff ads are showing (they weren't yesterday). Stuff is definitely on IP6, NZHerald definitely isn't.

 

 

No Stuff ads for me.

 

Double check the basics:

 

* Is your Pi-hole configure to block IPv6 ads? (I don't have the web interface, but you can run pihole reconfigure from the command line to set everything up again. Also try pihole -a interface all)

 

* On your Fritzbox, have you set both your IPv4 and IPv6 DNS servers?
Click to see full size
...
Click to see full size

 

* Also, in what order is your client using the DNS servers? Seems like mine is using IPv6 first
Click to see full size
Click to see full size






Please keep this GZ community vibrant by contributing in a constructive & respectful manner.


 
 
 
 




15241 posts

Uber Geek

Trusted
Subscriber

  # 2305127 24-Aug-2019 11:06
Send private message quote this post

I haven't configured IP6 DNS server. My pihole has a what I guess is a dynamic IP 6 address, so if it changes I would have to reconfigure the Fritzbox manually. Can I assign a static IP 6 address to my pi hole? Or am I missing something?

827 posts

Ultimate Geek

Trusted

  # 2305177 24-Aug-2019 11:33
Send private message quote this post

I'm INCREDIBLY rusty on IPv6 (I keep trying to forget it), but you should have a static link-local address on your server hosting pihole, so if you configure your router to forward all IPv6 DNS requests to THAT IPv6 address, and then configure the pihole with your provider's public IPv6 DNS, and enable IPv6 filtering, you should start seeing results.

 

Without going and doing any reading, there's a bunch of IPv6 addresses on an interface based on the interfaces MAC address, including a link-local, and if there's an IPv6 prefix being provided (which your ISP is providing), then you should have an address based on that. If your ISP is providing you with static IPv6, then your IPv6 addresses for your network will also be static, IIRC. Damn it, now I'm going to go read IPv6 documentation.

 

The reason you're seeing ads is because you'll be running in dual stack mode, and most IPv6 aware software prefers IPv6 over IPv6 when available, so you're just running standard public DNS with no filtering for anything that has a DNS AAAA record for IPv6, and filtering on everything else that uses IPv4 A records.





Anything I say is the ramblings of an ill informed, opinionated so-and-so, and not representative of any of my past, present or future employers, and is also probably best disregarded.




15241 posts

Uber Geek

Trusted
Subscriber

  # 2305181 24-Aug-2019 11:37
Send private message quote this post

Thanks toejam. I guess I have to do some reading on ip6 and local link addresses to get this working.

702 posts

Ultimate Geek


  # 2305208 24-Aug-2019 11:59
Send private message quote this post

ANglEAUT:

* On your Fritzbox, have you set both your IPv4 and IPv6 DNS servers?
Click to see full size
...
Click to see full size


* Also, in what order is your client using the DNS servers? Seems like mine is using IPv6 first
Click to see full size
Click to see full size




Pretty sure this will be what you are missing. Set it to your network local IPv6 address (fe80...... from memory) for your Pihole.

I guess the alternative would be to disable the IPv6 dns. Your pihole will still respond with IPv6 (AAAA) addresses to your clients.



15241 posts

Uber Geek

Trusted
Subscriber

  # 2305213 24-Aug-2019 12:10
Send private message quote this post

Thanks, I will try that later.



15241 posts

Uber Geek

Trusted
Subscriber

  # 2305471 24-Aug-2019 21:09
Send private message quote this post

Ok, I've made some progress. Things aren't working quite yet, I'm still seeing ads on stuff, but I understand this a bit more and I'm close.

 

First, the fc00::/7 is a "unique local address" (ULA), which is for private networks. This includes fc00::/8 and fd00::/8. fe80::/8 is the "local link address". The difference is spelled out here.

 

  • I've worked out the IPv6 local link address for my pi.hole, I've configured it in setupVars.conf, and I've run pihole -g to apply it. I'm not sure if I should use this fe80 or an fd00 really.
  • I've configured IPv6 on the Fritz. It has a 2406:: prefix which I believe is a public IPv6 address.
  • I've told the Fritz to "always assign ULA addresses" (which is probably why I have one of those on the pi-hole)
  • I've told the Fritz to Enable DHCPv6 server in the FRITZ!Box for the home network --> Only assign DNS server
  • I've enabled "Also announce DNSv6 server via router advertisement (RFC 5006)" and I've put in the fe80:: local link address for my pi-hole.

When I run ipconfig /all on my PC

 

DNS Servers . . . . . . . . . . . : fd00::9ec7:a6ff:xxxx:xxxx (this is the ULA for my Fritzbox)
                                       192.168.1.x (IPv4 for my pi-hole)
                                       fe80::9b16:3f9c:xxxx:xxx%16 (IPv6 local link address for my pi-hole)
                                       fd00::9ec7:a6ff:xxxx:xxxx (this is the ULA for my Fritzbox again)

 

 

 

TLDR: So it looks like DCHPv6 is sending the IPv6 local link of the pi-hole out, but it's behind the Fritzbox in the order of DNS servers, which means it's not used. When I set the pi-hole as the IPv6 DNS server on my PC it works fine, but I would like it handed out by DHCP so all computers on the network benefit from ad-blocking.

 

Question: Any idea how to get the pi-hole to the top of the list of Fritzbox IPv6 DNS servers?




15241 posts

Uber Geek

Trusted
Subscriber

  # 2305570 25-Aug-2019 07:15
Send private message quote this post

For now I've gone into Internet -> Account information -> DNS Server (tab) and set "use other DNS servers" to my Fritzbox fe80 address, with the 2degrees DNSv6 address as the second address. I might change the second to use the fd00 ULA address if ad-blocking isn't reliable. DNS servers seem to be used round robin rather than first and second.

 

The only downside to this I can think of is if my pi-hole fails I'll have to manually change DNS servers back to ISP supplied.


702 posts

Ultimate Geek


  # 2305703 25-Aug-2019 13:17
Send private message quote this post

I'm not using my Fritz 7390 anymore, however, it sounds like you've got it to where I had it. Although I didn't manually change any IPv6 addresses anywhere. Including the pihole. Can't see it being an issue though.

Happy to dig out the fritz and grab some screenshots if you need them.

 1 | 2
View this topic in a long page with up to 500 replies per page Create new topic



Twitter and LinkedIn »



Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:





News »

Arlo unveils its first video doorbell
Posted 21-Oct-2019 08:27


New Zealand students shortlisted for James Dyson Award
Posted 21-Oct-2019 08:18


Norton LifeLock Launches Norton 360
Posted 21-Oct-2019 08:11


Microsoft New Zealand Partner Awards results
Posted 18-Oct-2019 10:18


Logitech introduces new Made for Google keyboard and mouse devices
Posted 16-Oct-2019 13:36


MATTR launches to accelerate decentralised identity
Posted 16-Oct-2019 10:28


Vodafone X-Squad powers up for customers
Posted 16-Oct-2019 08:15


D Link ANZ launches EXO Smart Mesh Wi Fi Routers with McAfee protection
Posted 15-Oct-2019 11:31


Major Japanese retailer partners with smart New Zealand technology IMAGR
Posted 14-Oct-2019 10:29


Ola pioneers one-time passcode feature to fight rideshare fraud
Posted 14-Oct-2019 10:24


Spark Sport new home of NZC matches from 2020
Posted 10-Oct-2019 09:59


Meet Nola, Noel Leeming's new digital employee
Posted 4-Oct-2019 08:07


Registrations for Sprout Accelerator open for 2020 season
Posted 4-Oct-2019 08:02


Teletrac Navman welcomes AI tech leader Jens Meggers as new President
Posted 4-Oct-2019 07:41


Vodafone makes voice of 4G (VoLTE) official
Posted 4-Oct-2019 07:36



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.


Support Geekzone »

Our community of supporters help make Geekzone possible. Click the button below to join them.

Support Geezone on PressPatron



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.