2

I'm using pihole as my DNS on the LAN but I'm trying to use it as my "global" DNS server wherever I am on the planet.

One solution is to use a VPN on my LAN and pihole being set as the default DNS for that VPN gateway. It's fine but it may not be possible to mount a VPN tunnel every time for some reasons.

So I was thinking about opening port 53 on my home router and redirect the traffic to the pihole server.

Apart from being unintentionally DDOS if the DNS server is found and being used but botnets etc., what is the risk of doing that? I guess some people scanning the web may eventually find that DNS server and use it for some (bad) reasons, but in the end is my LAN at risk?

2
  • 3
    "I guess some people scanning the web may eventually find that dns server" - this is not a question of "if" but "when"...and the answer to "when" is likely on the order of a couple hours. Automated crawlers are constantly scanning the entire IP space looking for things like open DNS resolvers. See this writeup if you want to get an idea of what could happen. It is also likely to end up on Shodan.
    – tlng05
    May 10 '20 at 11:00
  • 2
    The "risk" is someone exploiting a vulnerability in your server, allowing full network access. The likelihood of compromise is not something we can guess. It's up to the system/software.
    – schroeder
    May 10 '20 at 11:02
3

Apart from being unintentionally DDOS if the DNS server is found and being used but botnets etc., what is the risk of doing that? I guess some people scanning the web may eventually find that DNS server and use it for some (bad) reasons, but in the end is my LAN at risk?

Any open port increases the attack surface, in theory. Your LAN could be at risk if a serious vulnerability is found in whatever DNS software you use.

The biggest risk is that your DNS server becomes an unwitting participant in DNS amplification attacks. Your home connection could also be flooded with bad traffic and become unavailable due to saturation.

To minimize abuse you could also set up rate limiting (RRL). Here is for example how it is implemented in Bind.

What I usually do for a private DNS service is to configure the resolver (eg Unbound) so that it only listens to a local interface (tun0), that is used by OpenVPN. So it is only visible to VPN clients and not open to the whole Internet.

So the best solution is to use a VPN. You've said this is not convenient in all situations, then something you could do is set up port knocking. This is security by obscurity but seems sufficient to me in this scenario. Here is an example that explains the concept. But since you have a router this will require opening a few ports (those required by the knocking sequence you'll define).

Now correct me if I'm wrong, but I had a look at the doc for Pihole and I have the impression that the built-in DNS 'server' is dnsmasq, so it is only a forwarder that sends requests to upstream servers like Google or OpenDNS. Then this is not a real resolver like Bind or Unbound and the benefit is not so obvious.

However they explain how to use Pi-hole with Unbound: Setting up Pi-hole as a recursive DNS server solution

1
  • Great answer, thanks a lot. I had heard of port knocking a while ago, looks like an answer yes but may not be easy to implement. Regarding Pi-hole, yes it's not a dns server but you can configure pi-hole to forward dns requests to the dns server of your choice (can be the IP of a private dns server). That's why it is my dns gateway to be configured to the clients for me. It allows some easy controls for me.
    – Ozwel
    May 10 '20 at 17:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.