[CONTENT-CHANGE]

[lissy93]

[CONTENT-CHANGE]

[Lissy93]

These links might be of help to you, if you're having trouble understanding how to implement this

• Pi-Hole, DoH, DNSCrypt and Cloudflare
• Pi-Hole with DNS over HTTPS using CloudFlare
• Pi-Hole Recursive DNS Server w Unbound
• DNS-over-HTTPS in Unbound
• DNSCrypt Proxy on Pi Hole

As an example, this is how I've set it up in LAN: Clients within my network connect through OPNsense, for inbound/ outbound WireGuard VPN, IDS, monitoring etc. OPNSense forwards DNS queries onto pihole, which will block domains on the blacklist, and for all the rest, it will either immediately return the IP if already cached, or use Unbound to forward any non-cached results with DoH upstream onto NextDNS's servers.

[nocturnalarchives]

You clearly missed the point DOH allows devices on your network to bypass your pihole completing sacrificing your privacy by allowing marketing companies to track you. Maybe if you stopped to think a minute you would grasp this, because you are 1247.2% wrong here.

[rusty-snake]

DOH allows devices on your network to bypass your pihole

Sorry, but this has nothing to do with DoH. Every device in your network can ignore your pihole (e.g. dig @9.9.9.9 github.com). You would need a firewall that does DPI to stop this.

[Lissy93]

Hi @nocturnalarchives - Thanks for raising this issue.

You're DNS lookups expose more than you realize, and DoH (along with other DNS encryption methods) reduces what data can be logged.

Absolutely ad-blocking is important too, but there's no reason why you can't use Pi-Hole alongside DoH, in fact I would recommend you do so (here's an example of a Pi-Hole Docker compose preconfigured with DoH).

[Lissy93]

Thanks for the reply @nocturnalarchives - but I think you're misunderstanding. The DNS queries are encrypted once they leave you're Pi-Hole. The easiest setup I've found is to use DoT from client to local Pi-Hole, and then DoH from Pi-Hole to authoritative dns server. Pi-Hole still blocks ads, and you're using DoH where it matters. Alternatively, check out this article on using DoH via CloudFlare from the Pi-Hole docs.

It's also worth noting that you can still be tracked, via numerous methods even with the strictest ad-blocking methods in place. Be careful not to put too much faith in you're Pi-Hole. Take a look at browser fingerprinting. If you're really worried, use Tails n Tor.