varunsridharan/pi-hole-android-private-dns

Script to auto-install & configure Android Private DNS For Pi-Hole

Pi-Hole Android Private DNS Installer

I came across Pi-hole about a year ago, and have been using it on and off since then for small projects.

A few months ago I decided to use it for private DNS, but the compatibility with Android Private DNS was not widely available or effective. I spent many hours searching over the internet, piecing together code from various sources and testing it.

I am finally happy to say that I am able to create a working piece of code for Android Private DNS!

As a member of the open source community, I would like to give back, and am posting the code here for use by fellow members. I am sure there are at least a few members out there who may have need for this code.

Requirements

1. Ubuntu / Debain Based (Any Version)
2. Pi-Hole Installed With Web Server
3. Forward The Following Ports in TCP (80,443,853) to your Pihole instance.

Note I dont use Raspberry Pi to run Pi-Hole so i was not able to test. but the same steps are required for it.

Installation

This is a simple script which requires 2 arguments

1. Domain Name To Run Android Private DNS Service Example: dns.myhomenetwork.net
2. Email To Share with letsencrypt to get an SSL For Android Private DNS

For Pihole 5

sudo wget https://raw.githubusercontent.com/GhostlyCrowd/pi-hole-android-private-dns/main/pi-hole5.sh
sudo bash pi-hole5.sh {domain_name} {email_for_letsencrypt}

Example Run sudo bash pi-hole5.sh mydns.example.com [email protected]

For Pihole 4 & Below

sudo wget https://raw.githubusercontent.com/GhostlyCrowd/pi-hole-android-private-dns/main/pi-hole-android-private-dns.sh
sudo bash pi-hole-android-private-dns.sh {domain_name} {email_for_letsencrypt}

Example Run sudo bash pi-hole-android-private-dns.sh dns.myhomenetwork.net [email protected]

---

📝 Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Checkout CHANGELOG.md

🤝 Contributing

If you would like to help, please take a look at the list of issues.

📜 License & Conduct

• GNU General Public License v3.0 © Varun Sridharan
• Code of Conduct

📣 Feedback

• ⭐ This repository if this project helped you! 😉
• Create An 🔧 Issue if you need help / found a bug

💰 Sponsor

I fell in love with open-source in 2013 and there has been no looking back since! You can read more about me here. If you, or your company, use any of my projects or like what I’m doing, kindly consider backing me. I'm in this for the long run.

• ☕ How about we get to know each other over coffee? Buy me a cup for just $9.99
• ☕️☕️ How about buying me just 2 cups of coffee each month? You can do that for as little as $9.99
• 🔰 We love bettering open-source projects. Support 1-hour of open-source maintenance for $24.99 one-time?
• 🚀 Love open-source tools? Me too! How about supporting one hour of open-source development for just $49.99 one-time ?

Connect & Say 👋

• Follow me on 👨‍💻 Github and stay updated on free and open-source software
• Follow me on 🐦 Twitter to get updates on my latest open source projects
• Message me on 📠 Telegram
• Follow my pet on Instagram for some dog-tastic updates!

---

Built With ♥ By Varun Sridharan

---

pi-hole-android-private-dns's Issues

How to uninstall?

I recently installed this project into my pi-hole installation, but it is not working for me. Now its just taking up some space, is there any way to remove this from my pi?

No warning for removal of already configured nginx sites

sudo rm -rf /etc/nginx/sites-available/*
sudo rm -rf /etc/nginx/sites-enabled/*

This part of the script (and more) should not be there, those should at least be backed up, and not just removed forecefully without any warning.

Soyy - dont know how to delete

NGINX reconfigures to 853 but doesn't leave port 80 for cert renewal

Describe the issue
When you run the script, NGINX starts as port 80 for the cert download, but once the script completes it only is active on port 853. Port 80 needs to remain in order to do the 3 month Lets Encrypt cert renewal.

To Reproduce
Run the script and check 'sudo netstat -tupan` and you'll see only 853 being openby NGINX

Expected behavior
NGINX should run as both 853 and 80, or be able to flip back and forth for the 3 month cert renewal.. I think. :)

Desktop (please complete the following information):

• OS: Raspberry Pi Zero W2 running PiHole 5.15.32-v7+

not working for pihole with docker

Hi,
I tried to run the script inside of the official pihole docker image
but i was not able to run the nginx inside the container
was getting error

"s6 service not found for nginx, exiting..."
for sudo service nginx restart

For anyone Whos private dns has stopped working after the Letencrypt cert expiry ~12h ago see inside

ssh into your pihole machine and run

sudo certbot renew --force-renewal --preferred-chain="ISRG Root X1"

To regen your certificate with the new chain of trust.

Logging

Recommend you enable logging
sudo echo "
log_format dns '$remote_addr:$remote_port - [$time_local] $protocol $status $upstream_addr $ssl_protocol $ssl_cipher - Server: $server_addr:$server_port - Connection: $connection';;
access_log /var/log/nginx/access.log dns;
error_log /var/log/nginx/error.log;
" >/etc/nginx/streams/dns-over-tls

Thanks for this page and your guide. Also, may help someone in testing their proxy:
kdig -d @YOUR-IP +tls-ca +tls-host=YOUR-DOMAIN DOMAIN

You also might want to look at other directives too:
proxy_responses 1;
proxy_timeout 1s;
server 127.0.0.1:53 fail_timeout=10s;

TLS v1.3 Not supported

Describe the bug
A clear and concise description of what the bug is.

To Reproduce
Steps to reproduce the behavior:

1. Run script
2. Restart nginx with systemctl
3. See the error

Expected behavior
Private DNS works.

Screenshots
If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information):

• OS: Debian Stretch
• Browser N/A

Additional context
Runs on Azure.

Still Private DNS not working

I'm using Pi-Hole v5.11.4 and installed using the below command in my ubuntu machine but still Private DNS not working

sudo wget https://raw.githubusercontent.com/GhostlyCrowd/pi-hole-android-private-dns/main/pi-hole5.sh
sudo bash pi-hole5.sh {domain_name} {email_for_letsencrypt}

Can you please tell me how I can debug it?
netstat -tulpn | grep LISTEN result

Showing LocalHost in query log when using android private dns

Describe the bug
When I go to see the TLS clients using my server, Pihole only shows them as “localhost”. That sounds quite obvious as the stream is redirecting them all through the localhost.
But using OpenVPN too and OpenVPN does send that information to Pihole as different clients (ie: 10.8.0.2, 10.8.0.3).
How could I make the stream to give what TLS clients that are accessing my server to Pihole as OpenVPN do?

To Reproduce
Just Connect Via Android And Check For the logs.

Expected behavior
It Should Show Proper IP

Docker support

Is your feature request related to a problem? Please describe.
I want to use Pi-Hole when outside of the home by using private DNS, but I am running it inside of docker

Describe the solution you'd like
A docker image for Pi-Hole that contains this repo

Describe alternatives you've considered
Manually installing this in my container, but that would be overwritten in an update or when migrating.

Additional context
/

include /etc/nginx/streams/* listed twice

in the resulting nginx.conf the directive:

stream {
include /etc/nginx/streams/*;
}

Is listed twice. This causes the nginx daemon to fail to start.

I've done this but I get error on phone

Describe the bug
A clear and concise description of what the bug is.

To Reproduce
Steps to reproduce the behavior:

1. Go to install following instruction
2. Click on random page
3. Scroll down to see error message ERR_NAME_NOT_RESOLVED
4. See error

Expected behavior
page loads without ads

Screenshots
just basic chrome

Smartphone (please complete the following information):
android 10 miui

Additional context
server is hosted on ubuntu linux with pihole and self updating dynamic dns domain

Script uses unavailable packages.

The shell script will try to install python-software-properties and python-certbot-nginx and will fail as neither of these packages are in the mainline repository.

python-software-properties was merged into software-properties-common, and python-certbot-nginx is now python3-certbot-nginx

This is on Ubuntu LTS 20.04.1

can you clarify the instructions?

Describe the bug

• I'm not sure what "Allow The Following Ports in TCP" means. is that opening those ports in the firewall on the host that has pi.hole installed?
• do we need an existing domain name registered?
• what do we then put in the android private dns hostname field?

To Reproduce
Reading README

Desktop (please complete the following information):

• Raspbian on raspberry pi

Smartphone (please complete the following information):

• Device: Google PIxel
• OS: Android Q (Android 10)
• Browser Chrome
• Version not sure

Additional context

Feature Request

Could you please implement this so that the certificate is also used for secure web administration of pihole. Example if you wanted to run this on a cloud vm this would be super helpful. Afterall, already requesting the certificate, it could be used both on 443 and 853