homelab/docs/DNS Resolution.md

28 lines
1.8 KiB
Markdown
Raw Permalink Normal View History

2022-10-23 17:42:47 -07:00
```mermaid
graph TB;
Upstream["dns.google (8.8.8.8; 8.8.4.4)"]
Clients["Clients [192.168.1.0/24]"]
2022-11-09 14:20:02 -08:00
Router["VyOS Router [192.168.1.1]"]
2022-11-09 14:47:56 -08:00
PiHoles["PiHole [192.168.1.22,192.168.1.21]"]
2022-10-23 17:42:47 -07:00
BlackHole["Black Hole"]
2022-11-09 14:47:56 -08:00
Clients --"First connect"--> Router
Router --"Sends DHCP with DNS=192.168.1.22,192.168.1.21"--> Clients
Clients --"Subsequent requests"--> PiHoles
Router ----> PiHoles
PiHoles --"Blacklisted domains"--> BlackHole
PiHoles --"Valid requests"--> Upstream
2022-10-23 17:42:47 -07:00
```
2022-11-09 14:47:56 -08:00
Clients connecting to the local network for the first time will receive as part of the DHCP negotiation ([code 6](https://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol#Information)) the domain name servers' addresses. These addresses will correspond to the IP addresses of the PiHole servers (currently RasPis at `192.168.1.22` and `192.168.1.21`).
From that point, clients will send simultaneous DNS requests to both Piholes and use the first response received. This means the PiHoles will be able to track requests per-client. However, this splits tracking data between the two servers, so it may be difficult to visualize a complete picture.
A client can be manually configured to request DNS resolution from the router, which will forward requests to the PiHoles.
2022-10-23 17:42:47 -07:00
DNS requests to the PiHole will be checked against the [configured adlists](https://pihole.jafner.net/groups-adlists.php). If matched, the request will be blocked. If a user is attempting to access a website that is blocked, the request should quickly resolve to a Domain Not Found error. It will look like this:
2022-11-09 15:29:28 -08:00
![Chrome](/docs/img/pihole_domain_blocked_chrome.png)
![Firefox](/docs/img/pihole_domain_blocked_firefox.png)
2022-10-23 17:42:47 -07:00
If the request does not match any adlists, it will be passed upstream to Google `8.8.8.8` (or backup `8.8.4.4`).
Presently, the PiHole does not cache any requests.