REDDIT 原始帖子
Can I self-host a DNS server to custom block websites on Android?
Hi. I have an issue where I want to block certain websites on my Android phone. I've already looked into custom DNS servers, the problem is that none I could find support being able to add actually custom blocklists, they're only from a preset. Is it a good…
Hi. I have an issue where I want to block certain websites on my Android phone. I've already looked into custom DNS servers, the problem is that none I could find support being able to add actually custom blocklists, they're only from a preset. Is it a good idea to self-host a public facing DNS server for this purpose, or does anyone have any other idea (which isn't a VPN-based solution, since I don't like the battery drain)
已收录讨论
Expand the replies to this comment to learn how AI was used in this post/project.
https://pi-hole.net/
Why?
I'm sure others can give even more in-depth answers but if a DNS isn't hardened they can vulnerable to amplification attacks and basically DDoS yourself or be used as a vector to DDoS others. I don't think most consumer DNS packages like pihole are hardened against those attacks and even if they are, best not risk it.
It's really not that bad on a VPS lol, I run two instances od Technitium, one on my home server and one on my vps, they both just go through pangolin, my domain points to the tailscale ip of my vps so nothing outside my tailnet can even resolve my domains to get to my auth.
This is my setup, I love it.
I had public facing DNS for at least 15 years. It has advantages (being able to server any record type) and disadvantages (it can be a faff to maintain, and you need to avoid allowing DNS amplification). At the moment I use a third party, but this is not a “DO NOT” item.
Isn't the whole pi-hole movement is about this?
Yes it is, you can host unbound too simultaneously
At best you’ll have a load of spam queries. Why would you want to do this
Public facing plain DNS on port 53 - don't. Public facing DoH/DoT with some kind of authentication-type thing like custom subdomains/client IDs like ControlD or AdGuard Home does - fine so long as you know how to harden the server in general.
„Public facing dns server “ - don’t! You can host one on a server in your home network, maybe setup some vpn to connect home when away. You can just use pihole for that, custom lists are easy… But I repeat, don’t let it face the public.
Do not, I mean, do NOT host a public facing DNS. You will need to use some form of vpn, maybe split tunneling won't use as much battery. I really like technitium , it's a really complete dns service that's really easy to configure, and you can add whatever website to the blocked list (like most selfhosted dns solutions).
You have three options I can think of.. And please don't do public facing DNS yourself because if you have to ask, you should not do it. Pi-hole with DNSCrypt + Tailscale Adguard Mullvad's DNS servers as they have different filterings available, including adblocking one.. Well there is 4th option which would be a VPS and running DNS on there but... I think it's better you don't do that... You would need to find a VPS that allows hosting your own DNS server... and know how to configure it correctly to avoid leaks and.. Just don't.
Ad Guard and PiHole both allow custom block lists, editing block lists, etc. I think pretty much every DNS server allows this, actually.
Could you use Tailscale and then set your Pihole tailnet address as your phones DNS? It would probably slow down browsing a bit, specially for new sites.
I use PiHole and PiVPN with Wireguard.
Adguard Home
And you wanting to block sites on your Android device or are you trying to actually host the DNS server on your Android device? Because if it's the former, Pihole is probably the easiest solution. Also is there a reason you want it public facing? Are you wanting to block sites when you aren't on your home wifi or something?
Pihole and Adguard are the biggest DNS blocker in the game, personally I use pihole
On a server: Pi-hole or AdGuard. On the Android phone: RethinkDNS.
Run and customize pi-hole on a VPS or home network, then just use Tailscale to make the “link” and your phone will use its DNS.
I have an OPNsense router which has Unbound built in to act as a DNS server. Works pretty well for blocking ads, tracking, blocking extenral internet access for my TV, rerouting calls to my personal domain straight to the local server (bypassing the internet), and even integrated a VPN so calls to certain domains go through another country, thus unblocking certain sites. I also have Wireguard so I can connect to my home network from my phone, and get all those benefits from anywhere. I would not make it public facing though, sounds like a recipe for disaster.
I have wireguard on my phone with an always on connection to my home routing all traffic through it. This also sets dns to use my home dns which is a coredns with blocking through Steven Black's hostfile and then forwarding to quad9 over tls.
Personaldnsfilter https://play.google.com/store/apps/details?id=dnsfilter.android