Is Accessing Pi-hole via IP and HTTP Risky? reddit / selfhosted ---------------------------------------------------------------------- pumpkin_sexy · 2023-10-25 14:25 I deployed Wireguard (using PiVPN) and Pi-hole on my Ubuntu Digital Ocean server. I can go to the Pi-hole settings with my IP address by adding '/admin' after it, and it's not secure (HTTP). Is this unsafe since everyone can access the /admin page? I have not added any custom firewall rules on DigitalOcean yet. ---------------------------------------------------------------------- thekrautboy · 2023-10-25 14:33 If your Pihole is **only** accessible through the VPN then its quite secure. I would still set a password for the webinterface. Adding HTTPS through a reverse proxy on top of that sure doesnt hurt but since its already protected by the VPN i wouldnt say its a priority in this case. **Absolutely do not your Pihole open to the internet.** ---------------------------------------------------------------------- pumpkin_sexy · 2023-10-25 14:45 I can access to the /admin page on my phone without connected to the VPN, does it means it is insecure and something is wrong with my setup? ---------------------------------------------------------------------- thekrautboy · 2023-10-25 14:47 Yes that means its open and very likely it acts as a public DNS server now. Shut it down immediately. Look at the Pihole documentation and ask /r/Pihole how you can make it run only through the VPN. ---------------------------------------------------------------------- pumpkin_sexy · 2023-10-25 14:50 I don't think it's available for everyone on the internet because I'm the only one in the Pi-hole dashboard. But I'll see how to make the admin page only reachable by my IP address. ---------------------------------------------------------------------- thekrautboy · 2023-10-25 15:08 If you can access it without your VPN then yes it is available for everyone. Again, read the link i gave you, read the docs and ask /r/Pihole. Dont be surprised when Digital Ocean shuts down your VPS and bans you. Good luck! ---------------------------------------------------------------------- pumpkin_sexy · 2023-10-25 15:09 Thanks! I am temporarily shutting down while I understand everything. ---------------------------------------------------------------------- flaming_m0e · 2023-10-25 15:09 > I don't think it's available for everyone on the internet If you can login to it without being connected via VPN...then it's ON THE INTERNET. ---------------------------------------------------------------------- lunakoa · 2023-10-25 15:48 If it is for use in a trusted environment (home) then I wouldn't worry about it too much. Mine does serve the guest network at home and I did a native pihole install on Rocky 9 and enabled SSL on lighttpd so it is possible to protect it with https. Another option (haven't tried it) is to completely block http on the host IP and only allow access via localhost and use ssh portforwarding to access [http://127.0.0.1/admin](http://127.0.0.1/admin) ---------------------------------------------------------------------- fortisvita · 2023-10-25 18:35 See if you can punch in the IP and get in from a friend's PC. If you can, that's a problem. ---------------------------------------------------------------------- helphp · 2023-10-25 18:57 Are you at home on your wifi though ---------------------------------------------------------------------- Scimir · 2023-10-25 20:21 Set the public ip of your Digital Ocean server as the DNS server when in a hotspot or different network. If that works without your vpn, you need to consider security. Having the admin panel open to the public is pretty unsafe already, but not concerning as most people wont have any interest in your project. Having a public DNS server running withouth the required knowledge can lead to abuse of your pihole and become a threat to others. It is quite likely that your hoster or any other company contacts you regarding your server. ---------------------------------------------------------------------- arcadianarcadian · 2023-10-25 20:22 Let's say you're in a public place such as cafe/library/school/work and using public internet connection to connect to your Pi-Hole and I'm the administrator who can check the connection of the users. I can create copy of Pi-Hole webpage on one of my servers and can easily redirect your pihole requests to my server. Because it's my server and because you're not using HTTPS, I can read your connection and password etc. basically it is. ---------------------------------------------------------------------- zfa · 2023-10-25 21:44 Asking the real questions instead of jumping to conclusions, you're spot on. Poster *could* be using ambiguous language and just mean he can access using his phone on his own WiFi. Needs clarification. ---------------------------------------------------------------------- BarServer · 2023-10-25 23:27 With HTTP you dort even need to put that much effort into it. Just sniff the network traffic and be done. :-) ---------------------------------------------------------------------- thekrautboy · 2023-10-25 23:31 > If that works without your vpn, you need to consider security. Security isnt the major issue with that. Sure someone could access OPs admin panel and adjust some settings and mess with them etc. The major issue is running the DNS server (not the admin panel) open to the public. [DNS Amplification Attacks](https://www.cloudflare.com/learning/ddos/dns-amplification- ddos-attack/) and other factors are a huge issue and are very easy to use. So running something like a Pihole or Adguard open is a very bad idea. And a lot of the big hosting providers check for these things and shut them down, and OP would risk to get banned from them. They are protecting their network, and if a user is not able to properly set up their services on a device, they "take care of it". ---------------------------------------------------------------------- thekrautboy · 2023-10-25 23:32 That is really not the problem with a open Pihole... ---------------------------------------------------------------------- SEND_NUKES_PLS · 2023-10-26 00:39 OP is using a VPS...so he's not connecting through LAN...if he can access his PiHole dashboard without a VPN then that means the rest of the internet can too. ---------------------------------------------------------------------- _PanicattheCostco · 2023-10-26 01:19 The droplet doesn’t still have ssh set up without ssh keys right? I.e password auth to ssh is turned off ---------------------------------------------------------------------- Ordinary_Employer_39 · 2023-10-26 01:23 [easy fix](https://github.com/NOXCIS/Worm-Hole) ---------------------------------------------------------------------- Ordinary_Employer_39 · 2023-10-26 01:23 https://github.com/NOXCIS/Worm-Hole ---------------------------------------------------------------------- guhcampos · 2023-10-26 02:21 That would be a lot of work though. It would be much easier for attacker in the cafe to just tcpdump the password out of the plaintext traffic 😬 ---------------------------------------------------------------------- Scimir · 2023-10-26 05:41 Please read again. I stated that the open DNS server is the bigger concern. My comment could have been misleading but security is not simply meant for one’s own systems. I simply didn’t want to explain the possible attacks again since fellow commenters already did that. ---------------------------------------------------------------------- R0cketM0nster · 2023-10-26 06:50 Only if he has port 53 open. If only 443/80 is open then only the admin interface is publicly accessible… still not great but doesn’t automatically mean he is serving DNS to the word. ---------------------------------------------------------------------- thekrautboy · 2023-10-26 07:06 Yes but Pihole doesnt differentiate between only web interface or DNS. So if the webinterface is available, the DNS is too. ---------------------------------------------------------------------- R0cketM0nster · 2023-10-26 07:18 That’s doesn’t make sense. Pihole will only respond to DNS requests on port 53 right? So if port 53 is not open then you can’t make DNS requests to Pihole. ---------------------------------------------------------------------- thekrautboy · 2023-10-26 07:20 Thanks i know that. Pihole itself has no option to only open the webinterface. Its all or nothing. If the webinterface is listening that means the DNS is listening too. OP would need to use firewall rules or for example run Pihole in a container and only open those specific ports. Neither of which is mentioned by OP at all. ---------------------------------------------------------------------- Drumdevil86 · 2023-10-26 07:43 As sysadmin managing firewalls, I can utilize a transparant proxy with SSH deep packet inspection to sniff HTTPS traffic. ---------------------------------------------------------------------- R0cketM0nster · 2023-10-26 07:47 But OP is running on a DO droplet, by default inbound is denied so port 53 would need to have been manually opened. Before jumping to the conclusion it’s an open DNS server my point is it would be worth asking if DNS requests are being serviced by Pihole while the VPN is disconnected. OP even called out there are no custom firewall rules on DO yet, so I don’t see how the admin interface is even available off the VPN. ---------------------------------------------------------------------- thekrautboy · 2023-10-26 07:50 Clearly OP is not very knowledgeable and as you mention yourself, it doesnt make sense to have no fw rules but still being able to access the webinterface. So its fair to assum OP has either turned off the fw completely or added rules. And id rather draw the conclusion on the cautionairy side by telling OP to shut their Pihole down. ---------------------------------------------------------------------- BarServer · 2023-10-26 08:03 True, but in all honesty: Attacks at that level are my least concern. ;-) ---------------------------------------------------------------------- thekrautboy · 2023-10-26 08:17 What difference would that make? If they can reach the Pihole through home internet, or cellular internet, the outcome is the same. ---------------------------------------------------------------------- helphp · 2023-10-26 08:19 Not familiar with pihole at all to be honest. But if it’s a server at home then obviously you can reach it via ip on wifi. But maybe that not what it is lol ---------------------------------------------------------------------- thekrautboy · 2023-10-26 08:27 Doesnt matter really what Pihole is but checkout /r/Pihole. OP states they are running it on a Digital Ocean VPS, and they can reach it without VPN. That means its reachable for the entire public internet. Wether OP is at home with wifi or through cellular doesnt make any difference. ---------------------------------------------------------------------- helphp · 2023-10-26 08:28 I’ll take the L on skimming and responding here lol 🙏🏻🙏🏻 ---------------------------------------------------------------------- RobertBobert06 · 2023-10-26 13:23 ....my dude you might want to learn how the internet works before playing with your network ---------------------------------------------------------------------- RobertBobert06 · 2023-10-26 13:23 .....no read again. ---------------------------------------------------------------------- Tharunx · 2023-10-26 14:14 Dude i did the same thing. Trust me. I thought who would attack or care about my digital ocean droplet. But just after some time i was attacks happening. So many bots tried to use my DNS server to DDoS some websites they targeted. I can see the queries going from few thousands to hundreds of thousands. This also affected all the devices using the DNS because it became slow. Internet loaded slower. I tried changing a few settings and at last tried to allow only certain IP addresses i allowed. But just after a day, i cannot see any queries . I cannot see anything. It’s hijacked. This is entirely a bad idea. You must host your DNS over private network such as VPN ---------------------------------------------------------------------- arcadianarcadian · 2023-10-26 20:04 It was an example :)