17.4 million DNS queries over 24 hours via AdGuard Home reddit / selfhosted ---------------------------------------------------------------------- ctrlaltpineapple · 2023-12-15 01:10 I recently rebuilt our data centre's DNS resolvers to work around rate limits with DNSBLs. As someone who uses AdGuard Home for home use, this was my go-to option. I wasn't able to find anything similar with a simple and easy to use GUI (other than Technitium). I did try to see if anyone else was using ADH in a DC environment, but I didn’t get very far. So here's some interesting stats and my review on using AdGuard Home for DC use. **TLDR: It’s awesome.** ADH scales incredibly well when coupled with Unbound. In the past 7 days, my two ADH servers have managed to resolve 121,982,300 queries. **Yes 121 million queries in 7 days.** I only have the malicious URL filter enabled, so YMMV depends on the number of rules and filters you add to ADH. The average processing time is quite high, however, this is heavily skewed upon the fact that there are thousands of DNS RBL checks being made every minute, and this can slow down the processing speed quite significantly as ADH needs to wait for this DNSRBL check to be completed. The other DNS resolver only has a 60ms processing time, but I believe I can get this down even further by syncing the cached results between servers. ---------------------------------------------------------------------- Prog47 · 2023-12-15 01:19 I would be concerned if i seen that many queries but maybe you know the reason why. I have TONS of IOT, multiple computers, servers, ect on my network and i keep my log for 90 days and i don't even have 6 millions. I know you didn't want to talk about this but the only thing i'm noticing is your average processing time is quite high. My average processing time is 10ms ---------------------------------------------------------------------- ctrlaltpineapple · 2023-12-15 01:40 Not an issue at all. This is a resolver that is used in a data centre by hundreds of servers, 40000+ websites and more. The processing speed is high as we’re caching DNSRBL checks which take a lot longer than normal DNS queries. The whole point of this post is to show that ADH is incredibly reliable and does a great job even in enterprise environments. ---------------------------------------------------------------------- thekrautboy · 2023-12-15 03:26 Then why not show this off in /r/Adguard and /r/AdguardHome? ---------------------------------------------------------------------- Secret_Recognition68 · 2023-12-15 03:28 I’m not an expert but I think you might be an ISP ---------------------------------------------------------------------- ctrlaltpineapple · 2023-12-15 03:29 Great idea. But I thought this community would be interested in self hosting DNS ---------------------------------------------------------------------- thekrautboy · 2023-12-15 03:30 Okay. ---------------------------------------------------------------------- jorissels · 2023-12-15 03:33 Very impressive! Whqt are the exact benefits of using something like adguard home? ---------------------------------------------------------------------- I_EAT_THE_RICH · 2023-12-15 03:40 We are interested, just ignore the trolls ---------------------------------------------------------------------- I_EAT_THE_RICH · 2023-12-15 03:41 This is awesome! I'm always hesitant to try and scale things meant for the home, but this is encouraging. ---------------------------------------------------------------------- purged363506 · 2023-12-15 03:45 Do a pi-hole next! ---------------------------------------------------------------------- iviksok · 2023-12-15 03:55 Single client is responsible 20% of those requests. There's something fishy going on. ---------------------------------------------------------------------- TheLazyGamerAU · 2023-12-15 03:55 I can never get adguard to work properly lmao, as soon as i set it up and clients get detected it just stops my internet from working ---------------------------------------------------------------------- OnlyForSomeThings · 2023-12-15 03:56 > I wasn't able to find anything similar with a simple and easy to use GUI (other than Technitium). So why did you choose AdGuard instead of Technitium? I've been thinking about switching because Technitium seems more powerful and flexible from a home-use perspective, so I'm curious about your reasoning. ---------------------------------------------------------------------- No_Dragonfruit_5882 · 2023-12-15 04:00 Not if its a Dnsforwarder / Firewall ---------------------------------------------------------------------- DEGENARAT10N · 2023-12-15 04:05 [This gives a great synopsis](https://www.google.com/search?q=benefits +of+using+adguard+home&ie=UTF-8&oe=UTF-8&hl=en-us&client=safari) and you can drill down even further from there, if you like ---------------------------------------------------------------------- ctrlaltpineapple · 2023-12-15 04:08 I went with AdGuard as I currently use it in my home lab. So far it's been working great. I think AdGuard Home should be renamed if anything haha ---------------------------------------------------------------------- ctrlaltpineapple · 2023-12-15 04:09 What client's are you using? If you're on a Mac, try doing some tests before going live. ​ dig [google.com](https://google.com) @your-adguard-server ​ And it should give a result ---------------------------------------------------------------------- ctrlaltpineapple · 2023-12-15 04:10 Nothing of concern, just a very very busy email server :) ---------------------------------------------------------------------- TheLazyGamerAU · 2023-12-15 04:11 Im just trying to use it at home, all windows machines, as soon as adguard gets any clients they all lose internet access. ---------------------------------------------------------------------- ctrlaltpineapple · 2023-12-15 04:12 Better visibility of what's going on with your devices, and if you're an ISP/hosting provider who receives emails, most spam filters will perform spam checks by DNS. These DNSRBL providers will commonly block public resolvers due to huge amounts of traffic to them. By using AdGuard, I can cache these results ensuring better spam filtering and faster spam scanning. ---------------------------------------------------------------------- ctrlaltpineapple · 2023-12-15 04:14 I tested Pi-Hole in my home lab and I found it ok. Ad Guard looks much nicer and has access to more filters (for home use). ---------------------------------------------------------------------- ctrlaltpineapple · 2023-12-15 04:29 No problems at all mate. Thanks for the idea of the crosspost. I couldn't share on r/adguard as they don't accept images tho ---------------------------------------------------------------------- 202-456-1414 · 2023-12-15 04:39 are you using unbound for resolving queries , cached by ADH, or are you doing the other way around, using ADH for resolving, cached by unbound ? ---------------------------------------------------------------------- thekrautboy · 2023-12-15 04:55 Make a text post and add the image as link? ---------------------------------------------------------------------- anestooo · 2023-12-15 05:00 I moved to controld because of the vpn over dns feature ---------------------------------------------------------------------- imreloadin · 2023-12-15 05:29 What do you mean by it having access to more filters than pi-hole? ---------------------------------------------------------------------- scriptmonkey420 · 2023-12-15 05:46 pfft thats nothing. A single server at my work does 300 million in an 8 hour window. /brag ---------------------------------------------------------------------- Pink_Slyvie · 2023-12-15 05:56 Years ago, I deployed a pihole into a condo environment. Sadly it didn't hold up well, but it was super popular until it crashed. Awesome to see this. ---------------------------------------------------------------------- Defiant-Ad-5513 · 2023-12-15 06:00 Does it have an Android app? ---------------------------------------------------------------------- ctrlaltpineapple · 2023-12-15 06:03 Pic or it didn't happen. That's also rediculous if true as you'll be adding huge unnecessary delays if that's the case. ​ At least my DNS queries are unique (as it's 1 DNS check for each email received). ---------------------------------------------------------------------- ctrlaltpineapple · 2023-12-15 06:03 ADH for resolving and caching by Unbound ---------------------------------------------------------------------- ctrlaltpineapple · 2023-12-15 06:03 I found AdGuard way easier to setup and configure and for day-to-day admin. But to be fair, I only use PiHole for a couple days. ---------------------------------------------------------------------- richiarrrdo · 2023-12-15 06:19 Stop surfing porn. That’s the only reason you have all the domains blocked out right?? 😂 ---------------------------------------------------------------------- localhost-127 · 2023-12-15 06:22 Could you please explain more on DNSRBL and how you have integrated with AGH? ---------------------------------------------------------------------- BloodyIron · 2023-12-15 06:23 > MySQL set to connect via hostname rather than IP, but that's just adding extra latency to your MySQL requests uneccesarily Connecting to DBs by FQDN is generally a good idea when connecting to DB clusters. It provides HA options that IP-only doesn't have (namely DNS reliant ofc). So if it's a single DB server, sure, but that's really not what should be used for DBs anyways at-scale, they should be clustered. ---------------------------------------------------------------------- ctrlaltpineapple · 2023-12-15 06:24 Ideally you should setup the DNS references via your hosts file. That will reduce your latency by quite a bit ---------------------------------------------------------------------- ctrlaltpineapple · 2023-12-15 06:25 Haha, I only have the malicious URLs filter enabled. But if you know you know ;) ---------------------------------------------------------------------- InnateSquire · 2023-12-15 06:44 You mentioned running it with Unbound, what configuration is that? Opened my eyes to a new setup :) ---------------------------------------------------------------------- ctrlaltpineapple · 2023-12-15 06:47 Check this guide out [https://jmcglock.substack.com/p/adguard-home- unbound](https://jmcglock.substack.com/p/adguard-home-unbound) ​ So in most typical environments, you would have something like this setup: **client > adguard home > your resolver >** [**1.1.1.1/8.8.8.8**](https://1.1.1.1/8.8.8.8) **> root DNS servers** This setup is perfectly fine for 99.99% of setups, but in my use case, as we're still using a public resolver, it caused issues with the blacklist providers who operate over DNS. By using unbound, my setup now looks like this: **client > adguard home > your resolver > unbound (hosted on the same server) > root DNS servers** This also has better privacy benefits as no one can see your DNS queries. ---------------------------------------------------------------------- ctrlaltpineapple · 2023-12-15 06:58 If you're running an email server and using a public DNS resolver, you may commonly run into this issue: ZEN\_BLOCKED\_OPENDNS This happens when Spamhaus rejects your spam check unless you pay them $$$. By setting up your own resolver using unbound, your checks will be completed as you're not using a public resolver and skipping the fee to use their services directly. ---------------------------------------------------------------------- mxforest · 2023-12-15 07:13 Over 200 queries per second throughout the day. Seems fine. ---------------------------------------------------------------------- GamerXP27 · 2023-12-15 07:31 damn i have like almost 300 during a week ---------------------------------------------------------------------- InnateSquire · 2023-12-15 07:37 Cheers mate, I'll do some reading tonight! ---------------------------------------------------------------------- Cylian91460 · 2023-12-15 07:42 > I recently rebuilt our data centre's DNS resolvers Yes he is ---------------------------------------------------------------------- theAddGardener · 2023-12-15 08:16 How would help FQDN with HA other than service discovery for LBs and proxies? ---------------------------------------------------------------------- twnki · 2023-12-15 08:27 Using DNS is perfectly valid in highly performant and resilient database designs. Using a round robin DNS with Oracle SCAN is a common configuration. ---------------------------------------------------------------------- Anas1554 · 2023-12-15 08:46 I have an ISP which provides me Dynamic IP, My ADH is hosted in cloud so have to enable waitlisting, When ISP change my IP everything stop working if you can tell me any solution it can be really helpful. Thank you ---------------------------------------------------------------------- Sapd33 · 2023-12-15 08:56 If its in a data center, how do you make it highly available? ---------------------------------------------------------------------- Shotokant · 2023-12-15 09:34 If you're doing this for a company, have you considered blocking adverts? if so, how much bandwidth would you save? ---------------------------------------------------------------------- [deleted] · 2023-12-15 09:41 [deleted] ---------------------------------------------------------------------- alex2003super · 2023-12-15 09:41 Clients cache DNS responses ---------------------------------------------------------------------- ctrlaltpineapple · 2023-12-15 09:53 Host AGH at home. Not really worth while hosting it in the cloud. I’m not sure if you can whitelist by domain, If you can. You can whitelist a dynamic domain instead using something like duckDNS ---------------------------------------------------------------------- ctrlaltpineapple · 2023-12-15 09:53 You have them in different locations :) ---------------------------------------------------------------------- ctrlaltpineapple · 2023-12-15 09:53 Yes, but we don’t want to be interfering with people’s DNS. Only malicious sites are blocked ---------------------------------------------------------------------- Shotokant · 2023-12-15 09:59 Would the users realise if a web site they browsed to had fewer adverts presented? I'm interested in, in in a business context how much bandwidth would be relieved by excluding adverts. ---------------------------------------------------------------------- Monckey100 · 2023-12-15 10:11 This is one of my favorite threads, saved! ---------------------------------------------------------------------- ctrlaltpineapple · 2023-12-15 10:21 Full transparency I’m not an ISP but we’re a server hosting provider! So blocking ads isn’t our goal but I wouldn’t be surprised if an ISP used AGH to block ads ---------------------------------------------------------------------- Klippenhof · 2023-12-15 11:12 I like using coredns. You can scale it really simple & get Metrics and UI in Grafana. Only changes can be done in yaml though ---------------------------------------------------------------------- Yanni_X · 2023-12-15 11:45 If you are the only one using the ADH in the cloud, why even have it in the cloud? Host it at home An alternative would be to create a VPN Split Tunnel from your device/network to your cloud instance and whitelisting the then-local address ---------------------------------------------------------------------- loqsq · 2023-12-15 11:57 How is it providing HA ? DNS Bind for example will be round robin or priority based in regards to SRV records. Besides clients cache responses so that would not help with HA either. Only if ye would use something like a MySQL router for the FQDN and then that takes care of DB cluster related routing. With opensource that I know, unless enterprise solutions have this in some other way that I might not know about. ---------------------------------------------------------------------- lannistersstark · 2023-12-15 12:03 They're obviously asking about OP's specific usecase, no need to be a condescending peanut. ---------------------------------------------------------------------- fism · 2023-12-15 12:07 Love seeing AdGuard get more traction. Being able to change the minimum TTL and TTL for blocked domains is fantastic. ---------------------------------------------------------------------- Quiet-Ad7141 · 2023-12-15 13:03 Why not use pie hole ---------------------------------------------------------------------- frisky_5 · 2023-12-15 13:27 These blurred queried domains what are theeeey !!!! ---------------------------------------------------------------------- FibreTTPremises · 2023-12-15 13:49 Unbound sends queries unencrypted, meaning anyone in the route to the root-servers can perform DPI and see your queries. ---------------------------------------------------------------------- _BoNgRiPPeR_420 · 2023-12-15 13:50 People can host what they want as long as it falls within the datacenter TOS. We had a guy hosting a web scraper at a previous job, he generated like 90% of all traffic too. ---------------------------------------------------------------------- SR_Lut3t1um · 2023-12-15 13:51 Sounds like you didn't configure adguard correctly. Take a look at the upstream DNS config. ---------------------------------------------------------------------- wsdog · 2023-12-15 13:52 Wait, you are managing a data center and making decisions because something "works great at home"? ---------------------------------------------------------------------- du_ra · 2023-12-15 14:04 If you’re applying this on user/customers without explicit agreement this would be illegal for a lot of countries (at least the whole EU). Just if someone thinks it’s a nice idea and try to replicate this. ---------------------------------------------------------------------- du_ra · 2023-12-15 14:06 Using Adguard for this type of usage is a bad idea because it’s just slower than other dns caching servers and here it’s also (nearly) useless (beside the legal trouble I mentioned on another comment). 226 blocks of 82M requests? ---------------------------------------------------------------------- Mittervi · 2023-12-15 14:07 ತ⁠_⁠ʖ⁠ತ ---------------------------------------------------------------------- erictho77 · 2023-12-15 14:11 Good point. Do root servers even support encryption yet in 2023? ---------------------------------------------------------------------- Mintfresh22 · 2023-12-15 14:25 So you say in the title this is one days traffic but then in a comment it is a weeks worth of traffic. So the question is are you stupid or a liar? ---------------------------------------------------------------------- Mintfresh22 · 2023-12-15 14:27 Like you? ---------------------------------------------------------------------- Mintfresh22 · 2023-12-15 14:31 Hope you don't get sued for violating the licensing agreement. ---------------------------------------------------------------------- DigitalDerg · 2023-12-15 14:40 [isn't it GPL v3?](https://github.com/AdguardTeam/AdGuardHome/blob/mas ter/LICENSE.txt) ---------------------------------------------------------------------- BloodyIron · 2023-12-15 14:44 I just told you... "DB clusters". DB clusters have fault-tolerance with many read nodes that can be converted to a write node if the write node fails. The FQDN aspect abstracts away how to connect to the specific DB and allows the cluster to just manage whatever that points to in practice without the "user" having to do anything at all. ---------------------------------------------------------------------- BloodyIron · 2023-12-15 14:45 > Ideally you should setup the DNS references via your hosts file No you shouldn't. That's a nightmare to maintain as you scale up! And you cannot centrally manage that anywhere near as efficiently as your own DNS NameServers did it instead... ---------------------------------------------------------------------- pentesticals · 2023-12-15 15:17 That’s a lot, I can hit that if I’m bruteforcing subdomains to find targets for bug bounty programs. Using massdns I can make about 4m queries in 5 minutes. ---------------------------------------------------------------------- I_EAT_THE_RICH · 2023-12-15 15:20 … ---------------------------------------------------------------------- jbroome · 2023-12-15 15:38 and this is why i don't use the DC's resolvers. ---------------------------------------------------------------------- teabiscuit35 · 2023-12-15 15:53 Hows adguard compared to pihole? ---------------------------------------------------------------------- at_physicaltherapy · 2023-12-15 16:00 Is blocking the malicious sites allowed by your contracts? ---------------------------------------------------------------------- Fe_awen · 2023-12-15 16:05 IT has always been the wild west, amigo. ---------------------------------------------------------------------- ctrlaltpineapple · 2023-12-15 16:12 Sigh, yes of course this is all legal and allowed. You don’t manage 200+ servers and tens of thousands of websites without proper legal docs. I just thought it would have been nice to share some stats and a quick review on AGH when used outside of a ‘home’ environment. Just because it has ‘home’ in its name, doesn’t mean you can make it enterprise ready. And yes, I did test alternatives but at the end of the day, AGH is just a wrapper for open source software. There’s no difference in using named with unbound and building your own GUI compared to AGH If you’re running an ISP, with thousands of user without proper legal agreements in place, you’re an idiot. ---------------------------------------------------------------------- ctrlaltpineapple · 2023-12-15 16:15 Will suss this out. Thanks ---------------------------------------------------------------------- ctrlaltpineapple · 2023-12-15 16:16 I’m not a big windows user, but I believe you can specificity a DNS server using NSLOOKUP ---------------------------------------------------------------------- ctrlaltpineapple · 2023-12-15 16:19 Honestly, I used to run an ISP, something like this wouldn’t be worth it (due to potential support issues) and would need to be opt in. Even if you did apply it, bandwidth wise, it would be negligible. Most ISP bandwidth comes from CDNs, video streaming and more. A couple images being blocked wouldn’t change anything. ---------------------------------------------------------------------- conpsd · 2023-12-15 16:21 hey, sometime thing work good ---------------------------------------------------------------------- B-CUZ_ · 2023-12-15 16:35 I'm curious, what made it crash? ---------------------------------------------------------------------- Pink_Slyvie · 2023-12-15 16:36 I think it was too much traffic. I was still young and didn't diagnose it much, we just pulled it out. ---------------------------------------------------------------------- Mintfresh22 · 2023-12-15 16:37 But it isn't a free product. ---------------------------------------------------------------------- CJtheDev · 2023-12-15 16:39 You don't? ---------------------------------------------------------------------- ctrlaltpineapple · 2023-12-15 16:43 Yes no shit ---------------------------------------------------------------------- wsdog · 2023-12-15 16:43 I'm not managing a data center :) But the amount of data we are passing at work in an hour is probably more than all HDDs I had in my hands for the whole life, so no, my home experience is totally irrelevant. ---------------------------------------------------------------------- ctrlaltpineapple · 2023-12-15 16:52 So build your own? Isn’t that the whole point of this subreddit to self host? ---------------------------------------------------------------------- webbkorey · 2023-12-15 17:02 I've got 275,000 in the last 24hrs in my house. ---------------------------------------------------------------------- sn4xchan · 2023-12-15 17:20 I'd say using software aimed at a consumer market is a security risk. I can't speak with complete confidence as I have not done any research into that company's security policies. But in general consumer marketed software tends to be more lax on security. Could be tons of exposed zero days you don't know about because big entities that employ security experts don't scrutinize it. ---------------------------------------------------------------------- ctrlaltpineapple · 2023-12-15 17:32 Well, using open source software that is maintained by a large organisation is a good starting point. But if you’ve been in the business long enough, you should know how to lock ports and manage a firewall… I thought it would have been neat showing how reliable and resilient open source software can be (especially one that I use frequently) but it’s really draining seeing the same replies over and over again. ---------------------------------------------------------------------- Entropy · 2023-12-15 17:34 r/homelab Specifically the lab part ---------------------------------------------------------------------- raojason · 2023-12-15 17:35 Technitium is a more robust DNS server in my opinion, but I actually use both. AGH on the front end pointed to Technitium on the back end for local DNS and cool features like RFC2136 support. ---------------------------------------------------------------------- guptaxpn · 2023-12-15 17:41 ? ---------------------------------------------------------------------- Mintfresh22 · 2023-12-15 17:45 ??????? ---------------------------------------------------------------------- 404invalid-user · 2023-12-15 17:50 is this dns public then or private/only accessible by customer ips? ---------------------------------------------------------------------- guptaxpn · 2023-12-15 17:51 What is the license then? ---------------------------------------------------------------------- Mintfresh22 · 2023-12-15 17:59 https://adguard.com/en/license.html ---------------------------------------------------------------------- DigitalDerg · 2023-12-15 18:14 That's not Adguard Home ---------------------------------------------------------------------- MyTechAccount90210 · 2023-12-15 18:22 RIP sqlite. ---------------------------------------------------------------------- IWiIIFuckYourMom · 2023-12-15 18:24 I have a question about AdGuard Home. I installed a Raspberry Pi on my network with AGH installed and working on it. When I set my router DNS to the Pi's IP Addr, it gives me no internet at all until I swap back to Spectrum's DNS. Though if I use Spectrum DNS and set the device's DNS to the Pi, it works and AGH counts the queries correctly. Is this expected behavior or is Spectrum fuckin with me ---------------------------------------------------------------------- Sroundez · 2023-12-15 18:30 What upstreams/forwarders have you configured within AGH? ---------------------------------------------------------------------- chyron_8472 · 2023-12-15 18:31 I enjoy that I can use AGH to have .local domains (abs.local, emby.local, qbit.local, plex.local) while on my LAN. That way I don't need to remember the IP or port to access local self-hosted stuff. ---------------------------------------------------------------------- scriptmonkey420 · 2023-12-15 18:42 There is no way in hell that I am going around to 100+ servers to update their host file when an IP changes or a server is replaced. DNS can take care of that. ---------------------------------------------------------------------- scriptmonkey420 · 2023-12-15 18:43 depends on the record TTL... ---------------------------------------------------------------------- gvasco · 2023-12-15 18:43 I'm guessing it's his own server ---------------------------------------------------------------------- AvocadoPanic · 2023-12-15 18:52 I've run both, but I've not used pinhole in 2 years or so. I prefer the UI / UX of AdGuard. Also there is a package for OpnSense so I run AdGuard on my firewall. ---------------------------------------------------------------------- sixstringsg · 2023-12-15 18:54 That’s for the version they host. Adguard Home is free. ---------------------------------------------------------------------- DeepImprovement4 · 2023-12-15 18:57 >hosts file Come on man ---------------------------------------------------------------------- FibreTTPremises · 2023-12-15 19:18 No. This is their last update on the matter: https://root- servers.org/media/news/Statement_on_DNS_Encryption.pdf And no, QNAME minimisation doesn't help against DPI, and "Aggressive DNSSEC Caching" is just a nice-to-have. ---------------------------------------------------------------------- Mintfresh22 · 2023-12-15 20:04 Not for commercial use. ---------------------------------------------------------------------- Mintfresh22 · 2023-12-15 20:05 I'm guess you can't read. ---------------------------------------------------------------------- sn4xchan · 2023-12-15 20:13 The problem with open source software is an attacker can study the code and get to know it without having to compromise a system first. It only mitigates the chance of a supply chain attack because it can be publicly audited. Also if you have any ports open even if it's just the ones you need, you have an attack surface. You have to take caution with consumer targeted software. Because they typically have stuff that is auto configured or doing multiple configurations in the backend with simple switches on the front end. Attackers can learn methods of attack using these "features" by having a lot of potential targets who often aren't very well versed in cyber defense and just want it to work. ---------------------------------------------------------------------- jbroome · 2023-12-15 21:28 I have two raspis running at home, and my things in a DC use them over tailscale. yEs I sElFhOsT, but i also like having machines available out of the country or on a faster connection than i have at home. ---------------------------------------------------------------------- guptaxpn · 2023-12-15 22:05 GPL doesn't restrict commercial use. https://github.com/AdguardTeam/AdGuardHome https://github.com/AdguardTeam/AdGuardHome/blob/master/LICENSE.txt ---------------------------------------------------------------------- ricardofiorani · 2023-12-15 22:14 Blocked adult website: 0 NOICE ---------------------------------------------------------------------- k4zetsukai · 2023-12-15 22:30 And what would you make the decision based on? Vendors pipe dreams? Home lab or personal experience is often the right one if tested at scale and implemented properly as it seems it was here. ---------------------------------------------------------------------- smarzzz · 2023-12-15 22:48 Cool, I do something similar for our virtual datacenters, but I have to process around 1.5 billion requests per day, so I’ve ended up with a coredns fork that implements similar blocking mechanisms :) ---------------------------------------------------------------------- smarzzz · 2023-12-15 22:55 Have network load balancers with fixed ips forward to multiple backend systems. We’re hosting dns for a nation critical service on kubernetes in an AZ/geo/cloud/cluster redundant way, in public cloud ---------------------------------------------------------------------- smarzzz · 2023-12-15 22:58 That sounds very mission critical to me… ---------------------------------------------------------------------- lithid · 2023-12-15 23:03 >You don’t manage 200+ servers and tens of thousands of websites without proper legal docs. Sir, you should meet some of my clients web designers and hosts. ---------------------------------------------------------------------- Odd-Media-6139 · 2023-12-16 00:04 Those are chop shops. You need an in house team for real professionals, honestly. ---------------------------------------------------------------------- Odd-Media-6139 · 2023-12-16 00:06 I can't think of a reason that the software should choke on cached DNS queries that it isn't even recursively resolving. You must have put it on a potato and ran out of RAM. ---------------------------------------------------------------------- Odd-Media-6139 · 2023-12-16 00:06 AdGuard seems more professional and does the same things. ---------------------------------------------------------------------- Pink_Slyvie · 2023-12-16 00:07 Quite possible, I don't remember at all. There is a reason I call that the before times. ---------------------------------------------------------------------- 4strl · 2023-12-16 00:37 Same process as the one liner you posted using dig - you just do: nslookup google.com your-adguard-server on windows :) ---------------------------------------------------------------------- lithid · 2023-12-16 00:47 =) Yup, they are. I will quote one of my customers: "but their website looked legit!" Right.. That's what they do lol ---------------------------------------------------------------------- Odd-Media-6139 · 2023-12-16 00:48 It probably looked like shit to an actual professional. You can't cheap out or outsource software without a lot of headache or just angry customers. ---------------------------------------------------------------------- risredd · 2023-12-16 02:15 I've seen such high activity on pihole when I tried using google account and google apps. ---------------------------------------------------------------------- SocietyTomorrow · 2023-12-16 02:25 I admin a neighborhood co-op ISP. This is low-key how I deal with problem customers who call the tech support line with obvious porn related malware problems. ---------------------------------------------------------------------- Nowaker · 2023-12-16 02:27 Exactly. ---------------------------------------------------------------------- Nowaker · 2023-12-16 02:36 >I'd say using software aimed at a consumer market is a security risk. Brainwashed by big corps. ---------------------------------------------------------------------- sn4xchan · 2023-12-16 02:37 Nope brainwashed by my career in cyber security. ---------------------------------------------------------------------- gvasco · 2023-12-16 02:51 I'm guessing you can't reason? ---------------------------------------------------------------------- PaleMongo · 2023-12-16 02:58 That's poor blocking. Less than 1%. Something is broken here. ---------------------------------------------------------------------- Fwiler · 2023-12-16 03:26 Maybe I don't understand but isn't DNS over TLS mean it's encrypted? That's how I set up Unbound. ---------------------------------------------------------------------- phantombytes0 · 2023-12-16 07:03 How does the HA do? With the simple sync ? ---------------------------------------------------------------------- Darkchamber292 · 2023-12-16 07:25 Sir this reddit. Where everyone and their dog is an expert and you're doing it wrong ---------------------------------------------------------------------- blind_guardian23 · 2023-12-16 10:59 real "professionals" think in Gartner reports/quadrants. /s ---------------------------------------------------------------------- blind_guardian23 · 2023-12-16 11:10 I went the powerdns route (dnsdist in front of recursive) and using lua for filtering (ansible rollout) but probably gui and familiarity is a big plus for you. but in IT there is not only THE one way to do it. ---------------------------------------------------------------------- TBT_TBT · 2023-12-16 12:30 Using AdGuard friggin >>HOME<< on such a scale and in such a setting is absolutely ridiculous! Do your customers know? I would be so gone if I were them. AdGuard Home has absolutely no place in an Enterprise environment. This setup absolutely violates GDPR and many other data protection laws. I would sue you if I were your customer. ---------------------------------------------------------------------- Mintfresh22 · 2023-12-16 12:45 I am guessing you can't read and a dumb ass. ---------------------------------------------------------------------- teabiscuit35 · 2023-12-16 13:14 I can't seem to tell any difference really ---------------------------------------------------------------------- teabiscuit35 · 2023-12-16 13:15 Nice, thanks ---------------------------------------------------------------------- nbeaster · 2023-12-16 13:18 And the problem with using products that aren’t open source is that anything can be stuffed into them including back doors or totally negligent code that no one will see. ---------------------------------------------------------------------- laser50 · 2023-12-16 14:02 Imagine his Adguard blocking IPs by accident and having people get connection issues lol ---------------------------------------------------------------------- No_Guarantee_1880 · 2023-12-16 14:56 @ctrlaltpineapple: thx for sharing that with us, i love AGH, but actually never thought about using that in commercial environment … until now 😁 how much hardware resources did you allocate to one of these AGH server ? Thx ---------------------------------------------------------------------- primalbluewolf · 2023-12-16 16:54 > This setup absolutely violates GDPR and many other data protection laws. [Citation needed] ---------------------------------------------------------------------- DjStephLordPro · 2023-12-17 02:49 What about Pi-Hole? ---------------------------------------------------------------------- kmisterk · 2023-12-17 05:40 ## Post Removed Hey, ctrlaltpineapple! Thanks for your submission on selfhosted. Your post has been removed due to a violation of the purpose of the subreddit: **Self Hosting** ## Not Self-Hosted When it comes to posts regarding applications in this subreddit, they must feature a self-hosted tool, or a tool that *can be* self-hosted, or some kind of related information, help request, or otherwise related to a tool that is something that one can self-host. If you believe this post *is in fact* relevant to /r/selfhosted, feel free to [message the mods](https://www.reddit.com/message/compose/?to= /r/selfhosted&subject=Removed For Not Being Self- Hosted&message=[Removed Post](https://www.reddit.com/r/selfhosted/comments/18io02l/-/\)) with your concerns. ---------------------------------------------------------------------- Rambus_Jarbus · 2023-12-19 17:01 Could you elaborate on this please? I am a web designer lol ---------------------------------------------------------------------- lithid · 2023-12-19 17:07 It's me poking fun at some of my clients web designers. A few of them are just kids with no contracts who are doing it on the side I have no idea how they manage to keep their business with my clients, after so many issues ---------------------------------------------------------------------- Rambus_Jarbus · 2023-12-19 17:11 I see. I worked for a guy and he never did shit for security on our rented server. Well it got hacked and it was not good. I learned a lot. He had good contracts though. ---------------------------------------------------------------------- RuffKez · 2023-12-19 19:10 Disable port 53! Its unsecure and bots use unencrypted dns to amplify attack ---------------------------------------------------------------------- bazpaul · 2023-12-25 22:36 I used to use PiHole. Is AdGuard better? ---------------------------------------------------------------------- lmb8753 · 2023-12-30 22:20 Mine is doing the same thing, but with frontier. I haven't been able to find a solution. I've been playing with it and researching for about two weeks now