Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[Shimada]

Hi i need to block some ports to get solo lobby for Red Dead Online on my PS4 im using 1.20 firmware

[FurryNutz]

Try setting a firewall rule? User manual on page 62 to begin with.

[go140point6]

Try setting a firewall rule? User manual on page 62 to begin with.

But to expand on this, how do you deny a certain port on a specific client to anywhere on the intenet?  The manual isn't much help at all. I want to deny port 53 (DNS) from my LAN client (Roku) to anywhere on the internet, so it's forced to use my LAN DNS (pi-hole).  I suspect many of the Roku apps are using hard-coded DNS servers.  Is there a wild card option?  What "range" do you use to signify "everything" but still allow broadcasts, etc.?

[me_iauras]

This is the rule ( actually 1 of 2 as you have to make separate UDP TCP rules for it to work ) I've created for exactly the same reason ; to block any hardcoded DNS resolvers from being used via the WAN interface instead of my pihole located in my LAN .

https://imgur.com/lNJtDXw  >> Just make sure your pihole's IP is outside of the Source IP Address Range as otherwise it won't be able to make upstream DNS querries to your chosen upstream DNS resolver . (I have my pihole set up with a manual IP outside the usual 100-254 DHCP pool range of IPs)

I'm not sure why I can't block every public/outside IP and can only go only as high as you can see but that was the limitation in my EU firmware (I got to that value by trial & error going back in increments ); I'm not really worried though as most of the major DNS resolvers out there (Google , Cloudflare , IBM Quad9 , OpenDNS , etc. ) are within that range so they're blocked (in theory there might be an app or two who could reach some specific DNS resolver but for the vast majority my pihole is the sole resolver they can connect to )

[go140point6]

awesome! thank you!  yes that makes sense and is exactly what I was looking for:

The multicast addresses are in the range:
224.0.0.0 through 239.255.255.255
and these are "reserved for future use":
240.0.0.0–255.255.255.254

So unless they started giving out those "future use" ones, your range is probably correct.  I guess you could make multiple rules if you really wanted to block it tho.

In case your image goes dead at some point, here are the settings for others to find:

Source LAN : specific IP on your LAN (192.168.1.200) or your LAN range (i.e. 192.168.1.1-192.168.1.254)
Destination WAN: 1.1.1.1-223.255.255.254
Protocol and Port Range: Create one rule for TCP and one rule for UDP --> the port is 53.  Or a range of ports if you wanted to (21-53).

Since I'm only blocking a single IP address on the Roku for now, I didn't have to worry about moving the pi-holes off the DHCP range (yes I run 2... one on a Pi3 and one on a PiZeroW).

Thanks again for pointing me in the right direction!

[me_iauras]

Glad to be of service!
Now... regarding your decadence in wasting perfectly good resources ; why don't you use only the Pi Zero as a Pi-hole host ?
Isn't it reliable enough or you can't reasonably rely on it's  wireless connection to serve you as the main DNS resolver ; any USB NIC should be able to fix that and you could repurpose the Pi 3 to a role more befitting it ( it could be a PLEX server if you only use DirectPlay and don't do transcoding ) 

[go140point6]

Glad to be of service!
Now... regarding your decadence in wasting perfectly good resources ; why don't you use only the Pi Zero as a Pi-hole host ?
Isn't it reliable enough or you can't reasonably rely on it's  wireless connection to serve you as the main DNS resolver ; any USB NIC should be able to fix that and you could repurpose the Pi 3 to a role more befitting it ( it could be a PLEX server if you only use DirectPlay and don't do transcoding )

LOL, yeah I actually have 1 PiZeroW, 2 Pi 3b, 1 Pi3b+, and 2 Pi4 4Gb.  The two Pi4's are my work-horses doing stuff (each with an SSD).  My "main" pi-hole is my Pi3 (wired) and I only set up the PiZeroW as a second pi-hole because I had nothing really to do with it after I did some direct compiling on it for a project that was not working for me trying to cross-compile.

And I kind of like having a back-up pi-hole... it makes it less likely the internet is going to stop working in the house (not a problem for me, but it makes the wife and kids a bit cranky if I'm not around to fix it)...