I made pihole-FTL blackhole - default deny all

[rapi3]

I created, together with ClaudeAI:
pihole-FTL Blackhole - default deny all !

You might be wondering what the point of all this is if the client can communicate directly with the server's IP address... or use its own DNS resolver.

Here's how I solved this problem:

• The firewall redirects all DNS requests to my resolver, while all other DNS resolution methods are blocked.
• The firewall allows client communication strictly through an alias that is initially empty. This means any IP address that is not explicitly permitted is blocked.
• The alias is dynamically updated in real time by the DNS resolver.
• All unauthorized traffic is blocked!

I've implemented an Unbound resolver that, together with a Python script, retrieves the IP addresses resolved by DNS in real time and sends them to the firewall. The firewall then updates the alias with the permitted IP addresses, allowing the device to communicate only with authorized destinations.

This way, communication with any other IP address is restricted!

The logic is as follows:

1. Pi-hole Blackhole blocks all DNS resolution requests for domains that are not on the allowlist.
2. Unbound resolves the permitted domains.
3. A Python script sends the resolved IP addresses to the firewall.
4. The client is allowed to communicate with the permitted IP addresses.
5. Any traffic destined for other IP addresses is blocked!

The post will be updated soon...

Why?
Mainly for LG TVs and all the devices that talk too much on the internet without your consent.
What does it do?
The logic now is: default deny all!
Everything that isn't explicitly allowed is blocked by default !
I no longer need blocklists ... it's very simple to allow something, for example YouTube or websites you use...just click from interface or here you have my Youtube whitelist:

Domain/RegEx	Type	Status	Comment	Group assignment
yt3.ggpht.com	Exact allow youtube Default
www.gstatic.com	Exact allow google Default
www.googleapis.com	Exact allow google Default
www.google.ro	Exact allow google Default
www.google.com	Exact allow google Default
static.doubleclick.net	Exact allow google Default
sponsorblock.inf.re	Exact allow youtube Default
localhost	Exact allow lan Default
ipv4.connman.net	Exact allow kodi Default
fonts.gstatic.com	Exact allow google Default
fonts.googleapis.com	Exact allow google Default
^encrypted-tbn[0-9]+\.gstatic\.com$	Regex allow google Default
^[0-9]+\.pool\.ntp\.org$	Regex allow NTP server Default
^(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\.1\.168\.192\.in-addr\.arpa$	Regex allow LAN 1 Default
^(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\.2\.168\.192\.in-addr\.arpa$	Regex allow LAN 2 Default
^(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\.10\.168\.192\.in-addr\.arpa$	Regex allow LAN 10 Default
^(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\.100\.168\.192\.in-addr\.arpa$	Regex allow LAN 100 Default
^(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\.111\.168\.192\.in-addr\.arpa$	Regex allow LAN 111 Default
1.0.0.127.in-addr.arpa	Exact allow localhost Default
(\.|^)ytimg\.com$	Regex allow youtube Default
(\.|^)youtube\.com$	Regex allow youtube Default
(\.|^)googlevideo\.com$	Regex allow youtube Default
(\.|^)googleusercontent\.com$ 	Regex allow google Default