Unifi Route Domains Through VPN When Using AdGuard or PiHole DNS – How to Bypass Online Safety Act ID Checks

With the rollout of the On-line Security Act within the UK, it’s now needed to supply identification to web sites when viewing sure forms of materials.

The intention is to forestall youngsters from accessing dangerous materials, however the system is so poorly thought-out that it’s simple to bypass with a VPN, and its broad attain means a whole lot of comparatively regular content material will get filtered out.

Not too long ago, my companion complained that she was unable to entry the True Crime subreddit because of this restriction. I might have arrange a VPN on her telephone and pill to bypass this, however I doubt she would ever use it, as it could be an excessive amount of of a problem for her.

VPN Critiques

The next are all just a few years previous, however they need to nonetheless be related.

UniFi UCG Max with Granular Management over VPN with Coverage-Primarily based Routing

I’ve the very good UniFi UCG Max for my dwelling router, and it affords loads of VPN choices, together with the flexibility to route visitors via third-party VPNs.

Moreover, your policy-based routing choices allow you to make use of the VPN for particular gadgets or web sites.  

I’m at the moment utilizing Surfshark for my VPN, which makes it very simple to arrange router VPN connections. You set it up on the Surfshark web site, then obtain the configuration file and import it into Unifi. That’s mainly it.

At first, I used the only answer: I set my companion’s gadgets to make use of Surfshark routing via Eire, the closest nation that doesn’t implement the On-line Security Act.

It did an awesome job of unblocking the subreddit she wished, however, as all her visitors was routed via Surfshark, when she accessed issues like Google, she constantly hit bot challenges.

I then tried to route visitors based mostly on domains solely, so anytime we accessed Reddit, it could undergo Surfshark. However, it simply wouldn’t work. I believed that it was a Reddit subdomain like redditmedia.com or redditstatic.com that was inflicting the problem, however these didn’t work both.

Exterior DNS, like AdGuard Residence and PiHole, Breaks Area-Primarily based Coverage Routing

Finally, I realised it was as a result of I exploit AdGuard Residence for my DNS.

Since visitors reaches AdGuard first, it finally bypasses the domain-based coverage routing.

Utilizing the Unifi UCG Max because the DNS server resolves the issue, however I don’t just like the ad-blocking choices with Unifi.

Finally, after some Googling (ChatGPT was ineffective for this), I discovered you could inform AdGuard to route sure requests via a distinct DNS.

So, within the case of Reddit, it’s a easy hyperlink you could add to the upstream DNS servers:

[/reddit.com/]192.168.0.1 (or regardless of the IP tackle of your gateway is)

So, when a tool requests Reddit, the DNS request goes via the Unifi and the policy-based routing works.

Whereas I don’t use PiHole at dwelling, it’s attainable to do the identical with this, albeit barely extra difficult.

The guides beneath ought to make it easier to arrange every thing.

Organising the VPN Configuration File in Surfshark

With Surfshark, the method is easy:

1. Go to Handbook set-up – I favor WireGuard
2. Choose I don’t have a key pair (assuming you haven’t finished this earlier than)
3. Identify your connection
4. Click on generate keypair. You may then copy the private and non-private key, however this isn’t wanted if you happen to obtain the conf file.
5. Choos location
6. This then opens the configuration file knowledge, and you’ll obtain the file

Organising VPN in Unifi

For the preliminary setup of the VPN in Unifi, you could:

1. Go to Settings > VPN > VPN Consumer
2. Create VPN
3. Go away Wire Guard chosen and identify the VPN
4. Add the file
5. Click on Apply Adjustments

One caveat with the configuration information is that if you happen to add two totally different Surfshark information, you’ll get a warning that the subnet with the opposite VPN overlaps

Unifi Coverage-Primarily based Routing for particular Domains to VPN interface with AdGuard Residence DNS

For Aguard, that is fairly easy:

• Log in to AdGuard
• Go to Settings > DNS Settings
• Then, in Upstream DNS servers, add domains you wish to route via the VPN utilizing:
• [/domain.com/] IP  tackle of Unifi gateway, so for me that might be:

[/reddit.com/]192.168.0.1

Unifi  Coverage-Primarily based Routing for particular Domains to VPN interface with PiHole Residence DNS

A caveat for this information is that I don’t usually use PiHole. I put in it on Proxmox utilizing Helper Scripts. I used ChatGPT to help me, and it really works, however there could also be a more practical answer.

That is barely extra difficult, however nonetheless simple. With the Helper Script set up on Proxmox, there is no such thing as a sudo to create information/directories

Do that (no sudo wanted):

1. Create the dnsmasq embrace listing

mkdir -p /and many others/dnsmasq.d

2. Create the customized routing file

cat > /and many others/dnsmasq.d/99-reddit-override.conf <<'EOF'
server=/reddit.com/192.168.0.1
server=/redd.it/192.168.0.1
server=/redditmedia.com/192.168.0.1
server=/redditstatic.com/192.168.0.1
EOF

(In the event you favor nano: nano /and many others/dnsmasq.d/99-reddit-override.conf, paste the strains, save.)

Notes:

• Pi-hole/FTL reads all *.conf information in /and many others/dnsmasq.d — that is the proper place for per-domain upstream guidelines (server=/area/UPSTREAM).
• In the event you put in Pi-hole by way of Docker, run these instructions contained in the container (or map the listing as a quantity).
• This strategy impacts all shoppers utilizing your Pi-hole. If you need this just for particular gadgets, say and I’ll present a per-client technique.

I’m James, a UK-based tech fanatic and the Editor and Proprietor of Mighty Gadget, which I’ve proudly run since 2007. Obsessed with all issues expertise, my experience spans from computer systems and networking to cell, wearables, and good dwelling gadgets.

As a health fanatic who loves working and biking, I even have a eager curiosity in fitness-related expertise, and I take each alternative to cowl this area of interest on my weblog. My various pursuits enable me to deliver a novel perspective to tech running a blog, merging way of life, health, and the most recent tech traits.

In my tutorial pursuits, I earned a BSc in Info Techniques Design from UCLAN, earlier than advancing my studying with a Grasp’s Diploma in Computing. This superior examine additionally included Cisco CCNA accreditation, additional demonstrating my dedication to understanding and staying forward of the expertise curve.

I’m proud to share that Vuelio has constantly ranked Mighty Gadget as one of many prime expertise blogs within the UK. With my dedication to expertise and drive to share my insights, I purpose to proceed offering my readers with partaking and informative content material.