Unifi Route Domains By way of VPN When Utilizing AdGuard or PiHole DNS – The right way to Bypass On-line Security Act ID Checks

With the rollout of the On-line Security Act within the UK, it’s now essential to offer identification to web sites when viewing sure varieties of materials.

The intention is to forestall youngsters from accessing dangerous materials, however the system is so poorly thought-out that it’s straightforward to bypass with a VPN, and its broad attain means numerous comparatively regular content material will get filtered out.

Lately, my companion complained that she was unable to entry the True Crime subreddit as a consequence of this restriction. I may have arrange a VPN on her cellphone and pill to bypass this, however I doubt she would ever use it, as it might be an excessive amount of of a trouble for her.

VPN Critiques

The next are all just a few years previous, however they need to nonetheless be related.

UniFi UCG Max with Granular Management over VPN with Coverage-Based mostly Routing

I’ve the very good UniFi UCG Max for my house router, and it provides loads of VPN choices, together with the power to route visitors by third-party VPNs.

Moreover, your policy-based routing choices allow you to make use of the VPN for particular units or web sites.  

I’m at the moment utilizing Surfshark for my VPN, which makes it very straightforward to arrange router VPN connections. You set it up on the Surfshark web site, then obtain the configuration file and import it into Unifi. That’s mainly it.

At first, I used the best answer: I set my companion’s units to make use of Surfshark routing by Eire, the closest nation that doesn’t implement the On-line Security Act.

It did an awesome job of unblocking the subreddit she wished, however, as all her visitors was routed by Surfshark, when she accessed issues like Google, she persistently hit bot challenges.

I then tried to route visitors primarily based on domains solely, so anytime we accessed Reddit, it might undergo Surfshark. However, it simply wouldn’t work. I believed that it was a Reddit subdomain like redditmedia.com or redditstatic.com that was inflicting the difficulty, however these didn’t work both.

Exterior DNS, like AdGuard House and PiHole, Breaks Area-Based mostly Coverage Routing

Finally, I realised it was as a result of I exploit AdGuard House for my DNS.

Since visitors reaches AdGuard first, it finally bypasses the domain-based coverage routing.

Utilizing the Unifi UCG Max because the DNS server resolves the issue, however I don’t just like the ad-blocking choices with Unifi.

Finally, after some Googling (ChatGPT was ineffective for this), I discovered that you could inform AdGuard to route sure requests by a unique DNS.

So, within the case of Reddit, it’s a easy hyperlink it is advisable to add to the upstream DNS servers:

[/reddit.com/]192.168.0.1 (or regardless of the IP handle of your gateway is)

So, when a tool requests Reddit, the DNS request goes by the Unifi and the policy-based routing works.

Whereas I don’t use PiHole at house, it’s attainable to do the identical with this, albeit barely extra sophisticated.

The guides beneath ought to make it easier to arrange every part.

Organising the VPN Configuration File in Surfshark

With Surfshark, the method is straightforward:

1. Go to Handbook set-up – I want WireGuard
2. Choose I don’t have a key pair (assuming you haven’t completed this earlier than)
3. Title your connection
4. Click on generate keypair. You may then copy the private and non-private key, however this isn’t wanted in the event you obtain the conf file.
5. Choos location
6. This then opens the configuration file information, and you may obtain the file

Organising VPN in Unifi

For the preliminary setup of the VPN in Unifi, it is advisable to:

1. Go to Settings > VPN > VPN Consumer
2. Create VPN
3. Depart Wire Guard chosen and identify the VPN
4. Add the file
5. Click on Apply Adjustments

One caveat with the configuration information is that in the event you add two completely different Surfshark information, you’ll get a warning that the subnet with the opposite VPN overlaps

Unifi Coverage-Based mostly Routing for particular Domains to VPN interface with AdGuard House DNS

For Aguard, that is fairly easy:

• Log in to AdGuard
• Go to Settings > DNS Settings
• Then, in Upstream DNS servers, add domains you need to route by the VPN utilizing:
• [/domain.com/] IP  handle of Unifi gateway, so for me that might be:

[/reddit.com/]192.168.0.1

Unifi  Coverage-Based mostly Routing for particular Domains to VPN interface with PiHole House DNS

A caveat for this information is that I don’t usually use PiHole. I put in it on Proxmox utilizing Helper Scripts. I used ChatGPT to help me, and it really works, however there could also be a more practical answer.

That is barely extra sophisticated, however nonetheless straightforward. With the Helper Script set up on Proxmox, there isn’t any sudo to create information/directories

Do that (no sudo wanted):

1. Create the dnsmasq embrace listing

mkdir -p /and so on/dnsmasq.d

2. Create the customized routing file

cat > /and so on/dnsmasq.d/99-reddit-override.conf <<'EOF'
server=/reddit.com/192.168.0.1
server=/redd.it/192.168.0.1
server=/redditmedia.com/192.168.0.1
server=/redditstatic.com/192.168.0.1
EOF

(In the event you want nano: nano /and so on/dnsmasq.d/99-reddit-override.conf, paste the traces, save.)

Notes:

• Pi-hole/FTL reads all *.conf information in /and so on/dnsmasq.d — that is the proper place for per-domain upstream guidelines (server=/area/UPSTREAM).
• In the event you put in Pi-hole through Docker, run these instructions contained in the container (or map the listing as a quantity).
• This method impacts all purchasers utilizing your Pi-hole. If you need this just for particular units, say and I’ll present a per-client methodology.

I’m James, a UK-based tech fanatic and the Editor and Proprietor of Mighty Gadget, which I’ve proudly run since 2007. Enthusiastic about all issues expertise, my experience spans from computer systems and networking to cell, wearables, and sensible house units.

As a health fanatic who loves working and biking, I even have a eager curiosity in fitness-related expertise, and I take each alternative to cowl this area of interest on my weblog. My various pursuits enable me to convey a singular perspective to tech running a blog, merging life-style, health, and the most recent tech tendencies.

In my educational pursuits, I earned a BSc in Info Techniques Design from UCLAN, earlier than advancing my studying with a Grasp’s Diploma in Computing. This superior research additionally included Cisco CCNA accreditation, additional demonstrating my dedication to understanding and staying forward of the expertise curve.

I’m proud to share that Vuelio has persistently ranked Mighty Gadget as one of many prime expertise blogs within the UK. With my dedication to expertise and drive to share my insights, I purpose to proceed offering my readers with participating and informative content material.