During pihole setup, yes no question had no question. got confused. How to fix "increase security, it is recommended to block public access"

[vujnovich]

during the install, the yes no selection didnt have any black and white question, and I THINK i hit yes... The setup dialog about 'it is recommended to block public access to the pihole admin panel". How can I change or verify that I actually dont want WAN access to the admin panel... I couldnt figure out the ambigous wording, and would be nice if it read, "would you like wan access to the admin panel".

Any easy way I can run that part of the installer so it can fix the ipranges allowed to access the admin panel without wiping my whole pihole setup (I added a bunch of blocklists, whitelists etc)

[MichaIng]

Hmm, the dialog does actually contain a yes/no question, at the very bottom:

┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
│                                                                                                                      │
│ In order to increase security, it is recommended to block public access to the Pi-hole admin panel, so that only     │
│ connections from within your LAN or via VPN are possible.                                                            │
│                                                                                                                      │
│ Practically this means to deny access from all IPs that do not match the reserved loopback and LAN ranges:           │
│  - 127.*                                                                                                             │
│  - 192.168.*                                                                                                         │
│  - 10.*                                                                                                              │
│  - 172.16.* - 172.31.*                                                                                               │
│  - ::1                                                                                                               │
│  - fe80:* - febf:* (LLAs)                                                                                            │
│  - fc00:* - fdff:* (ULAs)                                                                                            │
│                                                                                                                      │
│ Note that if you use IPv6 and hostnames within your LAN, but no ULAs (Unique Local Addresses), this might also block │
│ accesses from within your LAN, as then GUAs (Global Unicast Addresses) are used, which cannot be distinguished from  │
│ public accesses.                                                                                                     │
│                                                                                                                      │
│ You can always enable/disable this later using the commands:                                                         │
│  -                                                                                                                   │
│  -                                                                                                                   │
│                                                                                                                      │
│ Do you want to block public access to the admin panel now?                                                           │
│                                                                                                                      │
│                                   <YES>                                      <NO>                                    │
│                                                                                                                      │
└──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘

The two (here empty) dashes near the end additionally show the two commands, based on the used webserver, to enable/disable this block afterwards.

Did it look different in your case?

To assure the block is enabled, which webserver do you use?

[vujnovich]

lightpd

[MichaIng]

Ah, you can scroll down with arrow down or page down buttons. There is still this never solved bug in whiptail that the scoll bar is not visible:

• https://bugs.debian.org/945320
• DietPi-Globals | whiptail has no scrollbar #2947

Alternatively, of course you can make the PuTTY window larger.

[vujnovich]

ahh thanks for the heads up. didnt even think of scrolling because it ended with a sentence... So would my best bet be saving the pihole backup, and just reinstalling pihole using the installer? I just wonder if the pihole backup restoration would introduce some bugs...

[MichaIng]

With Lighttpd, use the following command:

lighty-enable-mod dietpi-pihole-block_public_admin

No need to do a reinstall :).

[vujnovich]

youre a good man, like rumpelstilskin. Thanks for your knowledge you have bestowed upon me.