Modern cyber infrastructure relies heavily on secure name resolution. In standard desktop environments without DNS filtering, your client device queries root and authoritative servers across public networks...
Module 1 of 5
DNS Fundamentals & Baseline Browsing Setup
Understand how Domain Name System (DNS) functions, observe standard un-filtered DNS behavior, and record baseline browsing results on your Windows VM.
Key Learning Objectives
- DNS UDP/TCP Port 53: Translates human-readable domain names (e.g.,
example.com) into IP addresses (e.g.,93.184.216.34). - Standard Recursive DNS: By default, host OS DNS requests bypass filtering, loading intrusive ad networks, privacy tracking scripts, and potentially inappropriate/harmful web destinations.
- DNS Sinkholing: Intercepting specific domain lookups at the local resolver level and returning
0.0.0.0orNXDOMAINto block connections before traffic leaves the browser.
Target Virtual Lab Topology
Proxmox VE Server
Hypervisor Host
── Bridge (vmbr9999) ──
Pi-hole Server (LXC/VM)
IP: 192.168.1.50
Windows VM Client
IP: 192.168.1.100
Step 1.1: Standard "Before" Browsing Session Test
Before installing Pi-hole, launch your Windows VM browser and observe how standard public DNS (ISP / 8.8.8.8) handles webpage requests, ad scripts, and restricted domains.
💡 How Domain Testing Works in This Lab: The URL
http://news-portal.test/sports-tech and domains like doubleclick.net / betting-poker-live.test are featured in the interactive simulator below so you can visually preview ad sinkholing & OpenDNS blocks directly inside this web guide! For your live Windows VM hands-on test, you can visit real ad-heavy sites or run nslookup doubleclick.net and nslookup poker.com to observe live DNS sinkholing (0.0.0.0) and OpenDNS block pages.
Daily Tech & News Update
Today's Edition
Windows PowerShell - Baseline DNS Lookup Test
PS C:\Users\Student> nslookup doubleclick.net
Server: Unfiltered-Public-DNS
Address: 8.8.8.8
Non-authoritative answer:
Name: doubleclick.net
Addresses: 142.250.190.46
2607:f8b0:4004:837::200e
Module 2 of 5
Deploying Pi-hole on Proxmox VE (LXC / VM)
Deploy a lightweight Linux instance inside Proxmox VE, execute the official Pi-hole installation, assign a static IP, and log into the administrative web GUI.
Step 2.1: Proxmox Container / VM Specs
Inside your Proxmox VE Web Console (https://<proxmox-ip>:8006), create a new LXC Container or Virtual Machine using the following specification parameters:
OS Template
Debian 12 / Ubuntu 24.04
CPU Cores
1 vCPU
RAM / Memory
512 MB - 1024 MB
Disk Storage
8 GB (local-lvm)
Network Bridge
vmbr9999
Static IPv4
192.168.1.50 / 24
Step 2.2: Automated Pi-hole Installation
Open the console of your newly created Debian/Ubuntu container in Proxmox and execute the official automated installer command:
Proxmox Container Console (root@pihole)
root@pihole:~# curl -sSL https://install.pi-hole.net | bashWizard Configuration Choices (Follow Carefully):
- Static IP Warning: Click OK to confirm assigning
192.168.1.50as your permanent static IP address. - Upstream DNS Provider: Select
Google (8.8.8.8 / 8.8.4.4)orCloudflare (1.1.1.1)for this initial phase. - Blocklists (StevenBlack): Leave default
StevenBlack Unified Listenabled (blocks ~150,000+ ad/malware domains). - Admin Web Interface: Select
On(Install web interface & lighttpd web server). - Query Logging: Select
On(Show all queries & privacy mode: Show everything).
Step 2.3: Set Admin Password & Log In
Once installation finishes, reset your Web Admin password in the Proxmox console using the command below:
Set Web Interface Admin Password
root@pihole:~# pihole -a -p
[?] Please enter a new password for the Pi-hole web interface: ********
[✓] Password changed successfully!
Web Admin URL: Navigate to
http://192.168.1.50/admin from your browser to confirm the Pi-hole dashboard is live and operational.
Module 3 of 5
Attaching Windows VM Client & Pi-hole Ad-Blocking Comparison
Reconfigure your Windows VM DNS server settings to point to the Pi-hole IP, flush local resolver caches, and evaluate ad-blocking performance.
Step 3.1: Configure Windows VM DNS Server
On your Windows VM, change the IPv4 DNS Server address to point directly to your Pi-hole container IP address (192.168.1.50).
Administrator PowerShell
PS C:\Windows\system32> Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses ("192.168.1.50")- Press
Win + R, typencpa.cpland press Enter. - Right-click your active Network Adapter (e.g. Ethernet) and select Properties.
- Select Internet Protocol Version 4 (TCP/IPv4) → Click Properties.
- Select Use the following DNS server addresses:
Preferred DNS server:192.168.1.50 - Click OK and close network windows.
Step 3.2: Flush Windows Resolver Cache
Windows caches previous DNS lookups locally. You MUST flush the local DNS resolver cache to enforce queries through Pi-hole:
Windows PowerShell / Command Prompt
PS C:\Users\Student> ipconfig /flushdns
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.Step 3.3: "After Pi-hole" Browsing & Ad Sinkholing Test
Refresh your test page or run nslookup doubleclick.net on the Windows VM. Pi-hole will intercept known advertising & tracking domains, returning 0.0.0.0 (sinkhole).
Daily Tech & News Update
Today's EditionModern cyber infrastructure relies heavily on secure name resolution. In standard desktop environments without DNS filtering, your client device queries root and authoritative servers across public networks...
Windows PowerShell - After Pi-hole Sinkhole Test
PS C:\Users\Student> nslookup doubleclick.net
Server: pi.hole
Address: 192.168.1.50
Name: doubleclick.net
Addresses: 0.0.0.0
Module 4 of 5
Integrating OpenDNS Content Safeguards (Parental Control & Gambling Block)
Learn how local DNS sinkholing (Pi-hole) pairs with upstream content filtering (OpenDNS FamilyShield) to protect network users from adult, gambling, and dangerous web content.
Why Upstream Content Filtering is Needed
While Pi-hole is effective at stripping ad-trackers, standard ad lists do not categorize or filter web domains by content types (such as adult websites, gambling, violence, or phishing). Connecting Pi-hole to OpenDNS FamilyShield creates a multi-layered security shield.
🛡️ Tier 1: Pi-hole (Local Level)
Blocks invasive scripts, doubleclick banners, malware telemetry, and user tracking scripts instantly at the local LAN edge.
🔒 Tier 2: OpenDNS FamilyShield (Upstream Level)
Categorizes millions of websites worldwide and blocks harmful or inappropriate content categories (e.g. gambling, adult, illicit material).
Step 4.1: Configure OpenDNS Upstream in Pi-hole GUI
Configure Pi-hole to route all non-cached queries to OpenDNS FamilyShield servers:
- Log into Pi-hole Admin Dashboard (
http://192.168.1.50/admin). - Navigate to Settings → DNS tab.
- Under Upstream DNS Servers, uncheck standard providers (Google/Cloudflare).
- Check OpenDNS OR manually enter Custom 1 (IPv4) and Custom 2 (IPv4):
208.67.222.122(OpenDNS FamilyShield Primary)208.67.220.220(OpenDNS FamilyShield Secondary)
- Scroll down and click Save.
Step 4.2: OpenDNS Block Page & Gambling Domain Test
Flush Windows VM DNS cache (ipconfig /flushdns) and attempt to load a gambling domain (e.g. betting-poker-live.test or example-gambling.com):
🛡️ OpenDNS FamilyShield
ACCESS RESTRICTED BY CONTENT SAFEGUARD
This website (betting-poker-live.test) has been blocked by your network administrator because it is categorized under Gambling & Inappropriate Content.
Category: Gambling / Adult Content •
Filtered IP: 67.215.92.220
Windows PowerShell - OpenDNS Category Block Lookup
PS C:\Users\Student> nslookup betting-poker-live.test
Server: pi.hole
Address: 192.168.1.50
Non-authoritative answer:
Name: betting-poker-live.test
Address: 67.215.92.220 <-- OpenDNS Block Guide Landing IP
Module 5 of 5
Interactive DNS Resolution Simulator & Lab Assessment
Test real-time domain lookups across different DNS modes, complete the lab reflection quiz, and generate your official lab report.
Interactive Live DNS Resolution Simulator
Select a active DNS mode and type any domain name to observe how requests pass through local cache, Pi-hole Gravity lists, and OpenDNS filters.
💻 Windows Client
→
🛡️ Pi-hole (192.168.1.50)
→
🔒 OpenDNS (208.67.222.122)
DNS Packet & Query Log Inspection
Click "Execute Query" or select a preset domain above to observe packet routing details...
Knowledge Check Assessment
Answer the following questions to verify your understanding of DNS architecture, Pi-hole, and OpenDNS filtering.
1. What IP address does Pi-hole return by default when a domain is blocked by a Gravity ad list (sinkholed)?
2. Why is executing ipconfig /flushdns on the Windows client necessary after changing DNS servers?
3. What is the primary difference between standard Pi-hole adlists and OpenDNS FamilyShield?
4. Which network transport protocol and port number are standard for DNS name resolution queries?
Lab Reflection & Student Summary
Summarize your findings regarding how DNS filtering impacts user privacy, network bandwidth, and content safety:
🎓 Complete Assignment & Export Lab Report
Verify all modules are checked and download your formatted lab summary report for instructor submission.