Kable Academy DNS Architecture & Safeguards Lab

Kable Academy Cybersecurity • Proxmox VE • Pi-hole • OpenDNS

Lab Status 0 / 5 Completed
Module 1 of 5

DNS Fundamentals & Baseline Browsing Setup

Understand how Domain Name System (DNS) functions, observe standard un-filtered DNS behavior, and record baseline browsing results on your Windows VM.

Key Learning Objectives

  • DNS UDP/TCP Port 53: Translates human-readable domain names (e.g., example.com) into IP addresses (e.g., 93.184.216.34).
  • Standard Recursive DNS: By default, host OS DNS requests bypass filtering, loading intrusive ad networks, privacy tracking scripts, and potentially inappropriate/harmful web destinations.
  • DNS Sinkholing: Intercepting specific domain lookups at the local resolver level and returning 0.0.0.0 or NXDOMAIN to block connections before traffic leaves the browser.

Target Virtual Lab Topology

🖥️
Proxmox VE Server
Hypervisor Host
── Bridge (vmbr9999) ──
🛡️
Pi-hole Server (LXC/VM)
IP: 192.168.1.50
🪟
Windows VM Client
IP: 192.168.1.100

Step 1.1: Standard "Before" Browsing Session Test

Before installing Pi-hole, launch your Windows VM browser and observe how standard public DNS (ISP / 8.8.8.8) handles webpage requests, ad scripts, and restricted domains.

💡 Live Student Testing URLs: In this lab, students will test real-world, accessible URLs on their Windows VM:
  • Baseline & Ad-Blocking Test: Visit https://www.cnn.com or https://www.msn.com and run nslookup doubleclick.net.
  • OpenDNS Safeguard Test: Visit https://www.poker.com or https://www.gambling.com and run nslookup www.poker.com.
https://www.cnn.com
DNS: Default Unfiltered

CNN International & World News

Live Edition • Unfiltered DNS
SPONSORED AD (doubleclick.net)

🎉 CONGRATULATIONS! YOU WON $10,000 CASH!

Click here immediately to claim your casino prize bonus code!

Modern cyber infrastructure relies heavily on secure name resolution. In standard desktop environments without DNS filtering, your client device queries root and authoritative servers across public networks...

ADVERTISEMENT (www.poker.com)

🎰 High Stakes Online Casino & Poker Room

Play instant cash slots and live dealer blackjack online now!

Windows PowerShell - Baseline DNS Lookup Test 
PS C:\Users\Student> nslookup doubleclick.net
Server:  Unfiltered-Public-DNS
Address:  8.8.8.8

Non-authoritative answer:
Name:    doubleclick.net
Addresses:  142.250.190.46
            2607:f8b0:4004:837::200e
Module 2 of 5

Deploying Pi-hole on Proxmox VE (LXC / VM)

Deploy a lightweight Linux instance inside Proxmox VE, execute the official Pi-hole installation, assign a static IP, and log into the administrative web GUI.

Step 2.1: Proxmox Container / VM Specs

Inside your Proxmox VE Web Console (https://<proxmox-ip>:8006), create a new LXC Container or Virtual Machine using the following specification parameters:

OS Template Debian 12 / Ubuntu 24.04
CPU Cores 1 vCPU
RAM / Memory 512 MB - 1024 MB
Disk Storage 8 GB (local-lvm)
Network Bridge vmbr9999
Static IPv4 192.168.1.50 / 24

Step 2.2: Automated Pi-hole Installation

Open the console of your newly created Debian/Ubuntu container in Proxmox and execute the official automated installer command:

Proxmox Container Console (root@pihole) 
root@pihole:~# curl -sSL https://install.pi-hole.net | bash

Wizard Configuration Choices (Follow Carefully):

  1. Static IP Warning: Click OK to confirm assigning 192.168.1.50 as your permanent static IP address.
  2. Upstream DNS Provider: Select Google (8.8.8.8 / 8.8.4.4) or Cloudflare (1.1.1.1) for this initial phase.
  3. Blocklists (StevenBlack): Leave default StevenBlack Unified List enabled (blocks ~150,000+ ad/malware domains).
  4. Admin Web Interface: Select On (Install web interface & lighttpd web server).
  5. Query Logging: Select On (Show all queries & privacy mode: Show everything).

Step 2.3: Set Admin Password & Log In

Once installation finishes, reset your Web Admin password in the Proxmox console using the command below:

Set Web Interface Admin Password 
root@pihole:~# pihole -a -p
[?] Please enter a new password for the Pi-hole web interface: ********
[✓] Password changed successfully!
Web Admin URL: Navigate to http://192.168.1.50/admin from your browser to confirm the Pi-hole dashboard is live and operational.
Module 3 of 5

Attaching Windows VM Client & Pi-hole Ad-Blocking Comparison

Reconfigure your Windows VM DNS server settings to point to the Pi-hole IP, flush local resolver caches, and evaluate ad-blocking performance.

Step 3.1: Configure Windows VM DNS Server

On your Windows VM, change the IPv4 DNS Server address to point directly to your Pi-hole container IP address (192.168.1.50).

Administrator PowerShell 
PS C:\Windows\system32> Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses ("192.168.1.50")
  1. Press Win + R, type ncpa.cpl and press Enter.
  2. Right-click your active Network Adapter (e.g. Ethernet) and select Properties.
  3. Select Internet Protocol Version 4 (TCP/IPv4) → Click Properties.
  4. Select Use the following DNS server addresses:
    Preferred DNS server: 192.168.1.50
  5. Click OK and close network windows.

Step 3.2: Flush Windows Resolver Cache

Windows caches previous DNS lookups locally. You MUST flush the local DNS resolver cache to enforce queries through Pi-hole:

Windows PowerShell / Command Prompt 
PS C:\Users\Student> ipconfig /flushdns
Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

Step 3.3: "After Pi-hole" Browsing & Ad Sinkholing Test

Refresh your test page or run nslookup doubleclick.net on the Windows VM. Pi-hole will intercept known advertising & tracking domains, returning 0.0.0.0 (sinkhole).

https://www.cnn.com
DNS: Pi-hole Active (192.168.1.50)

CNN International & World News

Live Edition • Pi-hole Protection
🛡️ AD BLOCKED BY PI-HOLE SINKHOLE (0.0.0.0)

Request for doubleclick.net intercepted by Gravity List.

Modern cyber infrastructure relies heavily on secure name resolution. In standard desktop environments without DNS filtering, your client device queries root and authoritative servers across public networks...

⚠️ UNFILTERED CATEGORY (www.poker.com)

🎰 High Stakes Online Casino & Poker Room

Notice: Standard Pi-hole adlists block ad-servers, but DO NOT block categorized gambling, adult, or illegal content domains by default.

Windows PowerShell - After Pi-hole Sinkhole Test 
PS C:\Users\Student> nslookup doubleclick.net
Server:  pi.hole
Address:  192.168.1.50

Name:    doubleclick.net
Addresses:  0.0.0.0
Module 4 of 5

Integrating OpenDNS Content Safeguards (Parental Control & Gambling Block)

Learn how local DNS sinkholing (Pi-hole) pairs with upstream content filtering (OpenDNS FamilyShield) to protect network users from adult, gambling, and dangerous web content.

Why Upstream Content Filtering is Needed

While Pi-hole is effective at stripping ad-trackers, standard ad lists do not categorize or filter web domains by content types (such as adult websites, gambling, violence, or phishing). Connecting Pi-hole to OpenDNS FamilyShield creates a multi-layered security shield.

🛡️ Tier 1: Pi-hole (Local Level)

Blocks invasive scripts, doubleclick banners, malware telemetry, and user tracking scripts instantly at the local LAN edge.

🔒 Tier 2: OpenDNS FamilyShield (Upstream Level)

Categorizes millions of websites worldwide and blocks harmful or inappropriate content categories (e.g. gambling, adult, illicit material).

Step 4.1: Configure OpenDNS Upstream in Pi-hole GUI

Configure Pi-hole to route all non-cached queries to OpenDNS FamilyShield servers:

  1. Log into Pi-hole Admin Dashboard (http://192.168.1.50/admin).
  2. Navigate to Settings → DNS tab.
  3. Under Upstream DNS Servers, uncheck standard providers (Google/Cloudflare).
  4. Check OpenDNS OR manually enter Custom 1 (IPv4) and Custom 2 (IPv4):
    • 208.67.222.122 (OpenDNS FamilyShield Primary)
    • 208.67.220.220 (OpenDNS FamilyShield Secondary)
  5. Scroll down and click Save.

Step 4.2: OpenDNS Block Page & Gambling Domain Test

Flush Windows VM DNS cache (ipconfig /flushdns) and attempt to load a gambling domain (e.g. https://www.poker.com or https://www.gambling.com):

https://www.poker.com
DNS: Pi-hole + OpenDNS FamilyShield

ACCESS RESTRICTED BY CONTENT SAFEGUARD

This website (www.poker.com) has been blocked by your network administrator because it is categorized under Gambling & Inappropriate Content.

Category: Gambling / Adult Content • Filtered IP: 67.215.92.220
Windows PowerShell - OpenDNS Category Block Lookup 
PS C:\Users\Student> nslookup www.poker.com
Server:  pi.hole
Address:  192.168.1.50

Non-authoritative answer:
Name:    www.poker.com
Address:  67.215.92.220  <-- OpenDNS Block Guide Landing IP
Module 5 of 5

Interactive DNS Resolution Simulator & Lab Assessment

Test real-time domain lookups across different DNS modes, complete the lab reflection quiz, and generate your official lab report.

Interactive Live DNS Resolution Simulator

Select a active DNS mode and type any domain name to observe how requests pass through local cache, Pi-hole Gravity lists, and OpenDNS filters.

Quick Test Presets:
💻 Windows Client
→
🛡️ Pi-hole (192.168.1.50)
→
🔒 OpenDNS (208.67.222.122)
DNS Packet & Query Log Inspection
Click "Execute Query" or select a preset domain above to observe packet routing details...

Knowledge Check Assessment

Answer the following questions to verify your understanding of DNS architecture, Pi-hole, and OpenDNS filtering.

1. What IP address does Pi-hole return by default when a domain is blocked by a Gravity ad list (sinkholed)?

2. Why is executing ipconfig /flushdns on the Windows client necessary after changing DNS servers?

3. What is the primary difference between standard Pi-hole adlists and OpenDNS FamilyShield?

4. Which network transport protocol and port number are standard for DNS name resolution queries?

Lab Reflection & Student Summary

Summarize your findings regarding how DNS filtering impacts user privacy, network bandwidth, and content safety:

🎓 Complete Assignment & Export Lab Report

Verify all modules are checked and download your formatted lab summary report for instructor submission.