I’ve just set up my pihole and I’m considering the best way to configure it. Is it a good idea to set the default group to block (almost) all domains and then manually add trusted devices to another group with a “normal” block list? My use case is untrustworthy devices that I don’t want phoning home but which might change their IP address.
Untrusted devices should really be on their own VLAN. You will have much better control over them and their ability to reach out to the net, or gather info on your network and other devices. Some IoT devices have their DNS hardcoded, so they will ignore your Pihole anyway - you will need to redirect the DNS with outbound NAT to combat this.
More reading for me to do then, thanks!