5 ms·

I’ve been using Pi-Hole on my home network and it’s amazing. Routinely 18-20%% of DNS requests are blocked. When my wife goes out onto another network she says

by plg 8y ago

I’ve been using Pi-Hole on my home network and it’s amazing. Routinely 18-20%% of DNS requests are blocked. When my wife goes out onto another network she says she is shocked at how ugly her web browsing becomes (ads on nytimes, huffpo, etc). I highly recommend it. Am using it with cloudfare’s encrypted DNS just as one more middle finger to my ISP.

jcastro 8y ago
> Am using it with cloudfare’s encrypted DNS just as one more middle finger to my ISP. Curious how you set this up? I see cloudflare as an option in the pihole settings but doesn't appear to be encrypted? (at least as a default)
- judge2020 8y ago
  Probably via 'cloudflared': https://docs.pi-hole.net/guides/dns-over-https/ https://docs.pi-hole.net/guides/dns-over-https/
  - plg 8y ago
    Yup cloudfared
- spork12 8y ago
  Checkout DNS Crypt. It came as an option when I flashed my router to DDWRT but it can also be installed on your laptop/desktop. https://dnscrypt.info/ https://dnscrypt.info/
- klrkdekira 8y ago
  If you want more options, dnscrypt-proxy https://github.com/jedisct1/dnscrypt-proxy https://github.com/jedisct1/dnscrypt-proxy https://github.com/pi-hole/pi-hole/wiki/DNSCrypt-2.0 https://github.com/pi-hole/pi-hole/wiki/DNSCrypt-2.0
mdeeks 8y ago
You might already know this, but in case you don't: they can still see the domain names you visit in plain text because of TLS SNI: https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication Encrypted SNI is a thing on the horizon that'll let us give the dual middle finger to our ISPs. As far as I know, it is not here now though.
- newman314 8y ago
  There’s an open request to add ESNI support to cloudflared
- gmac 8y ago
  A way round this, of course, is a VPN. Which is also a handy way of using an ad-blocking DNS service everywhere. My setup is documented here: https://github.com/jawj/ikev2-setup https://github.com/jawj/ikev2-setup
Fnoord 8y ago
> When my wife goes out onto another network This is why I implemented WireGuard on top of it. All the traffic is encrypted through our home network (200/20 mbit) with DNS over TLS and adblocking due to Pi-Hole. LTE, open WLAN networks, all of these work. And roaming works very well with WireGuard. The downside is the 20 mbit upload.
- deleted 8y ago
  [deleted]
- madspindel 8y ago
  Any recommended tutorial for setting this up? I have a Raspberry Pi with Pi-hole and would be great to add Wireguard on top of that.
  - Fnoord 8y ago
    I use WireGuard on my router (ER-L) and Pi-Hole on the router as well, with a primary DNS on my Synology which uses Pi-Hole's Docker image [1]. Docker runs on Raspberry Pi, so I recommend you look into that route. Jessfraz wrote a howto on running WireGuard in Docker [2] [1] https://github.com/pi-hole/docker-pi-hole https://github.com/pi-hole/docker-pi-hole [2] https://blog.jessfraz.com/post/installing-and-using-wireguard/ https://blog.jessfraz.com/post/installing-and-using-wireguar...
dominotw 8y ago
Do their paid versions have ads too?

by plg 8y ago

jcastro 8y ago

> Am using it with cloudfare’s encrypted DNS just as one more middle finger to my ISP. Curious how you set this up? I see cloudflare as an option in the pihole settings but doesn't appear to be encrypted? (at least as a default)

judge2020 8y ago
Probably via 'cloudflared': https://docs.pi-hole.net/guides/dns-over-https/ https://docs.pi-hole.net/guides/dns-over-https/
- plg 8y ago
  Yup cloudfared
spork12 8y ago
Checkout DNS Crypt. It came as an option when I flashed my router to DDWRT but it can also be installed on your laptop/desktop. https://dnscrypt.info/ https://dnscrypt.info/
klrkdekira 8y ago
If you want more options, dnscrypt-proxy https://github.com/jedisct1/dnscrypt-proxy https://github.com/jedisct1/dnscrypt-proxy https://github.com/pi-hole/pi-hole/wiki/DNSCrypt-2.0 https://github.com/pi-hole/pi-hole/wiki/DNSCrypt-2.0

mdeeks 8y ago

You might already know this, but in case you don't: they can still see the domain names you visit in plain text because of TLS SNI: https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication Encrypted SNI is a thing on the horizon that'll let us give the dual middle finger to our ISPs. As far as I know, it is not here now though.

newman314 8y ago
There’s an open request to add ESNI support to cloudflared
gmac 8y ago
A way round this, of course, is a VPN. Which is also a handy way of using an ad-blocking DNS service everywhere. My setup is documented here: https://github.com/jawj/ikev2-setup https://github.com/jawj/ikev2-setup

Fnoord 8y ago

> When my wife goes out onto another network This is why I implemented WireGuard on top of it. All the traffic is encrypted through our home network (200/20 mbit) with DNS over TLS and adblocking due to Pi-Hole. LTE, open WLAN networks, all of these work. And roaming works very well with WireGuard. The downside is the 20 mbit upload.

deleted 8y ago
[deleted]
madspindel 8y ago
Any recommended tutorial for setting this up? I have a Raspberry Pi with Pi-hole and would be great to add Wireguard on top of that.
- Fnoord 8y ago
  I use WireGuard on my router (ER-L) and Pi-Hole on the router as well, with a primary DNS on my Synology which uses Pi-Hole's Docker image [1]. Docker runs on Raspberry Pi, so I recommend you look into that route. Jessfraz wrote a howto on running WireGuard in Docker [2] [1] https://github.com/pi-hole/docker-pi-hole https://github.com/pi-hole/docker-pi-hole [2] https://blog.jessfraz.com/post/installing-and-using-wireguard/ https://blog.jessfraz.com/post/installing-and-using-wireguar...

dominotw 8y ago

Do their paid versions have ads too?