6 ms·

Pi-hole is my most prized addition to my connected home. It was simple to set up, easy to manage, and easy to access for whitelisting. Now, all of my devices

Pi-hole is my most prized addition to my connected home. It was simple to set up, easy to manage, and easy to access for whitelisting. Now, all of my devices throughout my network benefit from the service, as opposed to relying on locally installed solutions. If you aren't using it, you should!

bungie4 7y ago
Agreed, I combined this with Cloudflare's DNS service (1.1.1.1). A great combo.
- brianpayne2 7y ago
  What are the advantages of using Cloudflare's DNS as opposed to say Google DNS or your ISP? Tracking?
  - ChikkaChiChi 7y ago
    Speed.
  - segfaultbuserr 7y ago
    Due to the architecture of DNS, DNS is not end-to-end encrypted. There is a potential solution (djb's DNSCurve), but it will not be deployed. As a result, let's do an assessment. Using Google DNS, self-hosted resolver, or your ISP's DNS: NSA, your ISP, everyone and every dog at the middle of your link to the Internet can track and see your requests. Using CloudFlare's DNS w/ DNS-over-HTTPS: only NSA (via a NSL or subpoena), Cloudflare and CloudFlare's upstream can track and see your requests. And I guess 10%-20% of the domain names already use CloudFlare, so for some domain, it's end-to-end encrypted, nobody but NSA and CloudFlare can track you. Even better, Cloudflare is experimenting with peering to upstreams (e.g. Facebook) using private encrypted connections, so the point-to-point encryption ratio would be even higher in the future. Therefore, using CloudFlare is a net positive. But one also needs to consider its second-order effect: is giving CloudFlare more leverage over the Internet infrastructure in the long run an acceptable choice over unencrypted DNS? I guess everyone has a different opinion.
    - KirinDave 7y ago
      What threat model does concealing DNS but not indirecting traffic via Tor address, given that Tor can also tunnel DNS? Cloudflare's not wrong that the DNS requests are hidden, but many classes of observer who could read your DNS request could also see you connect to the resting host? Follow up question, do you trust CloudFlare not to manipulate the results of DNS more or less than Google?
      - woofcat 7y ago
        Cloudflare has also rolled out ESNI (https://www.cloudflare.com/ssl/encrypted-sni/ https://www.cloudflare.com/ssl/encrypted-sni/) which would mean someone reading your traffic would only be able to tell that you're connecting to a cloudflare IP address. However be unable to determine which specific site you were accessing.
        KirinDave 7y ago
        What does that accomplish? As opposed to Tor use, specifically?
        woofcat 7y ago
        Well it to me has a few use cases that are reasonable. a) Used where Tor is unacceptable, such as some university networks, and workplaces where using anonymization such as Tor/VPN is prohibited by policy. b) When using Tor protecting yourself from the Tor endpoint collecting information / statistics on what you are visiting.
        KirinDave 7y ago
        Why do you want to present a false sense of improved privacy by only obfuscating your DNS queries in these networks? It seems to me like these DNS tricks are parlor tricks in a security sideshow. Any attacker that could see your packets can also see who you are connecting to. It's pretty rare that SNI does anything relevant to a real threat model. I think a false sense of privacy is at least as dangerous as the alternative.
  - entropicdrifter 7y ago
    Speed and tracking. Cloudflare claims they don't keep logs
    - asymptotically2 7y ago
      >Cloudflare claims that they don't keep logs Emphasis on 'claims', sadly we have no way of verifying that they don't actually keep logs.
- malvosenior 7y ago
  I would like to use Cloudflare DNS but they have a bug open with archive.is so you can't see archived links if you use them. https://community.cloudflare.com/t/1-1-1-1-does-not-resolve-archive-is/28059/11 https://community.cloudflare.com/t/1-1-1-1-does-not-resolve-...
deleted 7y ago
[deleted]
programbreeding 7y ago
Over 50% of my DNS queries get blocked by the pihole [0]; and I've seen it much higher. Like you said, it's one of the most prized devices on my network. [0] https://i.imgur.com/dPZzYjL.png https://i.imgur.com/dPZzYjL.png
- sbarre 7y ago
  That's fascinating.. I would love to know what the averages are across a wider range of users.. In contrast, For my home network, it's just under 15% of queries that get blocked. I've got 3 Macs, a Windows 10 machine, an Apple TV (all connected 24/7) and a handful of iOS devices that hop on and off the network. My blocklist contains ~114k domains I believe.
  - AstroJetson 7y ago
    28-30% here about ~114k domains also, 5 devices
  - mpettitt 7y ago
    I get about 15% of queries blocked with 3 Windows laptops, 2 Android phones, 1 iPhone, and a smart TV. I do run most of the traffic generated for work through work VPN though, and that tends to be the largest source of traffic (about 80% by data volume), which completely ignores local DNS.
  - secabeen 7y ago
    Some of it may be various IoT devices that are aggressive in retrying when they can't reach their census servers.
- quaffapint 7y ago
  60+% blocked here - mostly do to my Roku tv and all its logging.
loudtieblahblah 7y ago
I see it as an advantage for all the devices on your network. I mean, to block trackers from Windows computers, or Roku devices or android apps. But as an adblocker - I feel like I'm missing something. It acts as a DNS server for your local network and blocks what's essentially a host file. So how does it handle ads served through websockets? How does it handle ads that come from the same domain as legitimate content (which is increasingly common)? The complexity of rulesets by addons like ublock origin or PrivacyBadger seem to far surpass what PiHole is capable of. I think PiHole has it's place on a network - obviously, but people have been promoting this thing like you can just get rid of your adblocker on your browser now. People also downplay that this can be a pain in a home with a handful a streaming devices, each with a handful of apps. You end up whitelisting so much for those devices, you might as well whitelist the whole device just so the apps can work. Your wife downloads a game on her phone, and you get that look like "ok, why isn't this working.. what did you do now?" It just seems like a lot of effort for fairly imperfect results. Sure installation is easy, but long term maintenance (the OS, the app, constantly whitelisting or troubleshooting when a new service or app breaks for someone in the house).
- ryandrake 7y ago
  It's a layer of defense, to be used with other layers. It should not be used as the sole solution. I don't use PiHole but I use a similar manual setup using dnsmasq, but also employ browser-based adblocking.
- sbarre 7y ago
  There are tradeoffs in all solutions of course. The pi-hole asks you to choose security over convenience, and you must accept that not all apps and services will work. That's a personal choice you can make for your own setup in your own home. I've never seen anyone say this _replaces_ your browser's ad blocker though.
  - loudtieblahblah 7y ago
    >The pi-hole asks you to choose security over convenience, This is an easy choice for myself. it's not an easy choice for one person to make for a family of others.
isbjorn16 7y ago
Haven't you noticed any drastic reductions in speed? My rpi 3b (not 3b+) just couldn't handle it. It had 2 users. Our DNS resolution times increased by about 200ms. It was awful. I stripped it back out and haven't bothered trying to set it up again. (Other details: the RPI was hardwired, wireless disabled, and it was a fresh raspbian install with zero customization outside of adding pihole.)
- kasey_junk 7y ago
  I have my router setup to act as a dns resolver and cache, with the pi-hole (rpi 3b) upstream. This fixed my speed issues as only a few queries actually make it to the pi-hole. The router has a secondary dns server as well in case the rpi goes down (which has happened ~2 in the last year or so) or I need to fiddle with it.
- ashman5 7y ago
  I would say that you may have a setup issue with your router. My resolution times decreased when the pi-hole is providing DNS responses. I have 30+ devices on a 3b+. I'm using a UniFi setup and both WAN and LAN point to the pi-hole local ip address.
  - bgeeek 7y ago
    Same here. Absolutely fine.
  - isbjorn16 7y ago
    I'm running a pfsense setup with cloudflare as my DNS (DNS-over-TLS, in specific). As soon as I had the rpi in the middle, it jacked up resolution times like crazy (rpi was set to use my SG as its DNS, so <clients>->rpi->pfsense->1.1.1.1 It's good to know you guys haven't been having problems; I thought everyone was just fucking nuts or something, but no; local problem. Sigh.
    - workethics 7y ago
      If you're using pfsense, why not just use pfBlockerNG-dev?
w_s_l 7y ago
is there any security concerns with the pi itself? say your computer is infected with a really bad malware. it takes over your host, ignores your right to block out noise, and then the idea that pi-hole will be able to as a last resort block it out?
- ashman5 7y ago
  Some devices use hard coded DNS (looking at you G). You can force devices to use the pi-hole via masqurading. In you example, you'd be able to see the malware requests show up in the pi-hole interface.
zouhair 7y ago
The problem I have with Pi-Hole is that it is sometimes a pain for the end user. It's impossible to fine tune it on the user side, like one can do with ublock origin.

bungie4 7y ago

Agreed, I combined this with Cloudflare's DNS service (1.1.1.1). A great combo.

brianpayne2 7y ago
What are the advantages of using Cloudflare's DNS as opposed to say Google DNS or your ISP? Tracking?
- ChikkaChiChi 7y ago
  Speed.
- segfaultbuserr 7y ago
  Due to the architecture of DNS, DNS is not end-to-end encrypted. There is a potential solution (djb's DNSCurve), but it will not be deployed. As a result, let's do an assessment. Using Google DNS, self-hosted resolver, or your ISP's DNS: NSA, your ISP, everyone and every dog at the middle of your link to the Internet can track and see your requests. Using CloudFlare's DNS w/ DNS-over-HTTPS: only NSA (via a NSL or subpoena), Cloudflare and CloudFlare's upstream can track and see your requests. And I guess 10%-20% of the domain names already use CloudFlare, so for some domain, it's end-to-end encrypted, nobody but NSA and CloudFlare can track you. Even better, Cloudflare is experimenting with peering to upstreams (e.g. Facebook) using private encrypted connections, so the point-to-point encryption ratio would be even higher in the future. Therefore, using CloudFlare is a net positive. But one also needs to consider its second-order effect: is giving CloudFlare more leverage over the Internet infrastructure in the long run an acceptable choice over unencrypted DNS? I guess everyone has a different opinion.
  - KirinDave 7y ago
    What threat model does concealing DNS but not indirecting traffic via Tor address, given that Tor can also tunnel DNS? Cloudflare's not wrong that the DNS requests are hidden, but many classes of observer who could read your DNS request could also see you connect to the resting host? Follow up question, do you trust CloudFlare not to manipulate the results of DNS more or less than Google?
    - woofcat 7y ago
      Cloudflare has also rolled out ESNI (https://www.cloudflare.com/ssl/encrypted-sni/ https://www.cloudflare.com/ssl/encrypted-sni/) which would mean someone reading your traffic would only be able to tell that you're connecting to a cloudflare IP address. However be unable to determine which specific site you were accessing.
      - KirinDave 7y ago
        What does that accomplish? As opposed to Tor use, specifically?
        woofcat 7y ago
        Well it to me has a few use cases that are reasonable. a) Used where Tor is unacceptable, such as some university networks, and workplaces where using anonymization such as Tor/VPN is prohibited by policy. b) When using Tor protecting yourself from the Tor endpoint collecting information / statistics on what you are visiting.
        KirinDave 7y ago
        Why do you want to present a false sense of improved privacy by only obfuscating your DNS queries in these networks? It seems to me like these DNS tricks are parlor tricks in a security sideshow. Any attacker that could see your packets can also see who you are connecting to. It's pretty rare that SNI does anything relevant to a real threat model. I think a false sense of privacy is at least as dangerous as the alternative.
- entropicdrifter 7y ago
  Speed and tracking. Cloudflare claims they don't keep logs
  - asymptotically2 7y ago
    >Cloudflare claims that they don't keep logs Emphasis on 'claims', sadly we have no way of verifying that they don't actually keep logs.
malvosenior 7y ago
I would like to use Cloudflare DNS but they have a bug open with archive.is so you can't see archived links if you use them. https://community.cloudflare.com/t/1-1-1-1-does-not-resolve-archive-is/28059/11 https://community.cloudflare.com/t/1-1-1-1-does-not-resolve-...

deleted 7y ago

[deleted]

programbreeding 7y ago

Over 50% of my DNS queries get blocked by the pihole [0]; and I've seen it much higher. Like you said, it's one of the most prized devices on my network. [0] https://i.imgur.com/dPZzYjL.png https://i.imgur.com/dPZzYjL.png

sbarre 7y ago
That's fascinating.. I would love to know what the averages are across a wider range of users.. In contrast, For my home network, it's just under 15% of queries that get blocked. I've got 3 Macs, a Windows 10 machine, an Apple TV (all connected 24/7) and a handful of iOS devices that hop on and off the network. My blocklist contains ~114k domains I believe.
- AstroJetson 7y ago
  28-30% here about ~114k domains also, 5 devices
- mpettitt 7y ago
  I get about 15% of queries blocked with 3 Windows laptops, 2 Android phones, 1 iPhone, and a smart TV. I do run most of the traffic generated for work through work VPN though, and that tends to be the largest source of traffic (about 80% by data volume), which completely ignores local DNS.
- secabeen 7y ago
  Some of it may be various IoT devices that are aggressive in retrying when they can't reach their census servers.
quaffapint 7y ago
60+% blocked here - mostly do to my Roku tv and all its logging.

loudtieblahblah 7y ago

I see it as an advantage for all the devices on your network. I mean, to block trackers from Windows computers, or Roku devices or android apps. But as an adblocker - I feel like I'm missing something. It acts as a DNS server for your local network and blocks what's essentially a host file. So how does it handle ads served through websockets? How does it handle ads that come from the same domain as legitimate content (which is increasingly common)? The complexity of rulesets by addons like ublock origin or PrivacyBadger seem to far surpass what PiHole is capable of. I think PiHole has it's place on a network - obviously, but people have been promoting this thing like you can just get rid of your adblocker on your browser now. People also downplay that this can be a pain in a home with a handful a streaming devices, each with a handful of apps. You end up whitelisting so much for those devices, you might as well whitelist the whole device just so the apps can work. Your wife downloads a game on her phone, and you get that look like "ok, why isn't this working.. what did you do now?" It just seems like a lot of effort for fairly imperfect results. Sure installation is easy, but long term maintenance (the OS, the app, constantly whitelisting or troubleshooting when a new service or app breaks for someone in the house).

ryandrake 7y ago
It's a layer of defense, to be used with other layers. It should not be used as the sole solution. I don't use PiHole but I use a similar manual setup using dnsmasq, but also employ browser-based adblocking.
sbarre 7y ago
There are tradeoffs in all solutions of course. The pi-hole asks you to choose security over convenience, and you must accept that not all apps and services will work. That's a personal choice you can make for your own setup in your own home. I've never seen anyone say this _replaces_ your browser's ad blocker though.
- loudtieblahblah 7y ago
  >The pi-hole asks you to choose security over convenience, This is an easy choice for myself. it's not an easy choice for one person to make for a family of others.

isbjorn16 7y ago

Haven't you noticed any drastic reductions in speed? My rpi 3b (not 3b+) just couldn't handle it. It had 2 users. Our DNS resolution times increased by about 200ms. It was awful. I stripped it back out and haven't bothered trying to set it up again. (Other details: the RPI was hardwired, wireless disabled, and it was a fresh raspbian install with zero customization outside of adding pihole.)

kasey_junk 7y ago
I have my router setup to act as a dns resolver and cache, with the pi-hole (rpi 3b) upstream. This fixed my speed issues as only a few queries actually make it to the pi-hole. The router has a secondary dns server as well in case the rpi goes down (which has happened ~2 in the last year or so) or I need to fiddle with it.
ashman5 7y ago
I would say that you may have a setup issue with your router. My resolution times decreased when the pi-hole is providing DNS responses. I have 30+ devices on a 3b+. I'm using a UniFi setup and both WAN and LAN point to the pi-hole local ip address.
- bgeeek 7y ago
  Same here. Absolutely fine.
- isbjorn16 7y ago
  I'm running a pfsense setup with cloudflare as my DNS (DNS-over-TLS, in specific). As soon as I had the rpi in the middle, it jacked up resolution times like crazy (rpi was set to use my SG as its DNS, so <clients>->rpi->pfsense->1.1.1.1 It's good to know you guys haven't been having problems; I thought everyone was just fucking nuts or something, but no; local problem. Sigh.
  - workethics 7y ago
    If you're using pfsense, why not just use pfBlockerNG-dev?

w_s_l 7y ago

is there any security concerns with the pi itself? say your computer is infected with a really bad malware. it takes over your host, ignores your right to block out noise, and then the idea that pi-hole will be able to as a last resort block it out?

ashman5 7y ago
Some devices use hard coded DNS (looking at you G). You can force devices to use the pi-hole via masqurading. In you example, you'd be able to see the malware requests show up in the pi-hole interface.

zouhair 7y ago

The problem I have with Pi-Hole is that it is sometimes a pain for the end user. It's impossible to fine tune it on the user side, like one can do with ublock origin.