48 ms·

Pi-Hole 4.3.2

338 points by bjoko 7y ago

donkeyd 7y ago
I can't find this anywhere, but does Pi-Hole have any sort of client side 'reload without blocking' functionality? If I were to implement this in my network and a user has issues with a page not loading/functioning correctly, I feel like they'd need my help to add the site to a white list, which would be pretty inconvenient.
- y4mi 7y ago
  It has an API. > You can craft a URL that disables pi-hole for X minutes, using the API. You hit the boomark and boom, pi-hole temporarily disabled. If you save it to your phone's home-screen, you've got an instant disable button.
  - DrAwdeOccarim 7y ago
    Rad!
  - Legogris 7y ago
    What I'd really like is temporary whitelisting a single domain. Just because I need to use site X for a couple of minutes it doesn't mean I want the flood-gates open.
    - datenhorst 7y ago
      Wouldn't you have to whitelist multiple domains (30+ for theguardian.co.uk) for a feature like "reload without blocking"?
      - Legogris 7y ago
        This is more for the case when a single JS file fails to load from a CDN or things like ReCaptcha. Since it's an API, even if it would have been 30+ those could all still be approved with a single script call.
  - imglorp 7y ago
    Nice. There should be a browser plugin to make this convenient. Maybe a good side project?
  - universenz 7y ago
    Man, it would be nice if there were a native app for iOS which you could link to multiple Pi-Holes for easy management and/or Siri Shortcuts. I'd definitely drop a few bucks for that app - and I'm sure a few others would too! Please DM me if anyone is working on it and needs a beta tester via Test Flight.
    - jdgoesmarching 7y ago
      Pretty sure Shortcuts interacts with APIs, you could just drop that into a “choose from menu” thing when you activate the shortcut
- DrAwdeOccarim 7y ago
  I second this. A firefox plugin that is "on" or "off" would be great. I guess FoxyProxy is close if PiHole can act as a SOCKS proxy to do its blocking. Is that one way it can work?
  - ZoomZoomZoom 7y ago
    I guess, you can just use any socks proxy set up not using Pi-Hole DNS and just switch to it whenever you need to disable blocking.
- obituary_latte 7y ago
  Unfortunately it doesn’t at this point I don’t believe. But as another comment mentions, there is a nice api. Another option would be to create a bash script and create a php page with a form to add a domain to whitelist. I do something similar to whitelist ip’s for dns in iptables. Pi admin uses php so it’s already installed and working.
- deathwarmedover 7y ago
  You can do a timed disable (like a pause) from the Pi-hole UI: I've done 5-minute disables to eg. get through purchase check-out flows with tight coupling to trackers.
- chopin 7y ago
  There's a Firefox addon which can temporarily disable Pi-Hole.
crstin 7y ago
As the situation has worsened with the latest release of Safari I'm really interested to globally setup Pi-Hole on a VPS via docker and use it in combination with VPN (Strongswan) for all of my devices (also mobile). Has anybody had success with such a setup yet?
- adestefan 7y ago
  Looks like they have a document on that. https://docs.pi-hole.net/guides/vpn/overview/ https://docs.pi-hole.net/guides/vpn/overview/
- onlingyding 7y ago
  I haven't attempted that setup however I've got a Nginx server acting as a reverse proxy which implements DNS-over-TLS. Android 9 has support for custom private DNS servers so I just point it to my home IP and works great, no adverts when I'm out of the house.
- cripblip 7y ago
  It Does not have the vpn component but I have been very happy with nextdns for mobile ad blocking
- feistypharit 7y ago
  Check out https://nextdns.io/ https://nextdns.io/. Free now, but I do worry about their eventual monetization.
- obituary_latte 7y ago
  I have run pi-hole on the cheapest tier of Rackspace cloud server for 2+years now with great success. It’s wonderful. Just configure my routers dhcp to set my pi ip for dns and no ads anywhere (YouTube, streaming [except Hulu unfortunately], and general browsing). It’s especially nice now that it seems every company is offering their own streaming apps with ads. Recent example was I wanted to watch an action sports video and firetv had it with the redbull app. Ten or so minutes in and the video was interrupted with “here’s some ads” stinger and then the video immediately resumed. Kinda caught me off guard but produced an instant smile. One thing to consider though is becoming a dns resolver for any random thing on the net. What I did for this was create a bash script that adds the visiting ip to iptables whitelist. Created an impossible-to-guess php page (pi admin uses php so it’s already installed and ready to go) which takes the REMOTE_ADDR and passes it to the bash script to add to iptables. Makes it super easy to allow ip’s when isp changes address or when visiting family/friends and they want to use it.
coretx 7y ago
This might be an alternative for people who are too lazy for setting up a pi-hole or desire things to be a couple of ms faster: https://simplednscrypt.org/ https://simplednscrypt.org/
- thunderbong 7y ago
  This looks really good. Can it pull blacklists automatically?
- dexterdog 7y ago
  Windows only
- hendersoon 7y ago
  That isn't what I would call a simple solution for lazy people, it requires the user to run a local service and download/setup their own blocklist, with no way to automatically update it. Adguard DNS is a simple solution for lazy people. Change your DNS server and, well, that's it. https://adguard.com/en/adguard-dns/overview.html https://adguard.com/en/adguard-dns/overview.html
onyva 7y ago
Isn't it easier to set it up with wireguard? I’ve recently set up my turris running “adblock” (openwrt) natively with only wireguard open, connecting from my laptop, ipad and iPhone, which seems to me to be a far lighter and easier setup ....
asymmetric 7y ago
I spent some time implementing a Pi-hole module for NixOS, but eventually decided to go for a much simpler setup: dns server (dnsmasq or unbound) + periodically updated hosts file (via systemd timer) passed to the dns server. At the end of the day, that’s really all you need as a technical user, so I couldn’t justify he rest of what came with pi-hole, which I believe targets a less tech-savvy crowd. YMMV and I’m very happy Pi-hole exists, I think I’m just not the target audience. -- EDIT: see here[0] for an example configuration. [0]: https://deadc0de.re/articles/unbound-blocking-ads.html https://deadc0de.re/articles/unbound-blocking-ads.html
- apexalpha 7y ago
  >dns server (dnsmasq or unbound) + periodically updated hosts file (via systemd timer) passed to the dns server. This is what Pihole is... All extra is just default blocklists, API access, dashboard with stats and settings.
  - asymmetric 7y ago
    I invite you to look at the codebase more closely. Pi-hole is a fork of dnsmasq (FTL), a PHP web app, and a python web application, plus a bunch of shell scripts. Compared to what I linked above, there's really no comparison in terms of simplicity.
    - apexalpha 7y ago
      You literally said: "dnsmasq + periodically updated hosts file". That is what PiHole, in its core, is! The rest is just for the webserver, dashboard and API. You don't really need that. Sure, you're solution requires less code but I don't think it's easier to setup or manage.
      - asymmetric 7y ago
        > The rest is just for the webserver, dashboard and API. You don't really need that. Sure, you're solution requires less code but I don't think it's easier to setup or manage. I think this really depends on who you are. For me, using a systemd timer and a systemd service is easier than the set of ad-hoc solutions Pi-hole uses. For someone else, probably Pi-hole is easier. That was my point in the OP.
boyter 7y ago
Just recently I experimented going without my pi-hole or any ad blocker software for 4 weeks to see what would happen. My goodness the internet is a dumpster fire without it. So many pages lagging and slow to load. Things I wanted to click that jumped when an ad loaded resulting in miss clicks. Annoying things following me around. It was especially bad on mobile with the GDRP/Cookie notices and ad's to the point that on my iPhone SE some pages had a thin smear of the actual content no taller than a single line of text. News sites were especially bad for this. With the experiment ended my pi-hole and ad blockers are now set to very on (and updated to this version and can confirm the block list went from 100,000 to 89,000) and I am much happier. Seems about 20% of the traffic on my network is blocked now which explains why some pages performed so awfully. The ad industry really needs to up its game because the current state of the web is just horrible.
- madacoo 7y ago
  Why four weeks? Surely you could have reached a similar conclusion in a day, or less? Or did you learn anything in that time that couldn't have been learnt in a short burst of unprotected internet activity?
  - boyter 7y ago
    Seemed like a reasonable period of time. I got to see what the difference was on different devices including desktop, laptop, tablet and phone. I also got to see how they were affected for work, study and play over weekends and weekdays. I did notice I started to wait longer for pages to load with the ad's so that I would not accidentally click on them while they loaded in. That and I got generally annoyed by the web experience in general.
    - penagwin 7y ago
      This has always been my conclusion when I experiment with not using an ad blocker. So many websites with outwise "okayish" content are basically ruined by ads. Some sites are littered with "targeted" ads like download buttons and similar, which I'm not even sure why that's allowed. It's also fun on "big" websites like MS Teams, Netflix, hulu, etc, to see the "blocked" count raise into the hundreds.
Havoc 7y ago
Not quite clear what they are replacing easylist with? Like I get depreciating stuff but this seems like it’s still very much in active use? No plan B/transition?
- close04 7y ago
  Easylist was meant to be an adblock browser extension list and as such it's not perfectly suitable for a DNS blocking solution [0]. > select filter lists for use in your browser provided that you are using a compatible ad blocker (tested with Adblock Plus, AdBlock and uBlock Origin). The replacement is any other list of hosts available for PiHole. [0] https://easylist.to/ https://easylist.to/
- kup0 7y ago
  They have other blocklists. In fact, easylist isn't even enabled by default in Pi-hole. I've been running Pi-hole with its default set of blockers and it still blocks quite a bit, but there are all sorts of lists you can add on top of that.
- lightswitch05 7y ago
  If you are looking for more blocklists, I maintain several. I recommend my 'Ads & Tracking' list for most people. I also have an aggressive list - which I don't normally recommend. I also have a Google AMP list and a Facebook products list (not just facebook - but their other products as well). Anyways, you are welcome to check it out and give me any feedback you have: https://www.github.developerdan.com/hosts/ https://www.github.developerdan.com/hosts/
glaberficken 7y ago
Now what i really want is a universal gdpr-cookies-prompt killer. Does that exist?
- jannes 7y ago
  Yes! Activate the "annoyances" lists in uBlock Origin. I believe many of them are off by default. "AdGuard Annoyances" or "Fanboy's Annoyance List" and "Fanboy's Cookie List" should do the trick. However, I recommend enabling "Ignore generic cosmetic filters" in order to not load giant stylesheets into every single page.
  - glaberficken 7y ago
    omg...thank you, this is like browsing a new internet =)!
  - xpil 7y ago
    Ahhh, you just made my day. Thank you!
  - tombrossman 7y ago
    See also https://www.i-dont-care-about-cookies.eu/ https://www.i-dont-care-about-cookies.eu/ for a larger and more specific blocklist. I found it worked better for me because the annoyances list was too broad and blocked too many legitimate page elements, such as the <div> containing the play button for NPR podcasts.
fluential 7y ago
I’ve found any vpn including WireGuard running on mobile draining battery too much. Disabling third party cookies works much better, and for mobile safari using free ka-block.
1_player 7y ago
I've had my Pi-Hole for a month now. It's great, but many blocklists are bad. People often use https://firebog.net/ https://firebog.net/ to get their blocklists, and use only those with a checkmark which are, quote, "least likely to interfere with browsing". Bollocks, I've had to disable a few of the recommended ones, and adding manual whitelisted hosts because they were blocking legitimate sites (ocsp.apple.com), blocking Windows updates, blocking Instagram altogether!
- jacobush 7y ago
  Hehe, Insta. I can sympathize a bit there.
- lightswitch05 7y ago
  I agree that blocking OCSP (Online Certificate Status Protocol) servers is a bad practice. The argument to block them is that they can be used for tracking purposes. OCSP stapling is a great way to use OCSP without the risk of tracking - but not everyone does it or supports it. Anyways, I maintain an 'Ads & Tracking' blocklist that I believe is pretty reliable and you are welcome to give it a try if you like: https://www.github.developerdan.com/hosts/ https://www.github.developerdan.com/hosts/ I've been maintaining my list publicly for over a year, and I've got to say its not always clear what deserves to be blocked, what should be blocked but can't be due to broken functionality, and what is legitimate like the OCSP servers. Everyone has their own personal level of expected privacy vs functionality. Its impossible to make everyone happy. I just wanted to say that being a maintainer of these lists isn't always easy. The obvious example you provided with (ocsp.apple.com) isn't exactly obvious because it _could_ be used for tracking, and it certainly isn't need for functional reasons (although I would argue that it is needed for security reasons). Anyways, there is a lot of gray when it comes to blocking and you can't make everyone happy.
  - drukenemo 7y ago
    Sorry for my ignorance, but how could I load these into Pi-Hole?
    - 7y ago
rietta 7y ago
I have Pi Hole running on my LAN and it's amazing. Also helped me identify that my Amcrest PoE security cameras aggressively phone home, even when no cloud functionality is configured on them. All the reason to keep them on their own VLAN and off the Internet.
- Mister_Snuggles 7y ago
  Separate VLANs is the right answer. Phoning home is not an Amcrest-specific thing, all of my cameras (I have a handful of Amcrest and D-Link cameras, and one Reolink camera) try to do that. I've put them all in a separate VLAN which can't access anything, not even DNS. The NVR software lives on a different VLAN and is able to open connections to the cameras for recording. This setup works perfectly. Most importantly, the cameras all work fine even if they can't phone home.
  - lifty 7y ago
    What access point do you use the offers VLAN functionality?
    - geggam 7y ago
      I built my own with OpenBSD to get this and other functionality Not to mention the cool toys you can setup to see what is happening https://undeadly.org/cgi?action=article;sid=20140228093820 https://undeadly.org/cgi?action=article;sid=20140228093820
    - tga 7y ago
      For an actual AP, check out the Unifi AP line. https://www.ui.com/unifi/unifi-ap https://www.ui.com/unifi/unifi-ap For a home wireless router, you can buy a supported device and install OpenWRT. https://openwrt.org/supported_devices https://openwrt.org/supported_devices
    - Mister_Snuggles 7y ago
      The access point I use is a UniFi AP-AC-Pro. You can create multiple wifi networks and map each one to a separate VLAN. I also use UniFi switches and a UniFi Security Gateway, but really any equivalent that supports VLANs will work. I believe I also accomplished the same thing with an Asus router/AP running DD-WRT, but that was a long time ago.
philliphaydon 7y ago
Donno if this is a silly question or not. But if there anywhere to buy a raspberry + pi with pi-hole pre-configured on it? I've wanted one for a while but just wanna plug it in and go to the web console, not buy it set it up install it etc.
- qzx_pierri 7y ago
  All you have to do is run a script from the pi-hole website to install. It’s very effortless. Like.. literally effortless. If you’re posting here, I guarantee you could do it in no time. The “hardest” part is excluding an IP for the pihole & setting your DHCP server to serve that IP w/ new leases. Good luck dude.
  - philliphaydon 7y ago
    Haha ok. I Guess my Xmas present to myself this year is a raspberry pi and setting this up :) Thanks!
    - guilhermetk 7y ago
      Go for it, it's really worth the effort, even if it is a small one, with the bonus of being fun (at least for me it is). I can't imagine setting up my home network without pihole, and I'm considering setting it up at work, I manage a small network with 100 devices connected to the internet.
      - benplumley 7y ago
        Can a Pi really keep up with that size of network or would you run it on more powerful hardware/a VM?
        theandrewbailey 7y ago
        DNS is a very light protocol. In addition, responses tend to be cached, so it's not like the Pi would be hit with a dozen queries on literally every page load for every client on the network.
Mister_Snuggles 7y ago
The one thing that's holding me back on actually using Pi-Hole is the lack of flexibility. What I'd really like to see is the ability to do various things on a per-client basis. For example, one commenter wanted a simple "reload without blocking" functionality and the response was to use a bookmarklet plus the Pi-Hole API to disable it temporarily. This works, but the problem is that it disables it temporarily for everyone and will inevitably result in "Hey, why's the ad blocker broken?" "Oh, sorry, that was me" conversations. Likewise, I'd also like to be able to configure block lists on a per-client basis. I don't want any Facebook stuff (for example) to resolve from my devices, but my girlfriend wants to use Facebook. Similarly, I may want different rules on different networks. For example, I may want to restrict what my IoT network can resolve differently than my regular user network. This is really just a generalization of doing things on a per-client basis. Currently the only solution to these types of problems is to maintain multiple Pi-Hole installations. This isn't a big deal if it's just one or two, but it doesn't scale reasonably.
- mihaifm 7y ago
  Pihole is just a GUI on top of dnsmasq, they're not doing anything fancy, apart maybe for the extra statistics. These are some interesting ideas for improvement, I'd also be interested in something with more flexibility, but I'm not sure if there's an alternative at the moment.
  - mikepurvis 7y ago
    There are still a few possibilities for how it could work— first would be running multiple instances of dnsmasq and then putting a reverse proxy in front of them that would direct the traffic based on who's asking. Another would be switching to a purpose-built DNS resolver/cache that had this capability. Finally, you could have per-client DNS IPs, but this would require the cooperation of the DHCP server, which is less typical on a home network where that's often a closed-source router. But a "super pi-hole" following this pattern could also potentially be the DHCP server. (Yes, raspberry pi can run OpenWRT: https://openwrt.org/toh/raspberry_pi_foundation/raspberry_pi https://openwrt.org/toh/raspberry_pi_foundation/raspberry_pi)
dfischer 7y ago
What's the most secure way to setup something like this on your network?
- AnIdiotOnTheNet 7y ago
  The most secure server is one that is turned off, so I recommend that.
bni 7y ago
Can Pi-Hole block YouTube ads yet?
- dexterdog 7y ago
  Either pihole or ublock origin blocks them. That's what I use and I never see them.
  - adestefan 7y ago
    I know ublock origin does because I have been using that on my systems and never see them.
- n1c 7y ago
  Not as far as I'm aware, no.
- Flott 7y ago
  It doesn't work for me at least. I still see a ton of ads on the youtube app on all of my Roku devices. I heard that it works for some people so maybe i'm hitting domains that aren't in the blocklists due to my location?
- Chico75 7y ago
  Not when those ads are just other youtube videos
- drukenemo 7y ago
  No, it blocks DNS requests and YouTube ads are served from the same DNS used by the actual YouTube video.
aurbano 7y ago
I already have uBlock Origin on Firefox, with tracking protection set to strict and I don't really remember seeing ads on desktop. I guess the main benefit of the PiHole is to have ad blocking on mobile devices, iPads... and others, do you think this is worth the effort of setting up in your experience?
- pimeys 7y ago
  You can see a screenshot from my VPN pihole blocking tracking requests from my android phone and make a decision do you need it or not. https://i.imgur.com/Hpcw42h.png https://i.imgur.com/Hpcw42h.png
  - aurbano 7y ago
    Damn, that's amazing.. can't believe 76% of requests are unnecessary. Assuming you're running this on a RPi at home, do you have DynDNS or how are you managing the external IP?
    - bjoli 7y ago
      I have similar numbers. 90% of the blocked requests I see come from 3 apps that are particularly diligent about submitting metrics. 2 phones have outlook installed and boy does outlook hate when metrics fails! Those phones alone account for half of the DNS requests in a network with about 15 devices, despite being out of the house for 9 hours every day.
    - pimeys 7y ago
      I have this running on a Hetzner server and connecting my phone to it with Wireguard. At home I have another pihole running in my router.
  - MikusR 7y ago
    Without list of sites it blocks those numbers are useless. I could setup to block only news.ycombinator.com and the result would be similar
zaro 7y ago
Openwrt has DNS ad-blocking built in which works just as well as pi-hole. It simply doesn't have the monitoring of what is being blocked but it is rarely needed anyway. https://openwrt.org/docs/guide-user/services/ad-blocking https://openwrt.org/docs/guide-user/services/ad-blocking
- inyorgroove 7y ago
  pfSense also has pfBlocker-ng[1] which can also be used for this purpose. [1] https://docs.netgate.com/pfsense/en/latest/packages/pfblocker.html https://docs.netgate.com/pfsense/en/latest/packages/pfblocke...
- theandrewbailey 7y ago
  If your router hardware is sufficient enough, OpenWRT supports QEMU, so you can run Pi-Hole in that: https://openwrt.org/docs/guide-user/virtualization/qemu_host https://openwrt.org/docs/guide-user/virtualization/qemu_host
  - pimeys 7y ago
    I'm running it in an LCX container on OpenWRT. Better to have an external disk connected for the container so the logging will not burn the internal storage too fast.
apexalpha 7y ago
I'm a huge fan of this project! I have 3 set-up right now. One as container on my Nuc at home for myself, and 2 other on old Pi's (one is a 1st gen B model) for family. A simple cron job to run every 2 months keeps everything up to date. For myself I use Wireguard to only forward DNS packets to the PiHole when I'm outside the house. If you install a PiHole (and maybe Unchecky.com) your help desk calls from family will drop by 90% (personal experience).
fotcorn 7y ago
I am running Pi-Hole at home (on a Ubuntu VM, no Raspberry Pi necessary). In addition I have a Wireguard VPN server which uses the DNS server from Pi-Hole. This way a have a system-wide ad blocker for my smartphone when connected to the VPN. The latency hit from this setup is barely noticeable.
deleted 7y ago
[deleted]
yumraj 7y ago
One unadvertised advantage of pihole is monitoring and blocking sites that you don't want kids to use, such as the thousands of io-games and what not.
- bloopernova 7y ago
  We use it to block phone-home sites that devices like "smart" TVs use to send data back for the manufacturer to profit off.
  - TheChaplain 7y ago
    There was a thread a month ago here (or on Reddit perhaps) about SmartTV's scanning/connecting to open hotspots if they can't phone home from their wlan. Someone also claimed TV's from the same manufacturer connects to eachother in a mesh to find a way to phone home but that sounds a little too spectacular...
testdelacc1 7y ago
Is this substantially better than using ublock origin? I feel like my browsing experience is pretty good right now, and I'm uncertain what the benefits to upgrading are.
- bun_at_work 7y ago
  It really depends on what you want/need. The Pi-hole blocks ad traffic by blocking DNS requests to known advertisement URLs. Ublock Origin works great in your browser. However, what about that app on your phone that plays an ad every time you open it? What if you use a mobile browser that doesn't have extensions (Chrome on mobile doesn't). It really comes down to where you want to block ads. Also, I don't know if Ublock Origin actually blocks the ad requests or just prevents them from loading, but if it's the latter, then you can reduce traffic with Pi-hole as well.
- prab97 7y ago
  You need to setup ublock origin on every browser on every device. With pihole, all your devices automatically get adblocking, even your friends coming home and connecting to your wifi get the ad blocking advantage without anything to do on their part.
- jeroenhd 7y ago
  No. But it works on all devices in your network (phone, computer, smart TV, WiFi connected dishwasher, etc.). I've never really understood how much tracking some apps on my phone did until I saw the graph showing lookups to Facebook's and Google's servers. In the middle of the night, a bunch of apps started trying to reach some tracking domain, something I would never have noticed if it wasn't for the graphing feature. One way I've noticed the difference with and without pihole is that most apps on my phone become ad free when I connect to my home network. On most phones ad blockers exist, but those are just another layer of software that needs to be woken when the phone wakes from deep sleep. I use pihole + uBlock in Firefox with tracking protection (on both mobile and PC) for my browsing, but Pihole saves me the effort of finding a reliable Android system ad blocker that's reasonably power efficient. I'm considering also using it on my laptop as a VM to get the same features on the go.
- 7y ago
deleted 7y ago
[deleted]
deleted 7y ago
[deleted]
intenseagile 7y ago
I set up a pi hole a few months ago. I'm not sure why I waited so long to do so. It's been great to be honest. Now and then someone in my family has a broken web app and I have to whitelist a few things. Confused my wife once or twice, but that's about the only downside. Now she knows to check with me if she doesn't get the expected result.
auslander 7y ago
Does Pi-Hole know when a request is third-party or first-party? IMHO only browser knows that.
cellover 7y ago
If the font is too thin for you: * F12 * Console tab * jQuery('body').css('font-weight', '500');
greenie_beans 7y ago
cool! thanks for building this, fun for a hobbyist
Jaepa 7y ago
I really wish PiHole would support DOH. Currently if you want to have secured DNS you have to set up a DOH local proxy, then connect pihole to that.
- mc32 7y ago
  Can’t you setup cloudflared on your pi-hole or does it have issues?
  - hendersoon 7y ago
    That's what I did. Works fine. It would of course be far better if Pihole supported DNS over HTTPS natively.
Fiahil 7y ago
My pi-hole is blocking 20% of all queries. Can we say that 20% of end-users internet traffic is for tracking and advertising ?
- the100rabh 7y ago
  38.6% for me, guess YMMV based what you do on your devices
- derrasterpunkt 7y ago
  This 20% queries could be 50% (or whatever) of your traffic. It depends what is being downloaded, would the queries be successful. You could measure the website you‘re visiting with/without the pihole.
froindt 7y ago
Preface: I'm moderately technical but don't understand the specific nuances of DNS. Is there any possibility Pi-Hole and the DNS server plus hosts file could be used in an attack? Could I setup a web server with identical UI to my target site, get one of the list providers to direct chase.com to my IP, list gets propagated to all Pi-Hole devices, and start collecting credentials?
- wnissen 7y ago
  At the moment, if an attacker has control of your DNS, it's game over before you even start. There are some technologies that help, such as secure DNS (DNSSEC) and "certificate pinning" but they don't do everything.
  - tptacek 7y ago
    In the case of DNSSEC, it doesn't do anything in this scenario, for two reasons: first, and most importantly, virtually nobody uses it (for instance, like almost every tech company as well, CHASE.COM isn't DNSSEC-signed and isn't likely to do so), and secondly because DNSSEC protects only server-to-server lookups and not client-server lookups, so if your Pi-Hole picks up a bad record somehow, DNSSEC isn't going to keep your browser from detecting that.
theomega 7y ago
Any recommendations for block lists for PI-Hole? I found the default lists not really covering enough. What lists are you using?

338 points by bjoko 7y ago

I can't find this anywhere, but does Pi-Hole have any sort of client side 'reload without blocking' functionality? If I were to implement this in my network and a user has issues with a page not loading/functioning correctly, I feel like they'd need my help to add the site to a white list, which would be pretty inconvenient.

y4mi 7y ago
It has an API. > You can craft a URL that disables pi-hole for X minutes, using the API. You hit the boomark and boom, pi-hole temporarily disabled. If you save it to your phone's home-screen, you've got an instant disable button.
- DrAwdeOccarim 7y ago
  Rad!
- Legogris 7y ago
  What I'd really like is temporary whitelisting a single domain. Just because I need to use site X for a couple of minutes it doesn't mean I want the flood-gates open.
  - datenhorst 7y ago
    Wouldn't you have to whitelist multiple domains (30+ for theguardian.co.uk) for a feature like "reload without blocking"?
    - Legogris 7y ago
      This is more for the case when a single JS file fails to load from a CDN or things like ReCaptcha. Since it's an API, even if it would have been 30+ those could all still be approved with a single script call.
- imglorp 7y ago
  Nice. There should be a browser plugin to make this convenient. Maybe a good side project?
- universenz 7y ago
  Man, it would be nice if there were a native app for iOS which you could link to multiple Pi-Holes for easy management and/or Siri Shortcuts. I'd definitely drop a few bucks for that app - and I'm sure a few others would too! Please DM me if anyone is working on it and needs a beta tester via Test Flight.
  - jdgoesmarching 7y ago
    Pretty sure Shortcuts interacts with APIs, you could just drop that into a “choose from menu” thing when you activate the shortcut
DrAwdeOccarim 7y ago
I second this. A firefox plugin that is "on" or "off" would be great. I guess FoxyProxy is close if PiHole can act as a SOCKS proxy to do its blocking. Is that one way it can work?
- ZoomZoomZoom 7y ago
  I guess, you can just use any socks proxy set up not using Pi-Hole DNS and just switch to it whenever you need to disable blocking.
obituary_latte 7y ago
Unfortunately it doesn’t at this point I don’t believe. But as another comment mentions, there is a nice api. Another option would be to create a bash script and create a php page with a form to add a domain to whitelist. I do something similar to whitelist ip’s for dns in iptables. Pi admin uses php so it’s already installed and working.
deathwarmedover 7y ago
You can do a timed disable (like a pause) from the Pi-hole UI: I've done 5-minute disables to eg. get through purchase check-out flows with tight coupling to trackers.
chopin 7y ago
There's a Firefox addon which can temporarily disable Pi-Hole.

crstin 7y ago

As the situation has worsened with the latest release of Safari I'm really interested to globally setup Pi-Hole on a VPS via docker and use it in combination with VPN (Strongswan) for all of my devices (also mobile). Has anybody had success with such a setup yet?

adestefan 7y ago
Looks like they have a document on that. https://docs.pi-hole.net/guides/vpn/overview/ https://docs.pi-hole.net/guides/vpn/overview/
onlingyding 7y ago
I haven't attempted that setup however I've got a Nginx server acting as a reverse proxy which implements DNS-over-TLS. Android 9 has support for custom private DNS servers so I just point it to my home IP and works great, no adverts when I'm out of the house.
cripblip 7y ago
It Does not have the vpn component but I have been very happy with nextdns for mobile ad blocking
feistypharit 7y ago
Check out https://nextdns.io/ https://nextdns.io/. Free now, but I do worry about their eventual monetization.
obituary_latte 7y ago
I have run pi-hole on the cheapest tier of Rackspace cloud server for 2+years now with great success. It’s wonderful. Just configure my routers dhcp to set my pi ip for dns and no ads anywhere (YouTube, streaming [except Hulu unfortunately], and general browsing). It’s especially nice now that it seems every company is offering their own streaming apps with ads. Recent example was I wanted to watch an action sports video and firetv had it with the redbull app. Ten or so minutes in and the video was interrupted with “here’s some ads” stinger and then the video immediately resumed. Kinda caught me off guard but produced an instant smile. One thing to consider though is becoming a dns resolver for any random thing on the net. What I did for this was create a bash script that adds the visiting ip to iptables whitelist. Created an impossible-to-guess php page (pi admin uses php so it’s already installed and ready to go) which takes the REMOTE_ADDR and passes it to the bash script to add to iptables. Makes it super easy to allow ip’s when isp changes address or when visiting family/friends and they want to use it.

coretx 7y ago

This might be an alternative for people who are too lazy for setting up a pi-hole or desire things to be a couple of ms faster: https://simplednscrypt.org/ https://simplednscrypt.org/

thunderbong 7y ago
This looks really good. Can it pull blacklists automatically?
dexterdog 7y ago
Windows only
hendersoon 7y ago
That isn't what I would call a simple solution for lazy people, it requires the user to run a local service and download/setup their own blocklist, with no way to automatically update it. Adguard DNS is a simple solution for lazy people. Change your DNS server and, well, that's it. https://adguard.com/en/adguard-dns/overview.html https://adguard.com/en/adguard-dns/overview.html

onyva 7y ago

Isn't it easier to set it up with wireguard? I’ve recently set up my turris running “adblock” (openwrt) natively with only wireguard open, connecting from my laptop, ipad and iPhone, which seems to me to be a far lighter and easier setup ....

asymmetric 7y ago

I spent some time implementing a Pi-hole module for NixOS, but eventually decided to go for a much simpler setup: dns server (dnsmasq or unbound) + periodically updated hosts file (via systemd timer) passed to the dns server. At the end of the day, that’s really all you need as a technical user, so I couldn’t justify he rest of what came with pi-hole, which I believe targets a less tech-savvy crowd. YMMV and I’m very happy Pi-hole exists, I think I’m just not the target audience. -- EDIT: see here[0] for an example configuration. [0]: https://deadc0de.re/articles/unbound-blocking-ads.html https://deadc0de.re/articles/unbound-blocking-ads.html

apexalpha 7y ago
>dns server (dnsmasq or unbound) + periodically updated hosts file (via systemd timer) passed to the dns server. This is what Pihole is... All extra is just default blocklists, API access, dashboard with stats and settings.
- asymmetric 7y ago
  I invite you to look at the codebase more closely. Pi-hole is a fork of dnsmasq (FTL), a PHP web app, and a python web application, plus a bunch of shell scripts. Compared to what I linked above, there's really no comparison in terms of simplicity.
  - apexalpha 7y ago
    You literally said: "dnsmasq + periodically updated hosts file". That is what PiHole, in its core, is! The rest is just for the webserver, dashboard and API. You don't really need that. Sure, you're solution requires less code but I don't think it's easier to setup or manage.
    - asymmetric 7y ago
      > The rest is just for the webserver, dashboard and API. You don't really need that. Sure, you're solution requires less code but I don't think it's easier to setup or manage. I think this really depends on who you are. For me, using a systemd timer and a systemd service is easier than the set of ad-hoc solutions Pi-hole uses. For someone else, probably Pi-hole is easier. That was my point in the OP.

boyter 7y ago

Just recently I experimented going without my pi-hole or any ad blocker software for 4 weeks to see what would happen. My goodness the internet is a dumpster fire without it. So many pages lagging and slow to load. Things I wanted to click that jumped when an ad loaded resulting in miss clicks. Annoying things following me around. It was especially bad on mobile with the GDRP/Cookie notices and ad's to the point that on my iPhone SE some pages had a thin smear of the actual content no taller than a single line of text. News sites were especially bad for this. With the experiment ended my pi-hole and ad blockers are now set to very on (and updated to this version and can confirm the block list went from 100,000 to 89,000) and I am much happier. Seems about 20% of the traffic on my network is blocked now which explains why some pages performed so awfully. The ad industry really needs to up its game because the current state of the web is just horrible.

madacoo 7y ago
Why four weeks? Surely you could have reached a similar conclusion in a day, or less? Or did you learn anything in that time that couldn't have been learnt in a short burst of unprotected internet activity?
- boyter 7y ago
  Seemed like a reasonable period of time. I got to see what the difference was on different devices including desktop, laptop, tablet and phone. I also got to see how they were affected for work, study and play over weekends and weekdays. I did notice I started to wait longer for pages to load with the ad's so that I would not accidentally click on them while they loaded in. That and I got generally annoyed by the web experience in general.
  - penagwin 7y ago
    This has always been my conclusion when I experiment with not using an ad blocker. So many websites with outwise "okayish" content are basically ruined by ads. Some sites are littered with "targeted" ads like download buttons and similar, which I'm not even sure why that's allowed. It's also fun on "big" websites like MS Teams, Netflix, hulu, etc, to see the "blocked" count raise into the hundreds.

Havoc 7y ago

Not quite clear what they are replacing easylist with? Like I get depreciating stuff but this seems like it’s still very much in active use? No plan B/transition?

close04 7y ago
Easylist was meant to be an adblock browser extension list and as such it's not perfectly suitable for a DNS blocking solution [0]. > select filter lists for use in your browser provided that you are using a compatible ad blocker (tested with Adblock Plus, AdBlock and uBlock Origin). The replacement is any other list of hosts available for PiHole. [0] https://easylist.to/ https://easylist.to/
kup0 7y ago
They have other blocklists. In fact, easylist isn't even enabled by default in Pi-hole. I've been running Pi-hole with its default set of blockers and it still blocks quite a bit, but there are all sorts of lists you can add on top of that.
lightswitch05 7y ago
If you are looking for more blocklists, I maintain several. I recommend my 'Ads & Tracking' list for most people. I also have an aggressive list - which I don't normally recommend. I also have a Google AMP list and a Facebook products list (not just facebook - but their other products as well). Anyways, you are welcome to check it out and give me any feedback you have: https://www.github.developerdan.com/hosts/ https://www.github.developerdan.com/hosts/

glaberficken 7y ago

Now what i really want is a universal gdpr-cookies-prompt killer. Does that exist?

jannes 7y ago
Yes! Activate the "annoyances" lists in uBlock Origin. I believe many of them are off by default. "AdGuard Annoyances" or "Fanboy's Annoyance List" and "Fanboy's Cookie List" should do the trick. However, I recommend enabling "Ignore generic cosmetic filters" in order to not load giant stylesheets into every single page.
- glaberficken 7y ago
  omg...thank you, this is like browsing a new internet =)!
- xpil 7y ago
  Ahhh, you just made my day. Thank you!
- tombrossman 7y ago
  See also https://www.i-dont-care-about-cookies.eu/ https://www.i-dont-care-about-cookies.eu/ for a larger and more specific blocklist. I found it worked better for me because the annoyances list was too broad and blocked too many legitimate page elements, such as the <div> containing the play button for NPR podcasts.

fluential 7y ago

I’ve found any vpn including WireGuard running on mobile draining battery too much. Disabling third party cookies works much better, and for mobile safari using free ka-block.

1_player 7y ago

I've had my Pi-Hole for a month now. It's great, but many blocklists are bad. People often use https://firebog.net/ https://firebog.net/ to get their blocklists, and use only those with a checkmark which are, quote, "least likely to interfere with browsing". Bollocks, I've had to disable a few of the recommended ones, and adding manual whitelisted hosts because they were blocking legitimate sites (ocsp.apple.com), blocking Windows updates, blocking Instagram altogether!

jacobush 7y ago
Hehe, Insta. I can sympathize a bit there.
lightswitch05 7y ago
I agree that blocking OCSP (Online Certificate Status Protocol) servers is a bad practice. The argument to block them is that they can be used for tracking purposes. OCSP stapling is a great way to use OCSP without the risk of tracking - but not everyone does it or supports it. Anyways, I maintain an 'Ads & Tracking' blocklist that I believe is pretty reliable and you are welcome to give it a try if you like: https://www.github.developerdan.com/hosts/ https://www.github.developerdan.com/hosts/ I've been maintaining my list publicly for over a year, and I've got to say its not always clear what deserves to be blocked, what should be blocked but can't be due to broken functionality, and what is legitimate like the OCSP servers. Everyone has their own personal level of expected privacy vs functionality. Its impossible to make everyone happy. I just wanted to say that being a maintainer of these lists isn't always easy. The obvious example you provided with (ocsp.apple.com) isn't exactly obvious because it _could_ be used for tracking, and it certainly isn't need for functional reasons (although I would argue that it is needed for security reasons). Anyways, there is a lot of gray when it comes to blocking and you can't make everyone happy.
- drukenemo 7y ago
  Sorry for my ignorance, but how could I load these into Pi-Hole?
  - 7y ago

rietta 7y ago

I have Pi Hole running on my LAN and it's amazing. Also helped me identify that my Amcrest PoE security cameras aggressively phone home, even when no cloud functionality is configured on them. All the reason to keep them on their own VLAN and off the Internet.

Mister_Snuggles 7y ago
Separate VLANs is the right answer. Phoning home is not an Amcrest-specific thing, all of my cameras (I have a handful of Amcrest and D-Link cameras, and one Reolink camera) try to do that. I've put them all in a separate VLAN which can't access anything, not even DNS. The NVR software lives on a different VLAN and is able to open connections to the cameras for recording. This setup works perfectly. Most importantly, the cameras all work fine even if they can't phone home.
- lifty 7y ago
  What access point do you use the offers VLAN functionality?
  - geggam 7y ago
    I built my own with OpenBSD to get this and other functionality Not to mention the cool toys you can setup to see what is happening https://undeadly.org/cgi?action=article;sid=20140228093820 https://undeadly.org/cgi?action=article;sid=20140228093820
  - tga 7y ago
    For an actual AP, check out the Unifi AP line. https://www.ui.com/unifi/unifi-ap https://www.ui.com/unifi/unifi-ap For a home wireless router, you can buy a supported device and install OpenWRT. https://openwrt.org/supported_devices https://openwrt.org/supported_devices
  - Mister_Snuggles 7y ago
    The access point I use is a UniFi AP-AC-Pro. You can create multiple wifi networks and map each one to a separate VLAN. I also use UniFi switches and a UniFi Security Gateway, but really any equivalent that supports VLANs will work. I believe I also accomplished the same thing with an Asus router/AP running DD-WRT, but that was a long time ago.

philliphaydon 7y ago

Donno if this is a silly question or not. But if there anywhere to buy a raspberry + pi with pi-hole pre-configured on it? I've wanted one for a while but just wanna plug it in and go to the web console, not buy it set it up install it etc.

qzx_pierri 7y ago
All you have to do is run a script from the pi-hole website to install. It’s very effortless. Like.. literally effortless. If you’re posting here, I guarantee you could do it in no time. The “hardest” part is excluding an IP for the pihole & setting your DHCP server to serve that IP w/ new leases. Good luck dude.
- philliphaydon 7y ago
  Haha ok. I Guess my Xmas present to myself this year is a raspberry pi and setting this up :) Thanks!
  - guilhermetk 7y ago
    Go for it, it's really worth the effort, even if it is a small one, with the bonus of being fun (at least for me it is). I can't imagine setting up my home network without pihole, and I'm considering setting it up at work, I manage a small network with 100 devices connected to the internet.
    - benplumley 7y ago
      Can a Pi really keep up with that size of network or would you run it on more powerful hardware/a VM?
      - theandrewbailey 7y ago
        DNS is a very light protocol. In addition, responses tend to be cached, so it's not like the Pi would be hit with a dozen queries on literally every page load for every client on the network.

Mister_Snuggles 7y ago

The one thing that's holding me back on actually using Pi-Hole is the lack of flexibility. What I'd really like to see is the ability to do various things on a per-client basis. For example, one commenter wanted a simple "reload without blocking" functionality and the response was to use a bookmarklet plus the Pi-Hole API to disable it temporarily. This works, but the problem is that it disables it temporarily for everyone and will inevitably result in "Hey, why's the ad blocker broken?" "Oh, sorry, that was me" conversations. Likewise, I'd also like to be able to configure block lists on a per-client basis. I don't want any Facebook stuff (for example) to resolve from my devices, but my girlfriend wants to use Facebook. Similarly, I may want different rules on different networks. For example, I may want to restrict what my IoT network can resolve differently than my regular user network. This is really just a generalization of doing things on a per-client basis. Currently the only solution to these types of problems is to maintain multiple Pi-Hole installations. This isn't a big deal if it's just one or two, but it doesn't scale reasonably.

mihaifm 7y ago
Pihole is just a GUI on top of dnsmasq, they're not doing anything fancy, apart maybe for the extra statistics. These are some interesting ideas for improvement, I'd also be interested in something with more flexibility, but I'm not sure if there's an alternative at the moment.
- mikepurvis 7y ago
  There are still a few possibilities for how it could work— first would be running multiple instances of dnsmasq and then putting a reverse proxy in front of them that would direct the traffic based on who's asking. Another would be switching to a purpose-built DNS resolver/cache that had this capability. Finally, you could have per-client DNS IPs, but this would require the cooperation of the DHCP server, which is less typical on a home network where that's often a closed-source router. But a "super pi-hole" following this pattern could also potentially be the DHCP server. (Yes, raspberry pi can run OpenWRT: https://openwrt.org/toh/raspberry_pi_foundation/raspberry_pi https://openwrt.org/toh/raspberry_pi_foundation/raspberry_pi)

dfischer 7y ago

What's the most secure way to setup something like this on your network?

AnIdiotOnTheNet 7y ago
The most secure server is one that is turned off, so I recommend that.

bni 7y ago

Can Pi-Hole block YouTube ads yet?

dexterdog 7y ago
Either pihole or ublock origin blocks them. That's what I use and I never see them.
- adestefan 7y ago
  I know ublock origin does because I have been using that on my systems and never see them.
n1c 7y ago
Not as far as I'm aware, no.
Flott 7y ago
It doesn't work for me at least. I still see a ton of ads on the youtube app on all of my Roku devices. I heard that it works for some people so maybe i'm hitting domains that aren't in the blocklists due to my location?
Chico75 7y ago
Not when those ads are just other youtube videos
drukenemo 7y ago
No, it blocks DNS requests and YouTube ads are served from the same DNS used by the actual YouTube video.

aurbano 7y ago

I already have uBlock Origin on Firefox, with tracking protection set to strict and I don't really remember seeing ads on desktop. I guess the main benefit of the PiHole is to have ad blocking on mobile devices, iPads... and others, do you think this is worth the effort of setting up in your experience?

pimeys 7y ago
You can see a screenshot from my VPN pihole blocking tracking requests from my android phone and make a decision do you need it or not. https://i.imgur.com/Hpcw42h.png https://i.imgur.com/Hpcw42h.png
- aurbano 7y ago
  Damn, that's amazing.. can't believe 76% of requests are unnecessary. Assuming you're running this on a RPi at home, do you have DynDNS or how are you managing the external IP?
  - bjoli 7y ago
    I have similar numbers. 90% of the blocked requests I see come from 3 apps that are particularly diligent about submitting metrics. 2 phones have outlook installed and boy does outlook hate when metrics fails! Those phones alone account for half of the DNS requests in a network with about 15 devices, despite being out of the house for 9 hours every day.
  - pimeys 7y ago
    I have this running on a Hetzner server and connecting my phone to it with Wireguard. At home I have another pihole running in my router.
- MikusR 7y ago
  Without list of sites it blocks those numbers are useless. I could setup to block only news.ycombinator.com and the result would be similar

zaro 7y ago

Openwrt has DNS ad-blocking built in which works just as well as pi-hole. It simply doesn't have the monitoring of what is being blocked but it is rarely needed anyway. https://openwrt.org/docs/guide-user/services/ad-blocking https://openwrt.org/docs/guide-user/services/ad-blocking

inyorgroove 7y ago
pfSense also has pfBlocker-ng[1] which can also be used for this purpose. [1] https://docs.netgate.com/pfsense/en/latest/packages/pfblocker.html https://docs.netgate.com/pfsense/en/latest/packages/pfblocke...
theandrewbailey 7y ago
If your router hardware is sufficient enough, OpenWRT supports QEMU, so you can run Pi-Hole in that: https://openwrt.org/docs/guide-user/virtualization/qemu_host https://openwrt.org/docs/guide-user/virtualization/qemu_host
- pimeys 7y ago
  I'm running it in an LCX container on OpenWRT. Better to have an external disk connected for the container so the logging will not burn the internal storage too fast.

apexalpha 7y ago

I'm a huge fan of this project! I have 3 set-up right now. One as container on my Nuc at home for myself, and 2 other on old Pi's (one is a 1st gen B model) for family. A simple cron job to run every 2 months keeps everything up to date. For myself I use Wireguard to only forward DNS packets to the PiHole when I'm outside the house. If you install a PiHole (and maybe Unchecky.com) your help desk calls from family will drop by 90% (personal experience).

fotcorn 7y ago

I am running Pi-Hole at home (on a Ubuntu VM, no Raspberry Pi necessary). In addition I have a Wireguard VPN server which uses the DNS server from Pi-Hole. This way a have a system-wide ad blocker for my smartphone when connected to the VPN. The latency hit from this setup is barely noticeable.

deleted 7y ago

[deleted]

yumraj 7y ago

One unadvertised advantage of pihole is monitoring and blocking sites that you don't want kids to use, such as the thousands of io-games and what not.

bloopernova 7y ago
We use it to block phone-home sites that devices like "smart" TVs use to send data back for the manufacturer to profit off.
- TheChaplain 7y ago
  There was a thread a month ago here (or on Reddit perhaps) about SmartTV's scanning/connecting to open hotspots if they can't phone home from their wlan. Someone also claimed TV's from the same manufacturer connects to eachother in a mesh to find a way to phone home but that sounds a little too spectacular...

testdelacc1 7y ago

Is this substantially better than using ublock origin? I feel like my browsing experience is pretty good right now, and I'm uncertain what the benefits to upgrading are.

bun_at_work 7y ago
It really depends on what you want/need. The Pi-hole blocks ad traffic by blocking DNS requests to known advertisement URLs. Ublock Origin works great in your browser. However, what about that app on your phone that plays an ad every time you open it? What if you use a mobile browser that doesn't have extensions (Chrome on mobile doesn't). It really comes down to where you want to block ads. Also, I don't know if Ublock Origin actually blocks the ad requests or just prevents them from loading, but if it's the latter, then you can reduce traffic with Pi-hole as well.
prab97 7y ago
You need to setup ublock origin on every browser on every device. With pihole, all your devices automatically get adblocking, even your friends coming home and connecting to your wifi get the ad blocking advantage without anything to do on their part.
jeroenhd 7y ago
No. But it works on all devices in your network (phone, computer, smart TV, WiFi connected dishwasher, etc.). I've never really understood how much tracking some apps on my phone did until I saw the graph showing lookups to Facebook's and Google's servers. In the middle of the night, a bunch of apps started trying to reach some tracking domain, something I would never have noticed if it wasn't for the graphing feature. One way I've noticed the difference with and without pihole is that most apps on my phone become ad free when I connect to my home network. On most phones ad blockers exist, but those are just another layer of software that needs to be woken when the phone wakes from deep sleep. I use pihole + uBlock in Firefox with tracking protection (on both mobile and PC) for my browsing, but Pihole saves me the effort of finding a reliable Android system ad blocker that's reasonably power efficient. I'm considering also using it on my laptop as a VM to get the same features on the go.
7y ago

deleted 7y ago

[deleted]

deleted 7y ago

[deleted]

intenseagile 7y ago

I set up a pi hole a few months ago. I'm not sure why I waited so long to do so. It's been great to be honest. Now and then someone in my family has a broken web app and I have to whitelist a few things. Confused my wife once or twice, but that's about the only downside. Now she knows to check with me if she doesn't get the expected result.

auslander 7y ago

Does Pi-Hole know when a request is third-party or first-party? IMHO only browser knows that.

cellover 7y ago

If the font is too thin for you: * F12 * Console tab * jQuery('body').css('font-weight', '500');

greenie_beans 7y ago

cool! thanks for building this, fun for a hobbyist

Jaepa 7y ago

I really wish PiHole would support DOH. Currently if you want to have secured DNS you have to set up a DOH local proxy, then connect pihole to that.

mc32 7y ago
Can’t you setup cloudflared on your pi-hole or does it have issues?
- hendersoon 7y ago
  That's what I did. Works fine. It would of course be far better if Pihole supported DNS over HTTPS natively.

Fiahil 7y ago

My pi-hole is blocking 20% of all queries. Can we say that 20% of end-users internet traffic is for tracking and advertising ?

the100rabh 7y ago
38.6% for me, guess YMMV based what you do on your devices
derrasterpunkt 7y ago
This 20% queries could be 50% (or whatever) of your traffic. It depends what is being downloaded, would the queries be successful. You could measure the website you‘re visiting with/without the pihole.

froindt 7y ago

Preface: I'm moderately technical but don't understand the specific nuances of DNS. Is there any possibility Pi-Hole and the DNS server plus hosts file could be used in an attack? Could I setup a web server with identical UI to my target site, get one of the list providers to direct chase.com to my IP, list gets propagated to all Pi-Hole devices, and start collecting credentials?

wnissen 7y ago
At the moment, if an attacker has control of your DNS, it's game over before you even start. There are some technologies that help, such as secure DNS (DNSSEC) and "certificate pinning" but they don't do everything.
- tptacek 7y ago
  In the case of DNSSEC, it doesn't do anything in this scenario, for two reasons: first, and most importantly, virtually nobody uses it (for instance, like almost every tech company as well, CHASE.COM isn't DNSSEC-signed and isn't likely to do so), and secondly because DNSSEC protects only server-to-server lookups and not client-server lookups, so if your Pi-Hole picks up a bad record somehow, DNSSEC isn't going to keep your browser from detecting that.

theomega 7y ago

Any recommendations for block lists for PI-Hole? I found the default lists not really covering enough. What lists are you using?