10 ms·

As the situation has worsened with the latest release of Safari I'm really interested to globally setup Pi-Hole on a VPS via docker and use it in combination wi

by crstin 7y ago

As the situation has worsened with the latest release of Safari I'm really interested to globally setup Pi-Hole on a VPS via docker and use it in combination with VPN (Strongswan) for all of my devices (also mobile). Has anybody had success with such a setup yet?

adestefan 7y ago
Looks like they have a document on that. https://docs.pi-hole.net/guides/vpn/overview/ https://docs.pi-hole.net/guides/vpn/overview/
onlingyding 7y ago
I haven't attempted that setup however I've got a Nginx server acting as a reverse proxy which implements DNS-over-TLS. Android 9 has support for custom private DNS servers so I just point it to my home IP and works great, no adverts when I'm out of the house.
cripblip 7y ago
It Does not have the vpn component but I have been very happy with nextdns for mobile ad blocking
feistypharit 7y ago
Check out https://nextdns.io/ https://nextdns.io/. Free now, but I do worry about their eventual monetization.
obituary_latte 7y ago
I have run pi-hole on the cheapest tier of Rackspace cloud server for 2+years now with great success. It’s wonderful. Just configure my routers dhcp to set my pi ip for dns and no ads anywhere (YouTube, streaming [except Hulu unfortunately], and general browsing). It’s especially nice now that it seems every company is offering their own streaming apps with ads. Recent example was I wanted to watch an action sports video and firetv had it with the redbull app. Ten or so minutes in and the video was interrupted with “here’s some ads” stinger and then the video immediately resumed. Kinda caught me off guard but produced an instant smile. One thing to consider though is becoming a dns resolver for any random thing on the net. What I did for this was create a bash script that adds the visiting ip to iptables whitelist. Created an impossible-to-guess php page (pi admin uses php so it’s already installed and ready to go) which takes the REMOTE_ADDR and passes it to the bash script to add to iptables. Makes it super easy to allow ip’s when isp changes address or when visiting family/friends and they want to use it.
- theshrike79 7y ago
  What's your reasoning on running it on a VPS as opposed to a raspi on your local network?
  - obituary_latte 7y ago
    Because it’s available everywhere e.g. work/family/friends etc. and I can share it with family/friends as well. It’s a lot of fun to see people’s reactions when they see what the net can be like without all of the ads.
    - shadyMrPatch 7y ago
      I run mine at home but have opened it up to be accessible remotely (just port 53 remotely) so I can use it whilst out and about.
      - move-on-by 7y ago
        Please do not open port 53. Without proper counter-measures, open resolvers contribute to DNS Amplification attacks. If you have an open resolver, I guarantee that it is being used maliciously. Please close your port 53 and use a VPN to securely access your pihole. DNS Amplification Attacks: https://www.us-cert.gov/ncas/alerts/TA13-088A https://www.us-cert.gov/ncas/alerts/TA13-088A
        shadyMrPatch 7y ago
        didn't know about that. I'll give that a read later.
        move-on-by 7y ago
        Its pretty simple: > A Domain Name Server (DNS) amplification attack is a popular form of distributed denial of service (DDoS) that relies on the use of publically accessible open DNS servers to overwhelm a victim system with DNS response traffic. DNS queries are much smaller then DNS responses. Making a huge amount of queries uses less bandwidth then uses to respond - making it a prime candidate for DDOS attacks. Look at your logs, no doubt you will see a large number of requests for various hosts. This is your system being used to attack people. Please close the port.
lifty 7y ago
I run wireguard + pi-hole (docker) on a cheap vps. It was fairly easy to setup and does a good job. Still, not an ideal setup for non-technical users.
StreamBright 7y ago
I would like to do the same. Maybe have a DNS server (pi-hole) on AWS and do a simple web ui where ui can log in and it whitelists your IP in the security group.
ignoramous 7y ago
You could instead WireGuard split tunnel dns traffic and serve it with Pi-Hole or forward it to dns.aguard.com if you do not really require analytics or use unbound with block lists to resolve names recursively.
- PureParadigm 7y ago
  Have you managed to get WireGuard to do split tunnel DNS? I've been wanting to do this, but couldn't figure out how to make it work on Android, for example.
  - ignoramous 7y ago
    Since wireguard uses allowed-ips for making routing decisions, it has been straightforward to set one up. The gist is, on the client configuration: 1. Set DNS server IP against allowed IP in the peer (which is your wireguard server) section. 2. Set DNS entry to the same IP as above for the client interface. Ref the discussion and the linked blog post (that talks abt Pi-Hole with wireguard): https://news.ycombinator.com/item?id=19544532 https://news.ycombinator.com/item?id=19544532, https://www.reddit.com/r/WireGuard/comments/bqccdz/split_tunnel_for_only_dns_possible/ https://www.reddit.com/r/WireGuard/comments/bqccdz/split_tun...
    - PureParadigm 7y ago
      Thanks for your answer. I think the sources you linked to are tunneling all of their DNS queries through Wireguard. I don't want to do this, since my work has some DNS records which only resolve internally. Basically I want to be able to give DNS names to the various hosts on my Wireguard network, while falling back to the DNS provided by the network I'm on.
      - ignoramous 7y ago
        In the config: DNS = <public-resolver>,<private-reslover> ...wouldn't work? Edit: per discussion on r/Wireguard, looks like one soln is to run dnsmasq locally on ::53 and forward public queries to the VPN/DNS provider of your choosing and resolve private queries locally. https://www.reddit.com/r/WireGuard/comments/cmhap6/use_both_wireguard_and_local_dns_servers/ https://www.reddit.com/r/WireGuard/comments/cmhap6/use_both_...

by crstin 7y ago

adestefan 7y ago

Looks like they have a document on that. https://docs.pi-hole.net/guides/vpn/overview/ https://docs.pi-hole.net/guides/vpn/overview/

onlingyding 7y ago

I haven't attempted that setup however I've got a Nginx server acting as a reverse proxy which implements DNS-over-TLS. Android 9 has support for custom private DNS servers so I just point it to my home IP and works great, no adverts when I'm out of the house.

cripblip 7y ago

It Does not have the vpn component but I have been very happy with nextdns for mobile ad blocking

feistypharit 7y ago

Check out https://nextdns.io/ https://nextdns.io/. Free now, but I do worry about their eventual monetization.

obituary_latte 7y ago

I have run pi-hole on the cheapest tier of Rackspace cloud server for 2+years now with great success. It’s wonderful. Just configure my routers dhcp to set my pi ip for dns and no ads anywhere (YouTube, streaming [except Hulu unfortunately], and general browsing). It’s especially nice now that it seems every company is offering their own streaming apps with ads. Recent example was I wanted to watch an action sports video and firetv had it with the redbull app. Ten or so minutes in and the video was interrupted with “here’s some ads” stinger and then the video immediately resumed. Kinda caught me off guard but produced an instant smile. One thing to consider though is becoming a dns resolver for any random thing on the net. What I did for this was create a bash script that adds the visiting ip to iptables whitelist. Created an impossible-to-guess php page (pi admin uses php so it’s already installed and ready to go) which takes the REMOTE_ADDR and passes it to the bash script to add to iptables. Makes it super easy to allow ip’s when isp changes address or when visiting family/friends and they want to use it.

theshrike79 7y ago
What's your reasoning on running it on a VPS as opposed to a raspi on your local network?
- obituary_latte 7y ago
  Because it’s available everywhere e.g. work/family/friends etc. and I can share it with family/friends as well. It’s a lot of fun to see people’s reactions when they see what the net can be like without all of the ads.
  - shadyMrPatch 7y ago
    I run mine at home but have opened it up to be accessible remotely (just port 53 remotely) so I can use it whilst out and about.
    - move-on-by 7y ago
      Please do not open port 53. Without proper counter-measures, open resolvers contribute to DNS Amplification attacks. If you have an open resolver, I guarantee that it is being used maliciously. Please close your port 53 and use a VPN to securely access your pihole. DNS Amplification Attacks: https://www.us-cert.gov/ncas/alerts/TA13-088A https://www.us-cert.gov/ncas/alerts/TA13-088A
      - shadyMrPatch 7y ago
        didn't know about that. I'll give that a read later.
        move-on-by 7y ago
        Its pretty simple: > A Domain Name Server (DNS) amplification attack is a popular form of distributed denial of service (DDoS) that relies on the use of publically accessible open DNS servers to overwhelm a victim system with DNS response traffic. DNS queries are much smaller then DNS responses. Making a huge amount of queries uses less bandwidth then uses to respond - making it a prime candidate for DDOS attacks. Look at your logs, no doubt you will see a large number of requests for various hosts. This is your system being used to attack people. Please close the port.

lifty 7y ago

I run wireguard + pi-hole (docker) on a cheap vps. It was fairly easy to setup and does a good job. Still, not an ideal setup for non-technical users.

StreamBright 7y ago

I would like to do the same. Maybe have a DNS server (pi-hole) on AWS and do a simple web ui where ui can log in and it whitelists your IP in the security group.

ignoramous 7y ago

You could instead WireGuard split tunnel dns traffic and serve it with Pi-Hole or forward it to dns.aguard.com if you do not really require analytics or use unbound with block lists to resolve names recursively.

PureParadigm 7y ago
Have you managed to get WireGuard to do split tunnel DNS? I've been wanting to do this, but couldn't figure out how to make it work on Android, for example.
- ignoramous 7y ago
  Since wireguard uses allowed-ips for making routing decisions, it has been straightforward to set one up. The gist is, on the client configuration: 1. Set DNS server IP against allowed IP in the peer (which is your wireguard server) section. 2. Set DNS entry to the same IP as above for the client interface. Ref the discussion and the linked blog post (that talks abt Pi-Hole with wireguard): https://news.ycombinator.com/item?id=19544532 https://news.ycombinator.com/item?id=19544532, https://www.reddit.com/r/WireGuard/comments/bqccdz/split_tunnel_for_only_dns_possible/ https://www.reddit.com/r/WireGuard/comments/bqccdz/split_tun...
  - PureParadigm 7y ago
    Thanks for your answer. I think the sources you linked to are tunneling all of their DNS queries through Wireguard. I don't want to do this, since my work has some DNS records which only resolve internally. Basically I want to be able to give DNS names to the various hosts on my Wireguard network, while falling back to the DNS provided by the network I'm on.
    - ignoramous 7y ago
      In the config: DNS = <public-resolver>,<private-reslover> ...wouldn't work? Edit: per discussion on r/Wireguard, looks like one soln is to run dnsmasq locally on ::53 and forward public queries to the VPN/DNS provider of your choosing and resolve private queries locally. https://www.reddit.com/r/WireGuard/comments/cmhap6/use_both_wireguard_and_local_dns_servers/ https://www.reddit.com/r/WireGuard/comments/cmhap6/use_both_...