5 ms·

I have run pi-hole on the cheapest tier of Rackspace cloud server for 2+years now with great success. It’s wonderful. Just configure my routers dhcp to set my p

I have run pi-hole on the cheapest tier of Rackspace cloud server for 2+years now with great success. It’s wonderful. Just configure my routers dhcp to set my pi ip for dns and no ads anywhere (YouTube, streaming [except Hulu unfortunately], and general browsing). It’s especially nice now that it seems every company is offering their own streaming apps with ads. Recent example was I wanted to watch an action sports video and firetv had it with the redbull app. Ten or so minutes in and the video was interrupted with “here’s some ads” stinger and then the video immediately resumed. Kinda caught me off guard but produced an instant smile. One thing to consider though is becoming a dns resolver for any random thing on the net. What I did for this was create a bash script that adds the visiting ip to iptables whitelist. Created an impossible-to-guess php page (pi admin uses php so it’s already installed and ready to go) which takes the REMOTE_ADDR and passes it to the bash script to add to iptables. Makes it super easy to allow ip’s when isp changes address or when visiting family/friends and they want to use it.

theshrike79 7y ago
What's your reasoning on running it on a VPS as opposed to a raspi on your local network?
- obituary_latte 7y ago
  Because it’s available everywhere e.g. work/family/friends etc. and I can share it with family/friends as well. It’s a lot of fun to see people’s reactions when they see what the net can be like without all of the ads.
  - shadyMrPatch 7y ago
    I run mine at home but have opened it up to be accessible remotely (just port 53 remotely) so I can use it whilst out and about.
    - move-on-by 7y ago
      Please do not open port 53. Without proper counter-measures, open resolvers contribute to DNS Amplification attacks. If you have an open resolver, I guarantee that it is being used maliciously. Please close your port 53 and use a VPN to securely access your pihole. DNS Amplification Attacks: https://www.us-cert.gov/ncas/alerts/TA13-088A https://www.us-cert.gov/ncas/alerts/TA13-088A
      - shadyMrPatch 7y ago
        didn't know about that. I'll give that a read later.
        move-on-by 7y ago
        Its pretty simple: > A Domain Name Server (DNS) amplification attack is a popular form of distributed denial of service (DDoS) that relies on the use of publically accessible open DNS servers to overwhelm a victim system with DNS response traffic. DNS queries are much smaller then DNS responses. Making a huge amount of queries uses less bandwidth then uses to respond - making it a prime candidate for DDOS attacks. Look at your logs, no doubt you will see a large number of requests for various hosts. This is your system being used to attack people. Please close the port.
rsync 7y ago
"One thing to consider though is becoming a dns resolver for any random thing on the net. What I did for this was create a bash script that adds the visiting ip to iptables whitelist. Created an impossible-to-guess php page (pi admin uses php so it’s already installed and ready to go) which takes the REMOTE_ADDR and passes it to the bash script to add to iptables." I hesitate to mention this, as it causes heads to explode, but the problem you're describing is nicely solved with port-knocking. Might be easier than setting up the php page, etc. ...
- pdimitar 7y ago
  Pardon my ignorance: can you recommend a good learning material on port knocking?
  - obituary_latte 7y ago
    Here’s an example: https://www.inmotionhosting.com/support/website/ssh/how-to-use-port-knocking https://www.inmotionhosting.com/support/website/ssh/how-to-u... But just search googs for “port knocking” and you’ll find a ton of info.
- obituary_latte 7y ago
  How would that work? How could I set up, for instance, my iPhone to port knock to allow port 53 access to the server from an unknown remote ip? Edit: found this guide https://www.inmotionhosting.com/support/website/ssh/how-to-use-port-knocking https://www.inmotionhosting.com/support/website/ssh/how-to-u... Looks like I could just create some bookmarks for the ports and open them sequentially. I think overall this is a much better solution than messing with php/bash - good idea and thanks!

theshrike79 7y ago

What's your reasoning on running it on a VPS as opposed to a raspi on your local network?

obituary_latte 7y ago
Because it’s available everywhere e.g. work/family/friends etc. and I can share it with family/friends as well. It’s a lot of fun to see people’s reactions when they see what the net can be like without all of the ads.
- shadyMrPatch 7y ago
  I run mine at home but have opened it up to be accessible remotely (just port 53 remotely) so I can use it whilst out and about.
  - move-on-by 7y ago
    Please do not open port 53. Without proper counter-measures, open resolvers contribute to DNS Amplification attacks. If you have an open resolver, I guarantee that it is being used maliciously. Please close your port 53 and use a VPN to securely access your pihole. DNS Amplification Attacks: https://www.us-cert.gov/ncas/alerts/TA13-088A https://www.us-cert.gov/ncas/alerts/TA13-088A
    - shadyMrPatch 7y ago
      didn't know about that. I'll give that a read later.
      - move-on-by 7y ago
        Its pretty simple: > A Domain Name Server (DNS) amplification attack is a popular form of distributed denial of service (DDoS) that relies on the use of publically accessible open DNS servers to overwhelm a victim system with DNS response traffic. DNS queries are much smaller then DNS responses. Making a huge amount of queries uses less bandwidth then uses to respond - making it a prime candidate for DDOS attacks. Look at your logs, no doubt you will see a large number of requests for various hosts. This is your system being used to attack people. Please close the port.

rsync 7y ago

"One thing to consider though is becoming a dns resolver for any random thing on the net. What I did for this was create a bash script that adds the visiting ip to iptables whitelist. Created an impossible-to-guess php page (pi admin uses php so it’s already installed and ready to go) which takes the REMOTE_ADDR and passes it to the bash script to add to iptables." I hesitate to mention this, as it causes heads to explode, but the problem you're describing is nicely solved with port-knocking. Might be easier than setting up the php page, etc. ...

pdimitar 7y ago
Pardon my ignorance: can you recommend a good learning material on port knocking?
- obituary_latte 7y ago
  Here’s an example: https://www.inmotionhosting.com/support/website/ssh/how-to-use-port-knocking https://www.inmotionhosting.com/support/website/ssh/how-to-u... But just search googs for “port knocking” and you’ll find a ton of info.
obituary_latte 7y ago
How would that work? How could I set up, for instance, my iPhone to port knock to allow port 53 access to the server from an unknown remote ip? Edit: found this guide https://www.inmotionhosting.com/support/website/ssh/how-to-use-port-knocking https://www.inmotionhosting.com/support/website/ssh/how-to-u... Looks like I could just create some bookmarks for the ports and open them sequentially. I think overall this is a much better solution than messing with php/bash - good idea and thanks!