6 ms·

The one thing that's holding me back on actually using Pi-Hole is the lack of flexibility. What I'd really like to see is the ability to do various things on a

The one thing that's holding me back on actually using Pi-Hole is the lack of flexibility. What I'd really like to see is the ability to do various things on a per-client basis. For example, one commenter wanted a simple "reload without blocking" functionality and the response was to use a bookmarklet plus the Pi-Hole API to disable it temporarily. This works, but the problem is that it disables it temporarily for everyone and will inevitably result in "Hey, why's the ad blocker broken?" "Oh, sorry, that was me" conversations. Likewise, I'd also like to be able to configure block lists on a per-client basis. I don't want any Facebook stuff (for example) to resolve from my devices, but my girlfriend wants to use Facebook. Similarly, I may want different rules on different networks. For example, I may want to restrict what my IoT network can resolve differently than my regular user network. This is really just a generalization of doing things on a per-client basis. Currently the only solution to these types of problems is to maintain multiple Pi-Hole installations. This isn't a big deal if it's just one or two, but it doesn't scale reasonably.

mihaifm 7y ago
Pihole is just a GUI on top of dnsmasq, they're not doing anything fancy, apart maybe for the extra statistics. These are some interesting ideas for improvement, I'd also be interested in something with more flexibility, but I'm not sure if there's an alternative at the moment.
- mikepurvis 7y ago
  There are still a few possibilities for how it could work— first would be running multiple instances of dnsmasq and then putting a reverse proxy in front of them that would direct the traffic based on who's asking. Another would be switching to a purpose-built DNS resolver/cache that had this capability. Finally, you could have per-client DNS IPs, but this would require the cooperation of the DHCP server, which is less typical on a home network where that's often a closed-source router. But a "super pi-hole" following this pattern could also potentially be the DHCP server. (Yes, raspberry pi can run OpenWRT: https://openwrt.org/toh/raspberry_pi_foundation/raspberry_pi https://openwrt.org/toh/raspberry_pi_foundation/raspberry_pi)
  - Mister_Snuggles 7y ago
    > Another would be switching to a purpose-built DNS resolver/cache that had this capability. Pi-Hole has already gone down this road with their FTLDNS package[0], so it's really a question of where they want the project to go. [0] https://pi-hole.net/2018/02/22/coming-soon-ftldns-pi-holes-own-dns-dhcp-server/ https://pi-hole.net/2018/02/22/coming-soon-ftldns-pi-holes-o...
    - promofaux 7y ago
      And of course, now we have more control over/hooks into the resolver, we can look at things like per-client configs: https://github.com/pi-hole/pi-hole/pull/2935 https://github.com/pi-hole/pi-hole/pull/2935
  - edoceo 7y ago
    Dnsmasq can be the DHCP too. I basically run a "pi-hole" like thing on a Soekris - handles four subnets and routes and other neat network magic. It serves dead pages for CSS, JS and IMG
- EricE 7y ago
  The pf-blockerNG package on pfSense would be the next level up. Not as pretty as pinhole, but far more capable if you are willing to stick with it. And you don't have to use pfSense as your firewall/gateway if you don't want to - pfSense will work just find with only one interface as an application appliance purely for running pf-blockerNG to use as your internal DNS server.
croo 7y ago
Heh, I'm considering it for the exact same reason you said. I want to control the whole home network with it and avoid per-client customizations. I want the exact same filter on the whole network, and I don't want it to be easily circumvented. I want to set up once and forget it and it should filter everything, automagically, every device, every browser, from the whole home network, forever. If I want to REALLY check something out I will use my mobile's internet.
- andrei_says_ 7y ago
  I have it, and it does exactly this. A tiny box taped to the leg of the table supporting the router. Haven’t seen ads in a year and am at this point forgetting what people are so upset about ;) Need to disable it when testing some google analytics settings or working on Pardot forms.
milofeynman 7y ago
Spin up a different pi-hole vm per user
- NegativeLatency 7y ago
  How would you handle routing those packets to the correct vm based on the user?
  - AnIdiotOnTheNet 7y ago
    DHCP reservations with a different gateway option.
  - promofaux 7y ago
    Keep an eye on this PR for future functionality... https://github.com/pi-hole/pi-hole/pull/2935 https://github.com/pi-hole/pi-hole/pull/2935
Sendotsh 7y ago
I have 2 Pi-Holes running. One is the “family” one and our modem/router uses it as primary DNS so basically everything on our network goes through it. This protects the family and any visitors in the wifi. The other is for me, and my personal devices have been manually set to use it as their DNS. It filters a lot more aggressively as I am more willing to put up with broken stuff for more privacy (eg completely blocking all FB domains, lots of Google stuff, etc). It also means I can suspend mine for a bit if I need to and not have the kids bombarded with ads.
- shifto 7y ago
  I have almost the same setup but I forward my requests from mine to the family one. If I disable mine I still go through the generic one which is supplied through DHCP.
- universenz 7y ago
  This is the perfect solution in my opinion. I never considered using more than one!
  - count 7y ago
    Easy to do running it containers too!
Hippocrates 7y ago
One solution is to set up two separate wireless networks with separate VLANs where one uses the pihole for DNS and the other does not. Clients can temporarily switch to the ads network at will. It might not be possible unless you have a decently high-end router. I know DD-WRT or Ubiquiti Unifi gear can do this.
- vvanders 7y ago
  Yup, we do this. Works like a charm and makes it easy to configure from any client by just connecting to a new wireless network. You don't need the VLAN, you can just put the two different wifi networks on different subnets or DNS config depending on your router and you're good to go. (I do put IoT stuff on a guest VLAN though which can only see the gateway and nothing local in the network).
- bjoli 7y ago
  I did this not more than 2 months ago. Only time I connect to my other network is when I want to access my odroid xu4 on which I accidentally blocked the wrong subnet in iptables.
Moru 7y ago
I had similar thoughts about it but I got fed up a couple of years ago and just installed it. If something doesn't work I will think about if I can live without it. Most of the time I can, and if not I just whitelist the domain. If you want to temporarily disable it for your computer, maybe switch DNS temporarily? Might even be some plugin for that in the browser?
douglasfshearer 7y ago
I use two Max OS "Locations" (Apple Menu -> Location), one which uses the router default DNS (which is a Pi-Hole at home), and another which is set to use the Cloudflare DNS servers. This allows me to to switch location, and instantly reload a page without the Pi-Hole interfering. Of course this only works on my Mac.
- jannes 7y ago
  Did you ever have issues with local DNS caching after switching location? Did you ever have to run the following command to reset Apple's local DNS after switching? sudo dscacheutil -flushcache sudo killall -HUP mDNSResponder As far as I know, Pi-Hole sets a relatively short TTL on its responses, but I think should still cause a non-zero delay when you disable it, shouldn't it?
vuln 7y ago
I have been testing nextdns[0]. Works great on per device granularity... [0]nextdns.io
heavyset_go 7y ago
You can spin up multiple PiHole containers.
somehnguy 7y ago
This is what holds me back from using it too. I would love network wide ad blocking but I hate breaking things for no reason. Sometimes certain websites just refuse to work properly with ublock, mainly comment sections and things like that. With a browser extension I can just click and disable for that site temporarily and be happy. With a Pi-hole it seems like way more of a task if something does not work. And no, I'm not going to spin up and maintain multiple pi-hole instances on my home network. That crosses into the 'madness' territory, I have enough stuff to maintain as it is.
dastx 7y ago
I think AdGuard's AdGuard Home, Pi-Hole competitor, does this. I've been following it for a while but haven't had the chance to replace my Pi-Hole installation yet.
- hendersoon 7y ago
  I played around with it. I really like the integrated DNS over HTTPS, but the reporting doesn't quite match up. I didn't bother switching but it would be a perfectly usable option.
  - lucasverra 7y ago
    im using the free nextdns.io [1] service on ios. It does work well ! On desktop, Ublock origin all the way. [1]https://news.ycombinator.com/item?id=20012687 https://news.ycombinator.com/item?id=20012687
promofaux 7y ago
Hi there, one of the Pi-hole Devs here. This is something we are very much looking into. Take a look at this PR[1] for more details! No ETAs as yet, of course, but it's something that has been asked about time and time again, and we think we may just have solved it... [1] https://github.com/pi-hole/pi-hole/pull/2935 https://github.com/pi-hole/pi-hole/pull/2935
- Mister_Snuggles 7y ago
  That's awesome! I'm excited to see what comes of this! I took a look at the changes and the amount of work here is impressive. I'm going to guess that there are also major UI changes that will need to come along to make this feature usable. Maybe the release that incorporates everything could be Pi-Hole 5.0?
deleted 7y ago
[deleted]

mihaifm 7y ago

Pihole is just a GUI on top of dnsmasq, they're not doing anything fancy, apart maybe for the extra statistics. These are some interesting ideas for improvement, I'd also be interested in something with more flexibility, but I'm not sure if there's an alternative at the moment.

mikepurvis 7y ago
There are still a few possibilities for how it could work— first would be running multiple instances of dnsmasq and then putting a reverse proxy in front of them that would direct the traffic based on who's asking. Another would be switching to a purpose-built DNS resolver/cache that had this capability. Finally, you could have per-client DNS IPs, but this would require the cooperation of the DHCP server, which is less typical on a home network where that's often a closed-source router. But a "super pi-hole" following this pattern could also potentially be the DHCP server. (Yes, raspberry pi can run OpenWRT: https://openwrt.org/toh/raspberry_pi_foundation/raspberry_pi https://openwrt.org/toh/raspberry_pi_foundation/raspberry_pi)
- Mister_Snuggles 7y ago
  > Another would be switching to a purpose-built DNS resolver/cache that had this capability. Pi-Hole has already gone down this road with their FTLDNS package[0], so it's really a question of where they want the project to go. [0] https://pi-hole.net/2018/02/22/coming-soon-ftldns-pi-holes-own-dns-dhcp-server/ https://pi-hole.net/2018/02/22/coming-soon-ftldns-pi-holes-o...
  - promofaux 7y ago
    And of course, now we have more control over/hooks into the resolver, we can look at things like per-client configs: https://github.com/pi-hole/pi-hole/pull/2935 https://github.com/pi-hole/pi-hole/pull/2935
- edoceo 7y ago
  Dnsmasq can be the DHCP too. I basically run a "pi-hole" like thing on a Soekris - handles four subnets and routes and other neat network magic. It serves dead pages for CSS, JS and IMG
EricE 7y ago
The pf-blockerNG package on pfSense would be the next level up. Not as pretty as pinhole, but far more capable if you are willing to stick with it. And you don't have to use pfSense as your firewall/gateway if you don't want to - pfSense will work just find with only one interface as an application appliance purely for running pf-blockerNG to use as your internal DNS server.

croo 7y ago

Heh, I'm considering it for the exact same reason you said. I want to control the whole home network with it and avoid per-client customizations. I want the exact same filter on the whole network, and I don't want it to be easily circumvented. I want to set up once and forget it and it should filter everything, automagically, every device, every browser, from the whole home network, forever. If I want to REALLY check something out I will use my mobile's internet.

andrei_says_ 7y ago
I have it, and it does exactly this. A tiny box taped to the leg of the table supporting the router. Haven’t seen ads in a year and am at this point forgetting what people are so upset about ;) Need to disable it when testing some google analytics settings or working on Pardot forms.

milofeynman 7y ago

Spin up a different pi-hole vm per user

NegativeLatency 7y ago
How would you handle routing those packets to the correct vm based on the user?
- AnIdiotOnTheNet 7y ago
  DHCP reservations with a different gateway option.
- promofaux 7y ago
  Keep an eye on this PR for future functionality... https://github.com/pi-hole/pi-hole/pull/2935 https://github.com/pi-hole/pi-hole/pull/2935

Sendotsh 7y ago

I have 2 Pi-Holes running. One is the “family” one and our modem/router uses it as primary DNS so basically everything on our network goes through it. This protects the family and any visitors in the wifi. The other is for me, and my personal devices have been manually set to use it as their DNS. It filters a lot more aggressively as I am more willing to put up with broken stuff for more privacy (eg completely blocking all FB domains, lots of Google stuff, etc). It also means I can suspend mine for a bit if I need to and not have the kids bombarded with ads.

shifto 7y ago
I have almost the same setup but I forward my requests from mine to the family one. If I disable mine I still go through the generic one which is supplied through DHCP.
universenz 7y ago
This is the perfect solution in my opinion. I never considered using more than one!
- count 7y ago
  Easy to do running it containers too!

Hippocrates 7y ago

One solution is to set up two separate wireless networks with separate VLANs where one uses the pihole for DNS and the other does not. Clients can temporarily switch to the ads network at will. It might not be possible unless you have a decently high-end router. I know DD-WRT or Ubiquiti Unifi gear can do this.

vvanders 7y ago
Yup, we do this. Works like a charm and makes it easy to configure from any client by just connecting to a new wireless network. You don't need the VLAN, you can just put the two different wifi networks on different subnets or DNS config depending on your router and you're good to go. (I do put IoT stuff on a guest VLAN though which can only see the gateway and nothing local in the network).
bjoli 7y ago
I did this not more than 2 months ago. Only time I connect to my other network is when I want to access my odroid xu4 on which I accidentally blocked the wrong subnet in iptables.

Moru 7y ago

I had similar thoughts about it but I got fed up a couple of years ago and just installed it. If something doesn't work I will think about if I can live without it. Most of the time I can, and if not I just whitelist the domain. If you want to temporarily disable it for your computer, maybe switch DNS temporarily? Might even be some plugin for that in the browser?

douglasfshearer 7y ago

I use two Max OS "Locations" (Apple Menu -> Location), one which uses the router default DNS (which is a Pi-Hole at home), and another which is set to use the Cloudflare DNS servers. This allows me to to switch location, and instantly reload a page without the Pi-Hole interfering. Of course this only works on my Mac.

jannes 7y ago
Did you ever have issues with local DNS caching after switching location? Did you ever have to run the following command to reset Apple's local DNS after switching? sudo dscacheutil -flushcache sudo killall -HUP mDNSResponder As far as I know, Pi-Hole sets a relatively short TTL on its responses, but I think should still cause a non-zero delay when you disable it, shouldn't it?

vuln 7y ago

I have been testing nextdns[0]. Works great on per device granularity... [0]nextdns.io

heavyset_go 7y ago

You can spin up multiple PiHole containers.

somehnguy 7y ago

This is what holds me back from using it too. I would love network wide ad blocking but I hate breaking things for no reason. Sometimes certain websites just refuse to work properly with ublock, mainly comment sections and things like that. With a browser extension I can just click and disable for that site temporarily and be happy. With a Pi-hole it seems like way more of a task if something does not work. And no, I'm not going to spin up and maintain multiple pi-hole instances on my home network. That crosses into the 'madness' territory, I have enough stuff to maintain as it is.

dastx 7y ago

I think AdGuard's AdGuard Home, Pi-Hole competitor, does this. I've been following it for a while but haven't had the chance to replace my Pi-Hole installation yet.

hendersoon 7y ago
I played around with it. I really like the integrated DNS over HTTPS, but the reporting doesn't quite match up. I didn't bother switching but it would be a perfectly usable option.
- lucasverra 7y ago
  im using the free nextdns.io [1] service on ios. It does work well ! On desktop, Ublock origin all the way. [1]https://news.ycombinator.com/item?id=20012687 https://news.ycombinator.com/item?id=20012687

promofaux 7y ago

Hi there, one of the Pi-hole Devs here. This is something we are very much looking into. Take a look at this PR[1] for more details! No ETAs as yet, of course, but it's something that has been asked about time and time again, and we think we may just have solved it... [1] https://github.com/pi-hole/pi-hole/pull/2935 https://github.com/pi-hole/pi-hole/pull/2935

Mister_Snuggles 7y ago
That's awesome! I'm excited to see what comes of this! I took a look at the changes and the amount of work here is impressive. I'm going to guess that there are also major UI changes that will need to come along to make this feature usable. Maybe the release that incorporates everything could be Pi-Hole 5.0?

deleted 7y ago

[deleted]