14 ms·

Ad blocking with Raspberry Pi and Pi-hole

241 points by christian_fei 6y ago

ananonymoususer 6y ago
Pi-Hole is a great project, and it's not limited to running on a Raspberry Pi either. I've got it running as a (x86-64 Ubuntu) VM in the same hypervisor that hosts my firewall. It's lightweight, super responsive, and provides great statistics on what it is doing.
lordnacho 6y ago
I'm looking for a way to combine the adblocking with a VPN switcher that takes eg NordVPN and routes all my home traffic through a variety of tunnels (they provide a load of openVPN files). Is there a ready-made way to do this? The idea is for anyone in the house to be protected by both the adblock and the VPN.
- aesh2Xa1 6y ago
  I'm not aware of an "out of the box" solution, but maybe paying for NordVPN or similar will do this for you. VPNs typically tunnel your packets thru an encrypted connection to a gateway somewhere else on the internet. Ad blockers point your DNS to a resolver that blacklists ad domains. You can use a VPN and still set your DNS to whatever you'd like. What works best for you will depend on your threat model (or just privacy concern, as that other term sounds loaded).
- parshimers 6y ago
  pfsense can do this pretty easily, i wouldn't call it out of the box though. the adblocking can be done via pfblocker-ng, and it has an openvpn client of course.
greencar 6y ago
> Use it for ad-blocking in your home network and to finally browse the web, watch videos etc. without annoying ads. It doesn't really do this as well as a browser adblocker, YouTube ads for example can't effectively be blocked with pihole
- alfalfasprout 6y ago
  Actually, it most cases I find it significantly beats what a normal in-browser adblocker will do. More importantly, it does this for my phone, etc. But yes self-hosted ads, etc. won't be blocked. For that, there are other solutions. Personally, I use both.
- schwartzworld 6y ago
  it's not really fair to compare it to an in-browser adblocker that way, especially since using them isn't mutually exclusive. PiHole blocks ads whether you are in a browser or not, an instant benefit for everybody on your WiFi network.
  - 416chad 6y ago
    Exactly this. Ads in places like news apps disappear, a big plus for pihole.
  - BLKNSLVR 6y ago
    In fact, one of the best things about Pi-hole network wide blocking is the removal of those 5 to 10 second otherwise unskippable ads in apps.
  - Firehawke 6y ago
    Absolutely. Defense in depth; Pi-hole will cover devices that you can't install an ad-blocker on while the ad-blocker will cover some edge cases where Pi-hole can't do it. It should never be considered an "or" situation; you want "both" as much as possible.
- christian_fei 6y ago
  there seems to be a solution: https://github.com/kboghdady/youTube_ads_4_pi-hole https://github.com/kboghdady/youTube_ads_4_pi-hole
- x3blah 6y ago
  Watching videos with Javascript turned off, there are no ads. Google tries to force users to turn on JavaScript by needlessly making the YouTube website "require" JS to be turned on to play videos. However it is easy to play the videos without using JavaScript using just basic HTML. Example https://news.ycombinator.com/item?id=23076239 https://news.ycombinator.com/item?id=23076239
Havoc 6y ago
There are dockerised versions as well if you happen to have a docker stack somewhere in your home
- christian_fei 6y ago
  i like the pi-hole installer a lot, since it's a damn one-liner. i was amazed by its simplicity
  - Havoc 6y ago
    Yeah definitely easier to deploy on a raspberry than docker but means an extra device
    - christian_fei 6y ago
      True
brenden2 6y ago
I use pi-hole, and it's great, but for browsers you still need something like uBlock Origin installed to properly block ads. The thing I like about pi-hole is it also blocks a long list of trackers that are bundled by various mobile SDKs. There's no way to block those with iOS or Android, except at the network level.
- daveslash 6y ago
  I've been using Pi-Hole for quite a while now too. I also have several in-browser ad blockers. In browser, I'm running Ghostery, uBlock Origin, and Privacy Badger, DuckDuck Go's privacy essentials, and whatever Firefox's does when you turn on all of the privacy respecting stuff. Honestly, I don't really know what does what any more. I recently turned off pi-hole and started to browse the web using Internet Explorer, just to see. Holy Cow... I'd forgotten what the incredible-edible internet was really like.
  - mulmen 6y ago
    This is great and I'm glad it is working for you. I think you are about 6 months ahead of me as I now have two Firefox privacy addons and I'm shopping for hardware to build a firewall box. As I read your comment all I could visualize was an IE6 browser with 8 toolbars. The network stack of the future.
bberrry 6y ago
I wish it were more effective in removing Youtube ads on my kids' iPads, but I understand it's a tall order. At least it gets rid of ads in most other apps.
- netsharc 6y ago
  If you had said Android I would've suggested NewPipe: https://newpipe.schabi.org/ https://newpipe.schabi.org/
- christian_fei 6y ago
  could be the right fit: https://github.com/kboghdady/youTube_ads_4_pi-hole https://github.com/kboghdady/youTube_ads_4_pi-hole
  - bberrry 6y ago
    Thank you! I'll give it a try
    - christian_fei 6y ago
      cheers, gotta try it too
- BuckRogers 6y ago
  Try Microsoft Edge. Its built in ad blocker works for me with Youtube on my iPhone. I block ads at the application layer, DNS based ad blocking doesn’t really do it anymore and can create another troubleshooting surface to consider when it breaks something.
  - frank2 6y ago
    In response to your comment, I tested Microsoft Edge on my iPad and can confirm that yes, indeed, it does block the ads on youtube.com -- mostly: out of about 7 videos, an ad was shown to me at the start of one of them, but that is much better than mobile Safari, on which and ad is shown to me at the start of every video I start. Thanks for the tip.
strenholme 6y ago
I actually have been doing some work with MaraDNS to have the ability to have a pi-hole sized blacklist. The main source of pi-hole’s blacklist is this Git repo: https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts That is about 60,000 hosts, so I added MaraDNS support to have up to 500,000 blacklisted names. Since it’s a speed-optimized (not size-optimized) cache, each element takes about a kilobyte of memory, so a blacklist this size takes about 60 megabytes of memory for MaraDNS to store (on a modern Core i7 7600U processor, it only takes about two seconds to load all 60,000 elements in to memory), but it’s very rapid to use. The script to take that blacklist and convert it in to a MaraDNS compatible format is here: https://github.com/samboy/MaraDNS/blob/master/deadwood-github/tools/make.blacklist.sh https://github.com/samboy/MaraDNS/blob/master/deadwood-githu... There are ways to make the memory footprint of the blacklist smaller, but this was a quick and simple way to implement a medium sized blacklist. Finding ways to have, say, 10 million blacklist elements with a small memory footprint is left as an exercise for the reader. My current project is to make a proper Docker container for MaraDNS.
- CoolGuySteve 6y ago
  What is the optimization gained by having 1KB cache slots when the cacheline size on Intel and ARM is typically 64 bytes?
  - strenholme 6y ago
    Each cache entry needs a hash bucket so we can look up the entry in O(1), and we need more hash buckets than entries to minimize cache look up time. The hash bucket needs a copy of the element for each hit (to verify we hit the correct hash bucket), and a possible link to the next hash bucket, just in case we got a hash collision (we still need to store that link in memory as a null pointer regardless). [1] The strings are special structures which allow binary data to be stored in them and to protect against buffer overflow protection, so they take up more room than a normal string. Since the cache is a dynamic LRU cache (blacklist entries are not in the circular LRU, of course, but the cache was designed that way) for temporarily storing correct DNS answers (with overhead because, yes, each entry has among other things a 64-bit expire timestamp), each entry is created or removed with multiple malloc() and free() calls, so there’s some page size overhead there. Like I said, there are ways to make a blacklist have a smaller memory footprint, by using a special data structure which trades speed for size, [2] but for a two-day coding project, it made more sense to just add them to the speed optimized LRU cache the code is built around. [1] As an aside, the hash compression algorithm came out before SIP Hash, but, like SIP Hash, has protection against an attacker finding hash bucket collisions. If I were to write the code today, I would use SIP Hash. [2] Here is how I would do it: I would have two blocks of data. One block is an array of offsets (pointers, but not C memory pointers) to data in the second block, and the second block is a bunch of NULL-terminated strings compactly stored. The array of offsets is a sorted list, where the sort key is the string each element points to. I would then do a binary search every time I wanted to see if an element is blacklisted. Memory overhead is, for 10 million entries with an average length of 15 bytes per string (including the NULL) 30 million bytes for the offsets and 150 million bytes for the strings, so we could store 10 million entries in under 200 megs. Speed is O(log2(N)) instead of O(1) but we save a lot of memory. We would need more memory to sort that list, but we could store this block as a binary file which is made on a host with a lot of memory, but read on our Raspberry Pi or old Netbook. Again, doing this is left as an exercise for the reader, and I’m sure there’s a lot of public domain or otherwise open licensed libraries which have already solved this problem. If I were to go down that path; I would probably use sqlite, but am a bit reluctant to add sqlite to a tiny program which can compile to be under 70k in size.
dastx 6y ago
Another alternative is AdGuard Home. They've come a long way since they announced it. I switched to AdGuard Home some 6 months ago and it has been great.
- ObsoleteNerd 6y ago
  I switched a section of my network over to it a few weeks ago, and I've been having constant random internet issues since, and when I swap back to the Pi-Hole the problems go away. Is there some trickery to getting AdGuard to run stable? I have it running as an Add-On to Home Assitant, so I'm not sure if that's causing the issues, but I get lots of failed DNS queries, slowdowns, etc when going through AdGuard.
  - dastx 6y ago
    Not that I know of. I'm running on a pi3b and never had issues. I suggest raising a GitHub issue, they're usually pretty quick to respond and quick to fix bugs.
doctoboggan 6y ago
Does anyone have any good suggestions for blacklists? I've only been using the default and am wondering if I should add some more items to the list.
- christian_fei 6y ago
  some blacklists i found: - https://discourse.pi-hole.net/t/update-the-best-blocking-lists-for-the-pi-hole-alternative-dns-servers-2019/13620 https://discourse.pi-hole.net/t/update-the-best-blocking-lis... - https://github.com/chadmayfield/my-pihole-blocklists https://github.com/chadmayfield/my-pihole-blocklists
- zf00002 6y ago
  This is the only one I use: https://www.reddit.com/r/oisd_blocklist/comments/dwxgld/dbloisdnl_internets_1_domain_blocklist/ https://www.reddit.com/r/oisd_blocklist/comments/dwxgld/dblo...
jedberg 6y ago
Is anyone successfully using PiHole with non-technical users? My main concern with putting PiHole on my home network is that for example my mother in law might not understand that she can't get to some web page because it's being ad-blocked, nor would she be able to go to the web admin page and temporarily unblock it. Even as a technical person sometimes it takes a while to figure out that a page isn't working because of adblock or pi-hole. How do people deal with this?
- ObsoleteNerd 6y ago
  I've set it up for most of my close family and friends, added a physical button to the top of the Raspberry Pi case that disables it for x minutes (x changes depending who they are and their needs), so if they're having issues they go press the button to access the problematic website. I keep reading about people having to disable the Pi-Hole so much that it becomes annoying, or constantly butting heads with websites that don't work with Pi-Holes, but I can honestly say that I, and the people I've set them up for, BARELY EVER need to use the Disable button. Not for online banking, not for online shopping, not for any regular content consumed. I can't personally think of the last time I needed to disable the Pi-Hole for anything at all. It just sits there blocking ads invisibly, plugged into the back of my modem/router, and is one of my absolute favourite parts of my tech stack. What websites are people visiting that the Pi-Hole doesn't work with? I'm genuinely curious, because I've been running mine for a couple years now and can't think of anything off the top of my head, and no one in my family group have ever complained about it, with most telling me it's been flawless and they barely every touch the button.
  - rablackburn 6y ago
    I like that physical button solution. Do you have a github repo or blog post documenting how you did it anywhere?
    - ObsoleteNerd 6y ago
      I haven't posted anything, but it's pretty simple really. Follow any of the guides to make a physical button run a Python/BASH script[0] and then I wrote a small script that just CURLs the URL to disable the Pi-Hole for a few minutes (eg: curl --silent http://192.168.2.2/admin/api.php?disable=600&auth=PASSWORD http://192.168.2.2/admin/api.php?disable=600&auth=PASSWORD ). I've been meaning to make a blog post about it but haven't got around to it yet. I'll try write something up later today/tonight. [0] https://raspberrypihq.com/use-a-push-button-with-raspberry-pi-gpio/ https://raspberrypihq.com/use-a-push-button-with-raspberry-p... Edit: I found this which is a much bigger/fancier version of what I did, but has the associated code you can pull out for a simple button: https://github.com/nickearl/piHoleButtons https://github.com/nickearl/piHoleButtons
Sohcahtoa82 6y ago
For my home desktop browser, I just use uBlock Origin to block ads. But for my phone, I set up a PiHole running on an EC2 instance and VPN into it from my phone. Blocks ads in everything, not just my web browser. The VPN is configured to only tunnel DNS lookups, not traffic, so the EC2 bandwidth bill is minimal.
- christian_fei 6y ago
  interesting approach
- Kipters 6y ago
  I've been doing the same (using Wireguard for DNS), except PiHole is running inside a Docker container on my Pi4 (I have a FTTH line, with a public/static IPv4 address). My ISP also started assigning /64 IPv6 nets to whoever requests one, so I might try that next
- ananonymoususer 6y ago
  Probably lightweight enough for the free EC2 tier too!
  - Sohcahtoa82 6y ago
    Oh, absolutely. But I have an instance that I already use for other things (IRC bouncer, Mumble server, Taiga task/issue tracker, and test server for a game I was writing) that has plenty of CPU time to spare, so it's not costing me anything.
  - graton 6y ago
    That is only free for 12 months though. Google Cloud and Oracle Cloud offer one free VM in their "always free" offering. Personally I use a $5/month Digital Ocean box.
    - ycombonator 6y ago
      I host Pihole on Digital Ocean as well.
kd913 6y ago
Please do note that Android appears to be quite weird in regards to accepting network set DNS. My observations so far have been that Android tends to ignore any DNS set by either the network via DHCP or statically set. Android instead probes the gateway for 8.8.8.8, and happily uses that instead. The only way I have been able to solve this has been to setup a VPN (I prefer wireguard) on the pihole. Android seems to accept this. The above in combination with say a DDNS hostname means that I now have a permanent adblocked VPN on my android phone which isn't too bad.
- KungFuJohnny 6y ago
  If you have a decent router, then you can just forcibly redirect any DNS requests from 8.8.8.8 to your PiHole.
  - kube-system 6y ago
    I have had good luck simply blocking any outbound port 53 traffic that doesn't come from pihole. Although with DoH these days, I'm not confident my firewall rule is still doing a good job :(
    - mulmen 6y ago
      If someone was rude enough to bypass DHCP's suggested DNS is it reasonable to assume they were polite enough to use the standard port? At this point every device on my network is hostile, default deny outbound is starting to feel like the reasonable starting point.
  - kd913 6y ago
    I have blocked port 53 forward and redirect. On my ISP's router (which I am forced to use), you can't block port 53 on the gateway itself. I don't want to add an extra router because that would add unnecessary latency. The above is not an unusual setup at all.
2OEH8eoCRo0 6y ago
I already have a home server so I run the pihole container with Podman. Pretty slick. It started as a quick project and then permanently tied up my raspberry pi because the adblocking was so awesome I didn't want to shut it down.
oschvr 6y ago
Funny, I did the exact same thing 1 week ago https://oschvr.com/posts/blocking-ads-with-pihole/ https://oschvr.com/posts/blocking-ads-with-pihole/
- christian_fei 6y ago
  interesting! nice site
Blackadderz 6y ago
Pi-hole has been excellent. I was able to discover that my Samsung TV was reporting minute by minute updates on what I was watching to a local Australian company. Unplugged it faster than I could swear.
- brachi 6y ago
  Reading these kind of anecdotes makes me wonder why is this legal or at least opt-in.
  - kube-system 6y ago
    My TV made me accept a terms of service agreement on first boot.
    - solstice 6y ago
      That (on its own) doesn't mean that it's legal, I'd imagine. At least in the EU, doesn't GDPR prohibit such non-choices?
      - GekkePrutser 6y ago
        It does now but it's possible it was bought before that time.
      - deleted 6y ago
        [deleted]
- mulmen 6y ago
  How does the Pi-hole achieve this? Does it have a blacklist (I assume) or can it use a whitelist? The services my TV needs to reach are easily enumerable, I pay all of them subscriptions. There is no other valid connection for it to make. Maybe firmware/app updates but I'd kinda prefer to do that myself at this point.
  - Smoosh 6y ago
accrual 6y ago
For OpenBSD users there is unbound-adblock[0]. It's a small shell script that uses only in-base utilities and can be run with minimal privileges. [0] https://www.geoghegan.ca/unbound-adblock.html https://www.geoghegan.ca/unbound-adblock.html
- stock_toaster 6y ago
  Similarly, there is also void-zone-tools[1] for FreeBSD. [1]: https://github.com/cyclaero/void-zones-tools https://github.com/cyclaero/void-zones-tools
m3at 6y ago
The combination of pihole and raspberry pi has impressed me. I just checked and the last reboot of my pi was 180 days ago, and since then things have just worked. It's in stark contrast with my server, which admittedly has more demanding tasks. For $35 it's the most trustable computer I bought, I now have a lot of respect for the Pi foundation.
- mulmen 6y ago
  Is uptime really desirable in this situation? How do you get security updates for a device that lives near the edge of your network?
  - m3at 6y ago
    You're right that's a fair question. My comment was trying to highlight the robustness of the system more than uptime being a good metric for quality. By that I mean that I didn't _have_ to reboot to keep the system healthy enough to stay alive. That's unfortunately not the case of some other hardware I deal with. For my Pi I regularly update without a reboot, but that might not be enough for kernel updates. I will look more into it.
tuananh 6y ago
some note for those want to use pihole - in windows, if you use primary dns as pihole and secondary dns as another cloud option (cloudflare, google), some ads will go through. secondary dns is not failover dns. try it and you will see.
- lostlogin 6y ago
  I don't think this is just Windows. I read the pihole documentation and came to the conclusion that primary/secondary DNS was more "a dns server" and "another dns server".
strangelove026 6y ago
This is a great repo. Step by step easy configuration of a pihole on a gcp compute instance with openvpn. I had pihole running on my phone blocking ads in the NYTs app! https://github.com/rajannpatel/Pi-Hole-PiVPN-on-Google-Compute-Engine-Free-Tier-with-Full-Tunnel-and-Split-Tunnel-OpenVPN-Configs https://github.com/rajannpatel/Pi-Hole-PiVPN-on-Google-Compu...
LeoPanthera 6y ago
The move of applications such as Firefox to start using DNS-over-https to hardcoded DNS servers will render such user-modified DNS services useless. Firefox can have this feature disabled, but more malicious applications will simply not give you the choice.
- mulmen 6y ago
  It's a tragic move. The DHCP/DNS ecosystem made managing devices dead simple. OTOH I suppose we were foolish to ever think our devices were playing nice. Is there a fix to DNS-over-HTTPS as a network operator? Can you MITM your "own" proprietary devices? What dragons live there?
  - iso947 6y ago
    You can set a canary domain which currently is used The only other way would be MITM all https traffic and sign with your own certificate, but many iot devices won’t allow you to install a new certificate store.
    - mulmen 6y ago
      I don’t know what a canary domain is. That reddit post isn’t entirely clear but it seems to be some kind of DNS black hole. That would rely on the application using your config. Will a canary domain on an edge device prevent my smart TV from using DoH to get the IP of a tracking server?
      - iso947 6y ago
        https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli... If your smart tv checks to see if it should disable DOH then it would work. I wouldn’t bank on it doing so though. Best to block all iot devices.
        mulmen 6y ago
deleted 6y ago
[deleted]
delcaran 6y ago
I currently use a 3-layered solution: browser blockers -> custom host file on each machine (StevenBlack hosts for linux and windows, nebulo for android) -> nextdns I'm actually satisfied, but I'm trying to setup pi-hole+unbound on a cloudatcost host I own to reduce the load on nextdns, so far without success.
- dingaling 6y ago
  Pi-hole is just a script wrapper around dnsmasq. On a host or server you might as well just do it straightforwardly: https://sfxpt.wordpress.com/2011/02/21/the-best-ad-blocking-method/ https://sfxpt.wordpress.com/2011/02/21/the-best-ad-blocking-...
IRegretNothing 6y ago
I've tested pihole for months now, it's working really well. Set up a VPN to an EC2 with pihole on it, no more ads on Spotify. Even family members wanted the VPN config, they really appreciate it.
adam0c 6y ago
I mean this is a great project and all but don't most moderns routers already have this built into them and are able to add VPNs.
- winrid 6y ago
  I haven't tried it, but I'd imagine the Pi performs a lot better. I wonder if anyone has benchmarked it against some common routers for this use case.
alecco 6y ago
curl -sSL https://install.pi-hole.net | bash Sigh
- christian_fei 6y ago
  https://raw.githubusercontent.com/pi-hole/pi-hole/master/automated%20install/basic-install.sh https://raw.githubusercontent.com/pi-hole/pi-hole/master/aut...
  - alecco 6y ago
    Are you implying everybody is supposed to AUDIT a 2700 line bash script??
m45t3r 6y ago
Thanks for the article to remember me of the existence of this project. I decided to do a setup in my home network using an old Raspberry Pi 1 that I had. Mainly because the router of my ISP screwed up really hard in its DHCP server, so I decided to disable it and use Pi-hole's one instead. I tried to make this setup as robust as possible, using OverlayFS [1] so root is read-only unless I remount it (to change configuration or upgrades) and with a watchdog so it can auto-reboot in case my Raspberry Pi is unresponsive. Pretty happy with this setup and it my internet seems more responsible than ever. [1]: https://yagrebu.net/unix/rpi-overlay.md/wiki/Setting_up_overlayFS_on_Raspberry_Pi https://yagrebu.net/unix/rpi-overlay.md/wiki/Setting_up_over...
- christian_fei 6y ago
  Awesome!
NicoJuicy 6y ago
I actually use NextDNS now, it's been on HN before and got good comments. https://news.ycombinator.com/item?id=22854209 https://news.ycombinator.com/item?id=22854209
- 0x49d1 6y ago
  Very nice resolver: I've pi-hole at home, but NextDNS as DNS resolver on mobile and as alternative DNS provider on home router. The setup works well, the only real thing the browser's adblocker is still needed is YouTube ads ;) Sure will pay for NextDNS when they will be out of beta.
gurrone 6y ago
I find it amazing how often ad blocking is discussed here, and start to wonder how many peeps hanging out here on the other hand depend indirectly on ad revenue to pay bills? There are obviously the big corps Facebook and Google, but also my own small employer, which is in theory in a different biz, runs ads on the web shop as an additional income source (which I find not very clever, increases page load times and is simply not our core biz). Do we all pay our bills with money made from the pour souls who did not get around to install an ad blocker or advanced setups like a pi hole? I'm on the pro ad blocking camp personally, also worked in the past in a biz that was 100% ad financed for a short period of time. Also there the whole tech department was using ad blockers.
- christian_fei 6y ago
  I can definitely agree with that. You can always explicitly whitelist a site you would like to see ads on and thus support, like I do
- dhimes 6y ago
  As always, it's not the ads most of us object to- it's the trackers. Google's original idea for monetizing the web, that you would be interested in something related to what you were searching for, apparently failed and now everybody's trying to follow you around to see what you might be interested in purchasing. It needs to stop. I know it's a lame solution but I use ff and containers and have a "shopping" container for sites that I don't block trackers on. I also have various other containers for other sites I don't mind knowing about each other. But mostly I block them.
  - bluntfang 6y ago
    >it's not the ads most of us object to I would love to see real data on this! Most of my peers don't want to be marketed to, at least when it comes to internet advertising. Definitely when it comes to traditional advertising (ie billboards are an eyesore, TV ads are offensive or irrelevant or just plain annoying).
    - 6y ago
jacques-noris 6y ago
I'm surprised, that no one here has mentioned Eblocker yet. It works a bit like Pi-hole, but is much easier to install and use. Eblocker used to be a commercial product (with its own hardware), but since this didn't work out the company open-sourced it a few months ago. It's free now, has a good interface and great performance and the former developers are still working on it. You can install it on a raspberry, but also on other SBCs. I'm in no way affiliated with them, just a happy user. https://eblocker.org/en/ https://eblocker.org/en/
pharaohgeek 6y ago
I set this up a couple of months ago and have been really happy with the results. Ad blockers on our iPhones/iPads are fine, but not always completely effective. I can't install one on my corporate laptop so there's no way around ads there. Using Pi-Hole was a perfect fit. I've only had to whitelist a single site that had problems with it.

241 points by christian_fei 6y ago

Pi-Hole is a great project, and it's not limited to running on a Raspberry Pi either. I've got it running as a (x86-64 Ubuntu) VM in the same hypervisor that hosts my firewall. It's lightweight, super responsive, and provides great statistics on what it is doing.

lordnacho 6y ago

I'm looking for a way to combine the adblocking with a VPN switcher that takes eg NordVPN and routes all my home traffic through a variety of tunnels (they provide a load of openVPN files). Is there a ready-made way to do this? The idea is for anyone in the house to be protected by both the adblock and the VPN.

aesh2Xa1 6y ago
I'm not aware of an "out of the box" solution, but maybe paying for NordVPN or similar will do this for you. VPNs typically tunnel your packets thru an encrypted connection to a gateway somewhere else on the internet. Ad blockers point your DNS to a resolver that blacklists ad domains. You can use a VPN and still set your DNS to whatever you'd like. What works best for you will depend on your threat model (or just privacy concern, as that other term sounds loaded).
parshimers 6y ago
pfsense can do this pretty easily, i wouldn't call it out of the box though. the adblocking can be done via pfblocker-ng, and it has an openvpn client of course.

greencar 6y ago

> Use it for ad-blocking in your home network and to finally browse the web, watch videos etc. without annoying ads. It doesn't really do this as well as a browser adblocker, YouTube ads for example can't effectively be blocked with pihole

alfalfasprout 6y ago
Actually, it most cases I find it significantly beats what a normal in-browser adblocker will do. More importantly, it does this for my phone, etc. But yes self-hosted ads, etc. won't be blocked. For that, there are other solutions. Personally, I use both.
schwartzworld 6y ago
it's not really fair to compare it to an in-browser adblocker that way, especially since using them isn't mutually exclusive. PiHole blocks ads whether you are in a browser or not, an instant benefit for everybody on your WiFi network.
- 416chad 6y ago
  Exactly this. Ads in places like news apps disappear, a big plus for pihole.
- BLKNSLVR 6y ago
  In fact, one of the best things about Pi-hole network wide blocking is the removal of those 5 to 10 second otherwise unskippable ads in apps.
- Firehawke 6y ago
  Absolutely. Defense in depth; Pi-hole will cover devices that you can't install an ad-blocker on while the ad-blocker will cover some edge cases where Pi-hole can't do it. It should never be considered an "or" situation; you want "both" as much as possible.
christian_fei 6y ago
there seems to be a solution: https://github.com/kboghdady/youTube_ads_4_pi-hole https://github.com/kboghdady/youTube_ads_4_pi-hole
x3blah 6y ago
Watching videos with Javascript turned off, there are no ads. Google tries to force users to turn on JavaScript by needlessly making the YouTube website "require" JS to be turned on to play videos. However it is easy to play the videos without using JavaScript using just basic HTML. Example https://news.ycombinator.com/item?id=23076239 https://news.ycombinator.com/item?id=23076239

Havoc 6y ago

There are dockerised versions as well if you happen to have a docker stack somewhere in your home

christian_fei 6y ago
i like the pi-hole installer a lot, since it's a damn one-liner. i was amazed by its simplicity
- Havoc 6y ago
  Yeah definitely easier to deploy on a raspberry than docker but means an extra device
  - christian_fei 6y ago
    True

brenden2 6y ago

I use pi-hole, and it's great, but for browsers you still need something like uBlock Origin installed to properly block ads. The thing I like about pi-hole is it also blocks a long list of trackers that are bundled by various mobile SDKs. There's no way to block those with iOS or Android, except at the network level.

daveslash 6y ago
I've been using Pi-Hole for quite a while now too. I also have several in-browser ad blockers. In browser, I'm running Ghostery, uBlock Origin, and Privacy Badger, DuckDuck Go's privacy essentials, and whatever Firefox's does when you turn on all of the privacy respecting stuff. Honestly, I don't really know what does what any more. I recently turned off pi-hole and started to browse the web using Internet Explorer, just to see. Holy Cow... I'd forgotten what the incredible-edible internet was really like.
- mulmen 6y ago
  This is great and I'm glad it is working for you. I think you are about 6 months ahead of me as I now have two Firefox privacy addons and I'm shopping for hardware to build a firewall box. As I read your comment all I could visualize was an IE6 browser with 8 toolbars. The network stack of the future.

bberrry 6y ago

I wish it were more effective in removing Youtube ads on my kids' iPads, but I understand it's a tall order. At least it gets rid of ads in most other apps.

netsharc 6y ago
If you had said Android I would've suggested NewPipe: https://newpipe.schabi.org/ https://newpipe.schabi.org/
christian_fei 6y ago
could be the right fit: https://github.com/kboghdady/youTube_ads_4_pi-hole https://github.com/kboghdady/youTube_ads_4_pi-hole
- bberrry 6y ago
  Thank you! I'll give it a try
  - christian_fei 6y ago
    cheers, gotta try it too
BuckRogers 6y ago
Try Microsoft Edge. Its built in ad blocker works for me with Youtube on my iPhone. I block ads at the application layer, DNS based ad blocking doesn’t really do it anymore and can create another troubleshooting surface to consider when it breaks something.
- frank2 6y ago
  In response to your comment, I tested Microsoft Edge on my iPad and can confirm that yes, indeed, it does block the ads on youtube.com -- mostly: out of about 7 videos, an ad was shown to me at the start of one of them, but that is much better than mobile Safari, on which and ad is shown to me at the start of every video I start. Thanks for the tip.

strenholme 6y ago

I actually have been doing some work with MaraDNS to have the ability to have a pi-hole sized blacklist. The main source of pi-hole’s blacklist is this Git repo: https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts That is about 60,000 hosts, so I added MaraDNS support to have up to 500,000 blacklisted names. Since it’s a speed-optimized (not size-optimized) cache, each element takes about a kilobyte of memory, so a blacklist this size takes about 60 megabytes of memory for MaraDNS to store (on a modern Core i7 7600U processor, it only takes about two seconds to load all 60,000 elements in to memory), but it’s very rapid to use. The script to take that blacklist and convert it in to a MaraDNS compatible format is here: https://github.com/samboy/MaraDNS/blob/master/deadwood-github/tools/make.blacklist.sh https://github.com/samboy/MaraDNS/blob/master/deadwood-githu... There are ways to make the memory footprint of the blacklist smaller, but this was a quick and simple way to implement a medium sized blacklist. Finding ways to have, say, 10 million blacklist elements with a small memory footprint is left as an exercise for the reader. My current project is to make a proper Docker container for MaraDNS.

CoolGuySteve 6y ago
What is the optimization gained by having 1KB cache slots when the cacheline size on Intel and ARM is typically 64 bytes?
- strenholme 6y ago
  Each cache entry needs a hash bucket so we can look up the entry in O(1), and we need more hash buckets than entries to minimize cache look up time. The hash bucket needs a copy of the element for each hit (to verify we hit the correct hash bucket), and a possible link to the next hash bucket, just in case we got a hash collision (we still need to store that link in memory as a null pointer regardless). [1] The strings are special structures which allow binary data to be stored in them and to protect against buffer overflow protection, so they take up more room than a normal string. Since the cache is a dynamic LRU cache (blacklist entries are not in the circular LRU, of course, but the cache was designed that way) for temporarily storing correct DNS answers (with overhead because, yes, each entry has among other things a 64-bit expire timestamp), each entry is created or removed with multiple malloc() and free() calls, so there’s some page size overhead there. Like I said, there are ways to make a blacklist have a smaller memory footprint, by using a special data structure which trades speed for size, [2] but for a two-day coding project, it made more sense to just add them to the speed optimized LRU cache the code is built around. [1] As an aside, the hash compression algorithm came out before SIP Hash, but, like SIP Hash, has protection against an attacker finding hash bucket collisions. If I were to write the code today, I would use SIP Hash. [2] Here is how I would do it: I would have two blocks of data. One block is an array of offsets (pointers, but not C memory pointers) to data in the second block, and the second block is a bunch of NULL-terminated strings compactly stored. The array of offsets is a sorted list, where the sort key is the string each element points to. I would then do a binary search every time I wanted to see if an element is blacklisted. Memory overhead is, for 10 million entries with an average length of 15 bytes per string (including the NULL) 30 million bytes for the offsets and 150 million bytes for the strings, so we could store 10 million entries in under 200 megs. Speed is O(log2(N)) instead of O(1) but we save a lot of memory. We would need more memory to sort that list, but we could store this block as a binary file which is made on a host with a lot of memory, but read on our Raspberry Pi or old Netbook. Again, doing this is left as an exercise for the reader, and I’m sure there’s a lot of public domain or otherwise open licensed libraries which have already solved this problem. If I were to go down that path; I would probably use sqlite, but am a bit reluctant to add sqlite to a tiny program which can compile to be under 70k in size.

dastx 6y ago

Another alternative is AdGuard Home. They've come a long way since they announced it. I switched to AdGuard Home some 6 months ago and it has been great.

ObsoleteNerd 6y ago
I switched a section of my network over to it a few weeks ago, and I've been having constant random internet issues since, and when I swap back to the Pi-Hole the problems go away. Is there some trickery to getting AdGuard to run stable? I have it running as an Add-On to Home Assitant, so I'm not sure if that's causing the issues, but I get lots of failed DNS queries, slowdowns, etc when going through AdGuard.
- dastx 6y ago
  Not that I know of. I'm running on a pi3b and never had issues. I suggest raising a GitHub issue, they're usually pretty quick to respond and quick to fix bugs.

doctoboggan 6y ago

Does anyone have any good suggestions for blacklists? I've only been using the default and am wondering if I should add some more items to the list.

christian_fei 6y ago
some blacklists i found: - https://discourse.pi-hole.net/t/update-the-best-blocking-lists-for-the-pi-hole-alternative-dns-servers-2019/13620 https://discourse.pi-hole.net/t/update-the-best-blocking-lis... - https://github.com/chadmayfield/my-pihole-blocklists https://github.com/chadmayfield/my-pihole-blocklists
zf00002 6y ago
This is the only one I use: https://www.reddit.com/r/oisd_blocklist/comments/dwxgld/dbloisdnl_internets_1_domain_blocklist/ https://www.reddit.com/r/oisd_blocklist/comments/dwxgld/dblo...

jedberg 6y ago

Is anyone successfully using PiHole with non-technical users? My main concern with putting PiHole on my home network is that for example my mother in law might not understand that she can't get to some web page because it's being ad-blocked, nor would she be able to go to the web admin page and temporarily unblock it. Even as a technical person sometimes it takes a while to figure out that a page isn't working because of adblock or pi-hole. How do people deal with this?

ObsoleteNerd 6y ago
I've set it up for most of my close family and friends, added a physical button to the top of the Raspberry Pi case that disables it for x minutes (x changes depending who they are and their needs), so if they're having issues they go press the button to access the problematic website. I keep reading about people having to disable the Pi-Hole so much that it becomes annoying, or constantly butting heads with websites that don't work with Pi-Holes, but I can honestly say that I, and the people I've set them up for, BARELY EVER need to use the Disable button. Not for online banking, not for online shopping, not for any regular content consumed. I can't personally think of the last time I needed to disable the Pi-Hole for anything at all. It just sits there blocking ads invisibly, plugged into the back of my modem/router, and is one of my absolute favourite parts of my tech stack. What websites are people visiting that the Pi-Hole doesn't work with? I'm genuinely curious, because I've been running mine for a couple years now and can't think of anything off the top of my head, and no one in my family group have ever complained about it, with most telling me it's been flawless and they barely every touch the button.
- rablackburn 6y ago
  I like that physical button solution. Do you have a github repo or blog post documenting how you did it anywhere?
  - ObsoleteNerd 6y ago
    I haven't posted anything, but it's pretty simple really. Follow any of the guides to make a physical button run a Python/BASH script[0] and then I wrote a small script that just CURLs the URL to disable the Pi-Hole for a few minutes (eg: curl --silent http://192.168.2.2/admin/api.php?disable=600&auth=PASSWORD http://192.168.2.2/admin/api.php?disable=600&auth=PASSWORD ). I've been meaning to make a blog post about it but haven't got around to it yet. I'll try write something up later today/tonight. [0] https://raspberrypihq.com/use-a-push-button-with-raspberry-pi-gpio/ https://raspberrypihq.com/use-a-push-button-with-raspberry-p... Edit: I found this which is a much bigger/fancier version of what I did, but has the associated code you can pull out for a simple button: https://github.com/nickearl/piHoleButtons https://github.com/nickearl/piHoleButtons

Sohcahtoa82 6y ago

For my home desktop browser, I just use uBlock Origin to block ads. But for my phone, I set up a PiHole running on an EC2 instance and VPN into it from my phone. Blocks ads in everything, not just my web browser. The VPN is configured to only tunnel DNS lookups, not traffic, so the EC2 bandwidth bill is minimal.

christian_fei 6y ago
interesting approach
Kipters 6y ago
I've been doing the same (using Wireguard for DNS), except PiHole is running inside a Docker container on my Pi4 (I have a FTTH line, with a public/static IPv4 address). My ISP also started assigning /64 IPv6 nets to whoever requests one, so I might try that next
ananonymoususer 6y ago
Probably lightweight enough for the free EC2 tier too!
- Sohcahtoa82 6y ago
  Oh, absolutely. But I have an instance that I already use for other things (IRC bouncer, Mumble server, Taiga task/issue tracker, and test server for a game I was writing) that has plenty of CPU time to spare, so it's not costing me anything.
- graton 6y ago
  That is only free for 12 months though. Google Cloud and Oracle Cloud offer one free VM in their "always free" offering. Personally I use a $5/month Digital Ocean box.
  - ycombonator 6y ago
    I host Pihole on Digital Ocean as well.

kd913 6y ago

Please do note that Android appears to be quite weird in regards to accepting network set DNS. My observations so far have been that Android tends to ignore any DNS set by either the network via DHCP or statically set. Android instead probes the gateway for 8.8.8.8, and happily uses that instead. The only way I have been able to solve this has been to setup a VPN (I prefer wireguard) on the pihole. Android seems to accept this. The above in combination with say a DDNS hostname means that I now have a permanent adblocked VPN on my android phone which isn't too bad.

KungFuJohnny 6y ago
If you have a decent router, then you can just forcibly redirect any DNS requests from 8.8.8.8 to your PiHole.
- kube-system 6y ago
  I have had good luck simply blocking any outbound port 53 traffic that doesn't come from pihole. Although with DoH these days, I'm not confident my firewall rule is still doing a good job :(
  - mulmen 6y ago
    If someone was rude enough to bypass DHCP's suggested DNS is it reasonable to assume they were polite enough to use the standard port? At this point every device on my network is hostile, default deny outbound is starting to feel like the reasonable starting point.
- kd913 6y ago
  I have blocked port 53 forward and redirect. On my ISP's router (which I am forced to use), you can't block port 53 on the gateway itself. I don't want to add an extra router because that would add unnecessary latency. The above is not an unusual setup at all.

2OEH8eoCRo0 6y ago

I already have a home server so I run the pihole container with Podman. Pretty slick. It started as a quick project and then permanently tied up my raspberry pi because the adblocking was so awesome I didn't want to shut it down.

oschvr 6y ago

Funny, I did the exact same thing 1 week ago https://oschvr.com/posts/blocking-ads-with-pihole/ https://oschvr.com/posts/blocking-ads-with-pihole/

christian_fei 6y ago
interesting! nice site

Blackadderz 6y ago

Pi-hole has been excellent. I was able to discover that my Samsung TV was reporting minute by minute updates on what I was watching to a local Australian company. Unplugged it faster than I could swear.

brachi 6y ago
Reading these kind of anecdotes makes me wonder why is this legal or at least opt-in.
- kube-system 6y ago
  My TV made me accept a terms of service agreement on first boot.
  - solstice 6y ago
    That (on its own) doesn't mean that it's legal, I'd imagine. At least in the EU, doesn't GDPR prohibit such non-choices?
    - GekkePrutser 6y ago
      It does now but it's possible it was bought before that time.
    - deleted 6y ago
      [deleted]
mulmen 6y ago
How does the Pi-hole achieve this? Does it have a blacklist (I assume) or can it use a whitelist? The services my TV needs to reach are easily enumerable, I pay all of them subscriptions. There is no other valid connection for it to make. Maybe firmware/app updates but I'd kinda prefer to do that myself at this point.
- Smoosh 6y ago

accrual 6y ago

For OpenBSD users there is unbound-adblock[0]. It's a small shell script that uses only in-base utilities and can be run with minimal privileges. [0] https://www.geoghegan.ca/unbound-adblock.html https://www.geoghegan.ca/unbound-adblock.html

stock_toaster 6y ago
Similarly, there is also void-zone-tools[1] for FreeBSD. [1]: https://github.com/cyclaero/void-zones-tools https://github.com/cyclaero/void-zones-tools

m3at 6y ago

The combination of pihole and raspberry pi has impressed me. I just checked and the last reboot of my pi was 180 days ago, and since then things have just worked. It's in stark contrast with my server, which admittedly has more demanding tasks. For $35 it's the most trustable computer I bought, I now have a lot of respect for the Pi foundation.

mulmen 6y ago
Is uptime really desirable in this situation? How do you get security updates for a device that lives near the edge of your network?
- m3at 6y ago
  You're right that's a fair question. My comment was trying to highlight the robustness of the system more than uptime being a good metric for quality. By that I mean that I didn't _have_ to reboot to keep the system healthy enough to stay alive. That's unfortunately not the case of some other hardware I deal with. For my Pi I regularly update without a reboot, but that might not be enough for kernel updates. I will look more into it.

tuananh 6y ago

some note for those want to use pihole - in windows, if you use primary dns as pihole and secondary dns as another cloud option (cloudflare, google), some ads will go through. secondary dns is not failover dns. try it and you will see.

lostlogin 6y ago
I don't think this is just Windows. I read the pihole documentation and came to the conclusion that primary/secondary DNS was more "a dns server" and "another dns server".

strangelove026 6y ago

This is a great repo. Step by step easy configuration of a pihole on a gcp compute instance with openvpn. I had pihole running on my phone blocking ads in the NYTs app! https://github.com/rajannpatel/Pi-Hole-PiVPN-on-Google-Compute-Engine-Free-Tier-with-Full-Tunnel-and-Split-Tunnel-OpenVPN-Configs https://github.com/rajannpatel/Pi-Hole-PiVPN-on-Google-Compu...

LeoPanthera 6y ago

The move of applications such as Firefox to start using DNS-over-https to hardcoded DNS servers will render such user-modified DNS services useless. Firefox can have this feature disabled, but more malicious applications will simply not give you the choice.

mulmen 6y ago
It's a tragic move. The DHCP/DNS ecosystem made managing devices dead simple. OTOH I suppose we were foolish to ever think our devices were playing nice. Is there a fix to DNS-over-HTTPS as a network operator? Can you MITM your "own" proprietary devices? What dragons live there?
- iso947 6y ago
  You can set a canary domain which currently is used The only other way would be MITM all https traffic and sign with your own certificate, but many iot devices won’t allow you to install a new certificate store.
  - mulmen 6y ago
    I don’t know what a canary domain is. That reddit post isn’t entirely clear but it seems to be some kind of DNS black hole. That would rely on the application using your config. Will a canary domain on an edge device prevent my smart TV from using DoH to get the IP of a tracking server?
    - iso947 6y ago
      https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli... If your smart tv checks to see if it should disable DOH then it would work. I wouldn’t bank on it doing so though. Best to block all iot devices.
      - mulmen 6y ago

deleted 6y ago

[deleted]

delcaran 6y ago

I currently use a 3-layered solution: browser blockers -> custom host file on each machine (StevenBlack hosts for linux and windows, nebulo for android) -> nextdns I'm actually satisfied, but I'm trying to setup pi-hole+unbound on a cloudatcost host I own to reduce the load on nextdns, so far without success.

dingaling 6y ago
Pi-hole is just a script wrapper around dnsmasq. On a host or server you might as well just do it straightforwardly: https://sfxpt.wordpress.com/2011/02/21/the-best-ad-blocking-method/ https://sfxpt.wordpress.com/2011/02/21/the-best-ad-blocking-...

IRegretNothing 6y ago

I've tested pihole for months now, it's working really well. Set up a VPN to an EC2 with pihole on it, no more ads on Spotify. Even family members wanted the VPN config, they really appreciate it.

adam0c 6y ago

I mean this is a great project and all but don't most moderns routers already have this built into them and are able to add VPNs.

winrid 6y ago
I haven't tried it, but I'd imagine the Pi performs a lot better. I wonder if anyone has benchmarked it against some common routers for this use case.

alecco 6y ago

curl -sSL https://install.pi-hole.net | bash Sigh

christian_fei 6y ago
https://raw.githubusercontent.com/pi-hole/pi-hole/master/automated%20install/basic-install.sh https://raw.githubusercontent.com/pi-hole/pi-hole/master/aut...
- alecco 6y ago
  Are you implying everybody is supposed to AUDIT a 2700 line bash script??

m45t3r 6y ago

Thanks for the article to remember me of the existence of this project. I decided to do a setup in my home network using an old Raspberry Pi 1 that I had. Mainly because the router of my ISP screwed up really hard in its DHCP server, so I decided to disable it and use Pi-hole's one instead. I tried to make this setup as robust as possible, using OverlayFS [1] so root is read-only unless I remount it (to change configuration or upgrades) and with a watchdog so it can auto-reboot in case my Raspberry Pi is unresponsive. Pretty happy with this setup and it my internet seems more responsible than ever. [1]: https://yagrebu.net/unix/rpi-overlay.md/wiki/Setting_up_overlayFS_on_Raspberry_Pi https://yagrebu.net/unix/rpi-overlay.md/wiki/Setting_up_over...

christian_fei 6y ago
Awesome!

NicoJuicy 6y ago

I actually use NextDNS now, it's been on HN before and got good comments. https://news.ycombinator.com/item?id=22854209 https://news.ycombinator.com/item?id=22854209

0x49d1 6y ago
Very nice resolver: I've pi-hole at home, but NextDNS as DNS resolver on mobile and as alternative DNS provider on home router. The setup works well, the only real thing the browser's adblocker is still needed is YouTube ads ;) Sure will pay for NextDNS when they will be out of beta.

gurrone 6y ago

I find it amazing how often ad blocking is discussed here, and start to wonder how many peeps hanging out here on the other hand depend indirectly on ad revenue to pay bills? There are obviously the big corps Facebook and Google, but also my own small employer, which is in theory in a different biz, runs ads on the web shop as an additional income source (which I find not very clever, increases page load times and is simply not our core biz). Do we all pay our bills with money made from the pour souls who did not get around to install an ad blocker or advanced setups like a pi hole? I'm on the pro ad blocking camp personally, also worked in the past in a biz that was 100% ad financed for a short period of time. Also there the whole tech department was using ad blockers.

christian_fei 6y ago
I can definitely agree with that. You can always explicitly whitelist a site you would like to see ads on and thus support, like I do
dhimes 6y ago
As always, it's not the ads most of us object to- it's the trackers. Google's original idea for monetizing the web, that you would be interested in something related to what you were searching for, apparently failed and now everybody's trying to follow you around to see what you might be interested in purchasing. It needs to stop. I know it's a lame solution but I use ff and containers and have a "shopping" container for sites that I don't block trackers on. I also have various other containers for other sites I don't mind knowing about each other. But mostly I block them.
- bluntfang 6y ago
  >it's not the ads most of us object to I would love to see real data on this! Most of my peers don't want to be marketed to, at least when it comes to internet advertising. Definitely when it comes to traditional advertising (ie billboards are an eyesore, TV ads are offensive or irrelevant or just plain annoying).
  - 6y ago

jacques-noris 6y ago

I'm surprised, that no one here has mentioned Eblocker yet. It works a bit like Pi-hole, but is much easier to install and use. Eblocker used to be a commercial product (with its own hardware), but since this didn't work out the company open-sourced it a few months ago. It's free now, has a good interface and great performance and the former developers are still working on it. You can install it on a raspberry, but also on other SBCs. I'm in no way affiliated with them, just a happy user. https://eblocker.org/en/ https://eblocker.org/en/

pharaohgeek 6y ago

I set this up a couple of months ago and have been really happy with the results. Ad blockers on our iPhones/iPads are fine, but not always completely effective. I can't install one on my corporate laptop so there's no way around ads there. Using Pi-Hole was a perfect fit. I've only had to whitelist a single site that had problems with it.