17 ms·

Pi-hole 5.0

587 points by Iolaum 6y ago

notkaiho 6y ago
Pi-Hole has made my home browsing experience so much better since setting it up. Minimal resource overhead, maximum results - and if you care about stats those are available too but I just turned all logging off. Now if it could just filter out YouTube ads...
- xienze 6y ago
  > Now if it could just filter out YouTube ads... Ive heard that the problem is that the native YT apps come with a big list of IP addresses for the ad servers, instead of doing lookups.
  - dahfizz 6y ago
    If true, it would be pretty easy to grab those ip addresses from the binary and add them to a firewall. A firewall is a little more than what I would trust to a raspberry pie, though...
  - kgwxd 6y ago
    I thought it was streaming the ads right along with the main content making it impossible to block.
- disiplus 6y ago
  > vanced.app
  - nobodyshere 6y ago
    I'd rather recommend this one: https://newpipe.schabi.org/ https://newpipe.schabi.org/ At least it is opensource and works great.
    - disiplus 6y ago
      it broke down for me after 10min of use. no amount of reinstall or cleaning cache helped.
      - agumonkey 6y ago
        it has frail feet but it does work more often than not
        the_pwner224 6y ago
        Interestingly it's been working perfectly for me with no issues for almost 1 year. A bit surprised to learn that it is not stable for a bunch of people.
        agumonkey 6y ago
        Well I think it's just a matter of lag between bugfix and updates on my side. Which means from time to time I get a guru error. Other than that it's quite stable.
      - KCUOJJQJ 6y ago
        Maybe coincidentally after the 10 minutes YouTube changed something? Once or twice NewPipe stopped working for me suddenly but an update helped. BTW F-Droid gets updates of NewPipe a bit later than GitHub it seems.
    - j1elo 6y ago
      I used NewPipe for a while and it was very nice, enjoyed how well it works. However I started wanting to see videos on my TV (Chromecast), and that's where the abilities of NewPipe fell short. They have an open issue [0] since a couple years ago, but so far it is not a feature yet. [0]: https://github.com/TeamNewPipe/NewPipe/issues/668 https://github.com/TeamNewPipe/NewPipe/issues/668
      - dastx 6y ago
  - j1elo 6y ago
    They very recently moved to require an special additional app just for installing their new .apks file (which is a file containing multiple .apk inside), called SAI. That would be fine by me, if it wasn't because SAI requires Android 5.0, while my Nvidia Tegra -like tablet (Xiaomi MiPad 1) is stuck on Android 4.4 :-( (no, Lineage and friends is not a good replacement, they all break the camera, and yet worse, suck battery like crazy)
- tfehring 6y ago
  AdGuard DNS works well for YouTube ads IME. https://adguard.com/en/adguard-dns/overview.html https://adguard.com/en/adguard-dns/overview.html
  - surround 6y ago
    I’m pretty sure that the on-device app blocks youtube ads, not the DNS filtering. Although I think it is indeed possible to block youtube ads through DNS filtering, it’s just really difficult & only works temporarily before needing to block new domains.
    - tfehring 6y ago
      I actually looked into this a bit after posting that comment, since it occurred to me that I don't actually know exactly what's blocking YouTube ads for me. (I'm still not sure, which is why I didn't edit my previous comment after doing that research.) Empirically, I don't get YouTube ads in the iOS app. I do use Firefox Focus as a content blocker, in addition to AdGuard DNS. I don't use the AdGuard app, and it was my understanding that Firefox Focus only blocked ads in Safari, so I assumed it was AdGuard DNS. The documentation for AdGuard DNS seems to indicate that it shouldn't work for this, but it seems like either that documentation or the documentation for iOS content blockers is missing something. Unless YouTube has just decided not to serve me ads for some reason. (I'm not complaining either way.)
- kgwxd 6y ago
  If you're on Android, you can use the YT site instead of the app and Firefox with uBlock Origin will block the ads.
- askvictor 6y ago
  I had something working a while ago for YT ad blocking in chromecast; the underlying problem there is that the chromecast is hard-coded to use Google's DNS servers (8.8.8.8, etc) instead of your networks. So you need to set up your network to intercept DNS requests to 8.8.8.8 and 8.8.4.4 and instead send these to your own ad-blocked DNS server. My network setup no longer lets me do this, and I don't care enough to make it work. Just pay for YT premium if you don't want ads (to all those people complaining about wanting an option to pay and not be tracked/advertised to/etc - this is a great opporunity to put your money where your mouth is)
  - slau 6y ago
    Just don’t allow outbound DNS except from your pihole, and the Chromecast will use whatever DNS server you give it. Also, make sure to block UDP and TCP on port 53, as well as UDP on port 443 (Chrome snitching).
    - askvictor 6y ago
      I imagine at some point, Chromecast will start using DNS-over-HTTPS and move the goalposts elsewhere.
surround 6y ago
Pi-hole is very easy to set up, and it works so well you can basically forget about it from that point on. Blocking ads is nice, but it’s also a huge boon for privacy. I run uBlock origin on all my browsers, but Pi-hole still blocks 30-50% of requests on my network. It’s also really nice to be able to glance at the logs and get an idea of what’s going on on your network, or if there’s any unusual activity. I’m especially excited to see CNAME inspection. I was tired of trying to figure out what domains like “xuenl4v1szy8g.cloudfront.net” were doing.
- ciarannolan 6y ago
  >I’m especially excited to see CNAME inspection. I was tired of trying to figure out what domains like “xuenl4v1szy8g.cloudfront.net” were doing. Is there a good explainer for CNAME inspection? I'm not finding anything good with my Google Fu.
  - deleted 6y ago
    [deleted]
  - dastx 6y ago
    Some ad agencies starting asking hosters to add a CNAME record to one of their domains. Let's say I have your own blog running on dastx.me, and I wanted some ads from adgiant.com. As an adblocker you've added `* .adgiant.com` to your blacklist and I'm an asshole and try to circumvent such adblocking measure. Them young millennials and their tech. Stealing me out of my money! So I go to adgiant.com and ask them if there is something i can do. adgiant.com asks me to add a new DNS record of `CNAME definitely-not-an-ad-subdomain.dastx.me -> terribleads.adgiant.com`. This way, whenever I wanna call terrible-ads.adgiant.com, I instead use `definitely-not-an-ad-subdomain.dastx.me`. When it comes to adblocking this is an issue because adblocking lists are usually based on a blacklist. They'll have `*.adgiant.com` on the list but not `definitely-not-an-ad-subdomain.dastx.me`, thus my ads will start working. We could of course ad every subdomain we come across to the blacklist, but suddenly our adblock list doubles, triples, quadruples or more. What adblocking software do now, is they do a dns lookup for every domain, and consider all domains in the result as the same. So if either of previous domains are in the block list, both domains are considered blocked. This CNAME method is also a huge security issue, but I'm not gonna go into that.
disiplus 6y ago
does anybody know how to properly secure the the DNS server from replay attacks with iptables. i have a pihone running on a cheap vps on internet, but i connect to it with a vpn and that's draining my smartphone battery. i want to be able to change only the dns settings and point to my pi-hole. but at that time the recommendation was to not run the dns part on the internet because it could be used for dns replay attacks. i found some iptables rules on the net at time but was not sure are they ok. i did not want the ip address blacklisted because i was running some other services on that server.
- surround 6y ago
  The official documentation includes a tutorial on how to use pi-hole with OpenVPN. This section describes how to use the VPN for only DNS requests: https://docs.pi-hole.net/guides/vpn/only-dns-via-vpn/ https://docs.pi-hole.net/guides/vpn/only-dns-via-vpn/ A Wireguard setup would probably be even less resource intensive if you know how to set it up (there’s no official tutorial for Wireguard). Do not open your pi to the internet, I doubt the iptables rules would be sufficient to protect it.
  - ignoramous 6y ago
    > ...there’s no official tutorial for Wireguard To run a split wireguard-tunnel to a DNS server, add its IP to the allowed-IPs list: https://www.reddit.com/r/WireGuard/comments/bqccdz/split_tunnel_for_only_dns_possible/ https://www.reddit.com/r/WireGuard/comments/bqccdz/split_tun... If you're on an Android phone, apps like Blokada (plain old DNS), Nebulo (DoH and DoT), Intra (DoH) can split tunnel traffic to a DNS server of your choice. Note that, Android 9+ supports DoT, out of the box. Look for the Private DNS setting.
- neurostimulant 6y ago
  I have migrated wireguard since several months ago and the battery life improvements is tremendous compared to openvpn. Previously I can't enable vpn 24/7 as my phone's battery will be drained before the end of the day, but now with wireguard I can enable it all day without draining the battery too much.
ycombonator 6y ago
I host pihole on Digital Ocean. Updated DNS on all my home clients. Smooth and adfree
- nobodyshere 6y ago
  I do it on a PoE powered raspberry pi. Minimal effort, zero maintenance, no fees other than the initial purchase.
  - hbcondo714 6y ago
    Do you use a PoE switch for this?
    - rand49an 6y ago
      Either a switch or an injector.
    - nobodyshere 6y ago
      I use a ubiquiti switch. I've decided to build my network with PoE in mind and one central location to power it all, backed up by a UPS.
  - c0nsumer 6y ago
    I do this too. After throwing around a bunch of other ideas, I realized that a Pi is cheap enough and the one-shot cost is nice. If it dies, I just update the MAC address for its DHCP reservation to the new pi, spend 10 minutes setting up a new instance, and that's that. It just ends up working.
    - yjftsjthsd-h 6y ago
      The dream is to network boot the thing, so you literally plug a new pi in to network+power and it automatically boots and starts running stuff:) (Well, a Pi also needs a 1-time step to enable network boot, but still)
A4ET8a8uTh0 6y ago
Per client blocking is clearly the biggest change. I am excited about this.
- barney54 6y ago
  What is the use case of per client blocking?
  - beervirus 6y ago
    Blocking Facebook stuff on every device except my wife’s phone.
    - Spivak 6y ago
      Why not just tell your DHCP server to give her the regular DNS servers? Is this situation where she wants ad blocking but still wants to use FB?
      - beervirus 6y ago
        Yeah, ad blocking in general is what makes the web tolerable.
      - slau 6y ago
        Not OP, but in my case, most of my VLANs can’t perform DNS requests to WAN. Only the pi.hole server is able to do that (and other devices in the DMZ). Reasoning: appliances like Chromecast/Apple TV/whatever will often ignore DHCP DNS settings if it doesn’t resolve, and they’ll reach out to 8.8.8.8/8.8.4.4 directly.
  - A4ET8a8uTh0 6y ago
    I have several users and multiple devices in our household. FB is not allowed anywhere near my PC, but wife has to currently switch between piholed and not piholed wifi. It just allows for a much better control. Heavens know not everyone is like me.
  - 6y ago
j1elo 6y ago
Server is down, right? Not for this case (which I assume is caused by the HN effect) but one downside of this kind of blockers (I also use uBlock in the browser) is that when something doesn't work well in a website, I'm never confident that it's because the site is broken and not because my blockers are breaking it :-) I know, you can just disable the blocker and try again, but doing so from my phone is not very convenient...
popotamonga 6y ago
When i uninstalled it broke my linux dns, keeps getting changed to localhost automatically. And om not expert enough on linux to fix it.
foob4r 6y ago
Woohoo been waiting for this for months. I host pihole on a home server in a docker container and spend 5 mins a month just updating it. No other administration. Definitely use it to get rid of trackers and ads. (I should add that I also pay for about dozen publications/newspapers that I read frequently in lieu of not seeing ads)
- asadhaider 6y ago
  Look at Watchtower [0] to keep your containers up to date automatically. [0] https://containrrr.github.io/watchtower/ https://containrrr.github.io/watchtower/
xref 6y ago
Is there a way to quickly disable/re-enable pihole for the network? With AdGuard DNS or uBlock Origin I still get into situations where occasionally they break a site completely and I have to temporarily disable the plugin (or switch to cell tower dns) to get the site working, so I’d want a quick way out of pi-holing traffic as well
- city41 6y ago
  You can navigate to the admin console (easily done on any machine on your network) and disable it for a certain amount of time very easily https://i.imgur.com/K6VgV2G.png https://i.imgur.com/K6VgV2G.png Note this is from pihole 4.3, but I can't image 5 would remove this feature.
- kylegordon 6y ago
  The Web UI has a Disable button, and also quick options for permanent, 10 seconds, 30 seconds, 5 minutes, custom, etc. I think there's also an API as well. I can toggle it via Alexa and Home-Assistant. It's a feature that's been around for 2 years or more
  - xref 6y ago
    “Alexa, shut pihole” Thanks for the tip, I don’t have any home assistants but this would be the first integration I’d set up
  - domoritz 6y ago
    I just noticed that the home assistant addon has been deprecated: https://github.com/hassio-addons/addon-pi-hole https://github.com/hassio-addons/addon-pi-hole. I hope that it comes back eventually.
    - GekkePrutser 6y ago
      They recommend the AdGuard Home one now... That's why they have replaced it. I also don't like it as AdGuard is a commercial company, and I have zero need for the added features like parental control. But I don't really care, I run all the dockers that have nothing to do with home assistant outside of hassio anyway.
iou 6y ago
Alternatively for MAX_lazyness and convenience I've been using https://nextdns.io https://nextdns.io, does all the same stuff and is the alternative to cloudflare in Firefox for DNS-over-Https (DOH)
- ciarannolan 6y ago
  Is there an advantage in sending all of your DNS queries to a for-profit company vs. setting up your own Pi-hole? Their privacy policy seems legit[0] but why trust them at all when Pi-hole is an option? [0] https://nextdns.io/privacy https://nextdns.io/privacy
  - jzig 6y ago
    max laziness and convenience ;)
    - iou 6y ago
      ^^ this though they do also have some additional security protections for typosquatting, safebrowsing, homoglyphs, threat-intelligence which is also nice. All of which could be done on a pihole though not out of the box when I last used it ~2 years ago.
  - dastx 6y ago
    Also, unless you go through the trouble of setting up unbound, your requests would need to go to an upstream server anyway, so might as well send them to one with the best privacy policy.
  - dogma1138 6y ago
    No additional hardware required, you can use it to provide some protection to your family without having to worry about remote access to the Pi-Hole to configure things, works for your devices on the go, cheaper than running pi-hole in the cloud yourself unless. Pricing wise it’s over 2 years worth of service for the price of an original Pi, a good SD card and a case. The only circumstances where Pi Hole is unquestionably superior is if you are on a network that redirects all DNS requests there are still some ISPs that do that however if you are on such network you probably want to either get off it ASAP or use a VPN.
yalogin 6y ago
I have never used this but how does it block ads on https pages? Or am I misunderstanding pi-hole?
- snazz 6y ago
  Browsing sites served over HTTPS still requires querying a DNS server to figure out what IP address to connect to. Pi-hole acts as a DNS server and returns invalid results when asked for the IP of a blocked site. Ads are served from a separate domain from content, so they can be blocked without affecting the content.
  - yalogin 6y ago
    Oh great point. Thanks for the explanation.
jftuga 6y ago
Pi-hole on Apple Watch - just ran up a quick proof of concept. Would there be any use/interest in this? https://www.reddit.com/r/pihole/comments/gathus/pihole_on_apple_watch_just_ran_up_a_quick_proof/ https://www.reddit.com/r/pihole/comments/gathus/pihole_on_ap...
- herman_toothrot 6y ago
  I don't know, but I do wish it could be run directly on my router
  - toomuchtodo 6y ago
    Docker container?
- surround 6y ago
  That’s pretty neat! Do you plan on open sourcing it? I’m hesitant to trust an application with my pi-hole api token (and with it, all of my browsing/network data).
  - jftuga 6y ago
    It's not my project. I am using it from within Test Flight. It is great for non-technical people who just need to temporarily disable Pi-Hole in order to get some sort of functionality to work that wouldn't otherwise. One idea that I want to explore is to create an Alexa Skill to temporarily disable Pi-Hole. This has probably been done already.
    - jlgaddis 6y ago
      I don't have a link handy but someone mentioned in an HN comment a few days ago that they created a "shortcut" on iOS that simply hits the Pi-hole URL to temporarily disable blocking. Seemed like a great way to handle that problem -- especially for the non-technical people on your network.
tryptophan 6y ago
My pihole blocks about 20% of queries. I have noticed literally 0 changes in my internet or computer using experience since installing it. It's baffling how much useless telemetry and other crap there is, slowing internet down and wasting cpu cycles.
- HumblyTossed 6y ago
  And battery on mobile/laptop.
- Tepix 6y ago
  There's one thing i noticed: When I click on a twitter link, the first request goes via twitter analytics and gets blocked. I have to click it again, the second time it doesn't go to twitter analytics and the request goes through.
jonahx 6y ago
I get a "This connection is not private warning" when trying to read this.
- phs318u 6y ago
  Me too. Ironic. Not sure what that page holds but you can find out all about Pi-hole here: https://github.com/pi-hole/pi-hole https://github.com/pi-hole/pi-hole
- surround 6y ago
  https://web.archive.org/web/20200510233013/https://pi-hole.net/2020/05/10/pi-hole-v5-0-is-here/ https://web.archive.org/web/20200510233013/https://pi-hole.n...
senectus1 6y ago
haha, just got around to setting up my pi-hole again this weekend... I was wondering why it didn't install 5.0 Just jumped onto it and kicked off a "pihole -up" and off it goes upgrading beautifully. pihole is a massively underrated project.
gclawes 6y ago
Is the cert on pi-hole.net broken for anyone else? It's returning a cert for CN = *.sucuri.net
- Havoc 6y ago
  Yeah
  - gclawes 6y ago
    HN hug of death maybe.
- aftbit 6y ago
  I get SSL_ERROR_BAD_CERT_DOMAIN - Websites prove their identity via certificates. Firefox does not trust this site because it uses a certificate that is not valid for pi-hole.net. The certificate is only valid for the following names: *.sucuri.net, sucuri.net
- surround 6y ago
  Snapshot: https://web.archive.org/web/20200510233013/https://pi-hole.net/2020/05/10/pi-hole-v5-0-is-here/ https://web.archive.org/web/20200510233013/https://pi-hole.n... Side note: it was working for me about an hour ago, but not anymore
- laveur 6y ago
  Yup
deleted 6y ago
[deleted]
pragmatic 6y ago
Ok, I give, what is a "gravity database"?
- asadhaider 6y ago
  Pi-Hole maintains a gravity list (list of domains to block), which is constructed from all the block lists to which you subscribe (public lists), along with your whitelist. [0] [0] https://discourse.pi-hole.net/t/does-pi-hole-keep-the-lists-updated/13224/2 https://discourse.pi-hole.net/t/does-pi-hole-keep-the-lists-...
ryankrage77 6y ago
> Much more efficient memory use. This is more impressive than it sounds. My pihole currently uses about 25MB of RAM with over half a million blocked domains and around 20 clients.
- swaits 6y ago
  I'm curious what lists you're using that gets you to 500k blocked domains?
  - llacb47 6y ago
    That's nothing... I have 2 million.
  - StavrosK 6y ago
    They decided to go with a whitelist approach.
  - escuier 6y ago
    https://dbl.oisd.nl https://dbl.oisd.nl has about a million. Using it with minimal whitelisting for about a year, works fine
lonelappde 6y ago
I set up pihole on docker on Windows and it worked great until I rebooted and then the pihoke server (both ports 53 and 80) was unreachable from outside docker even though docker claimed to be forwarding the ports. So I switched to AdGuard DNS on my devices.
- aembleton 6y ago
  Had the container started up?
x3blah 6y ago
"Javascript is required. Please enable javascript before you are allowed to see this page." Required to read the text of the announcement. No. Required to make donations via Stripe. Yes. RSS does not require Javascript. Looks like the full text announcement. https://pi-hole.net/feed/ https://pi-hole.net/feed/ Alternatively: echo 159.203.180.3 pi-hole.net >> /etc/hosts
- x3blah 6y ago
  Looks like they fixed the issue. The above is no longer needed to avoid the Sucuri interstitial page.
hendry 6y ago
Docker image broke for sometime back and its one of the projects that doesn't fix bugs before implementing new features: https://github.com/pi-hole/docker-pi-hole/issues/559 https://github.com/pi-hole/docker-pi-hole/issues/559 Good luck guys!
cgranier 6y ago
So, what's the easiest way to install this on a Comcast household network?
- muzakthings 6y ago
  I have Comcast. I did it with this guide: https://willdrevo.com/blocking-ads-with-pihole-mac-os-x-iphone-raspberry-pi/ https://willdrevo.com/blocking-ads-with-pihole-mac-os-x-ipho...
  - cgranier 6y ago
    Thanks. I'll take a look at it.
whalesalad 6y ago
Just did a `pihole -up` from 4.x and it went off without a hitch. Love the UX of the entire Pihole stack!
fulafel 6y ago
PSA: A RPi running Pi-hole is not a fire-and-forget item. The networked software on it, including pi-hole, sometimes has security holes discovered and exploited, and has to be kept up to date. See eg https://natedotred.wordpress.com/2020/03/28/cve-2020-8816-pi-hole-remote-code-execution/ https://natedotred.wordpress.com/2020/03/28/cve-2020-8816-pi... & https://www.reddit.com/r/pihole/comments/73tvdq/cve201714491_dnsmasq_vulnerability_and_pihole/ https://www.reddit.com/r/pihole/comments/73tvdq/cve201714491... & https://www.cvedetails.com/vulnerability-list.php?vendor_id=8351&product_id=14557&version_id=0&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&cweid=0&order=1&trc=16&sha=c1974d4b960eaac58e9ed44d9ad3a1136cbe3411 https://www.cvedetails.com/vulnerability-list.php?vendor_id=... (afaik Pi-hole is built on dnsmasq)
- Doxin 6y ago
  Setting up automatic updates is probably a good idea.
  - willyyr 6y ago
    Can you recommend a good way to make sure the Pi and Pi-hole are always up to date? I imagine a simple cron with pihole -up is not sufficient?
    - marsokod 6y ago
      The default way would be to install the package unattendedupgrade which will install security updates on your system every day. Depending on how pihole is installed, this may not upgrade it. I personally have it installed with docker and uses watchtower for updates, but the risk with this mechanism is that it can break things.
    - apexalpha 6y ago
      I've set a cron job on the raspberry pi at my parents' house. It's a debian based system with only PiHole running so I just pihole -up and apt update && upgrade every month or so.
aetherspawn 6y ago
I just realised that if your router runs OpenWrt, you can install PiHole (an equivalent of, rather) directly onto your router by installing the following packages [1] dnsmasq adblock luci-app-adblock You may also need libustream-mbedtls Just tried it, works great. With a few small lists, the amount of blocked DNS requests is floating at around 30%. [1]: https://openwrt.org/docs/guide-user/services/ad-blocking https://openwrt.org/docs/guide-user/services/ad-blocking
- theandrewbailey 6y ago
  I remember seeing those packages, and wondered how effective they were.
- deleted 6y ago
  [deleted]
- netsec1337 6y ago
  https://command.honestsec.com https://command.honestsec.com sounds promising... looks like the system includes a secure router with secured double layer dns filtering (local at source and upstream resolver).
Max_aaa 6y ago
I run my pihole within LXD on my home server, found it much easier than to maintain another device. Also much more responsive.
fomine3 6y ago
I prefer blocking ads by browser extension for PC/iOS and device local MiTM solution (like AdGuard) for Android because these solutions can block more precisely and easier to unblock things permanently or temporary, compared to DNS server solution like Pi-hole or NextDNS. Why choose DNS solution? I suspect the reasons are maybe like for lower resource usage (especially for smartphones), works for smart device like TV.
- matt-attack 6y ago
  Content Blockers only work in Safari. There are a host of other apps that I use that are susceptible to ads and tracking. (e.g. Apple News, Apollo (reddit app), hacker news apps, etc. )
  - jereees 6y ago
    MiTM solutions work for other apps too.
- technovader 6y ago
  There's a chrome extension where you can disable the ad-blocking on Pihole temporarily.
  - porker 6y ago
    Not knowing how to disable it temporarily has been the one thing stopping me from adding Pihole to our network (need to test ads for clients sometimes...) so thank you.
jojo14 6y ago
Dear Pi-hole devs & maintainers: thank you very much !
pizza 6y ago
Does anyone know if pi-hole lets you see per-client bandwidth usage?
- technocratia 6y ago
  It's a DNS server so it has no way of knowing the bandwidth usage of the clients, the traffic is not flowing trough the pi-hole, it just responds to the DNS queries sent to it by the clients.
- dtparr 6y ago
  It can't. There pihole only sees your DNS requests, not any other traffic, so it can't tell if you pulled 100 KB or 100 GB from that domain you just looked up. It does show you DNS requests counts and such per device, but that's a poor proxy for bandwidth.
8589934591 6y ago
Can someone please explain how exactly does this work? So I have an ubuntu system. Is it ok to just install it in my local system alone and use it? Or should I be doing something to connect to a modem or something? I currently use my phone as the hotspot for my computer. If I install it say in a remote server in digital ocean, how can I use my phone/computer to use pi hole? Still a noob when it comes to networking so any help is appreciated thanks :)
- jve 6y ago
  Not an expert with PiHole other than having set-up one myself not so long ago. It is a DNS server. Basically whatever you put into DNS Server list on your device (some host on local network, some host with public IP) - your device will send DNS queries to THAT host. More often than not, you will configure your router to hand out your local devices these DNS servers via DHCP. So that answers the question: you can host it on local network or use remote server (given you have public IP and can open port 53/UDP). If you don't have firewall there, you will probably be configuring host local firewall to allow using DNS from hosts@home. It may get complicated if you have a dynamic address for your home router.
- StreamBright 6y ago
  You can install it on any device you want. Just make sure you point to it as your DNS server. My setup: 2x Raspberry Pi running Pi-hole 1x OpenWRT running DHCP DHCP answers with DNS servers rpi1 and rpi2 IP addresses. Does this make sense?
syphilis2 6y ago
I like Pi-hole, but pi@pihole:~ $ pihole -up [i] Checking for updates... [i] Pi-hole Core: up to date [i] Web Interface: up to date [i] FTL: up to date [] Everything is up to date! pi@pihole:~ $ pihole -v Pi-hole version is v4.4 (Latest: v5.0) AdminLTE version is v4.3.3 (Latest: v5.0) FTL version is v5.0 (Latest: v5.0)
- technovader 6y ago
  Were you on the beta? Try this pihole checkout master
  - syphilis2 6y ago
    Thanks for the suggestion, it's neat that pihole maintains a git repo like this. I didn't get a chance to try it out though, I just installed from scratch.
IntelMiner 6y ago
Cross-posting from my comment on Reddit's /r/Linux I'm a little disappointed that they seem to be very uninterested on how to get it working on "unsupported" configurations My x86 gateway currently runs on Gentoo (PFsense kept having random crashing issues) and it's something I'd love to add to it as far as I can tell all Pi-Hole needs is - Lighttpd + PHP (web management portal) - DNSMASq (DNS) - DHCPD (DHCP) - git (blocklist updates?) There was a single github issue tracker where someone got it working fairly easily (essentially saying "please install package X/Y/Z" during setup) which was closed by the developer as "only two people have asked about Gentoo" I know Gentoo is fairly niche as far as distributions go, but seeing popular software moving away from "here's how to compile/install it" to "here's a docker container/here's what "we" support" is very disheartening
- laumars 6y ago
  Pihole comes with some nice features but the core tool could be written in a single shell script (I know this because that’s exactly what I used to do for years before pi-hole even existed). At its core, all you really need is curl / wget to pull a few text files and then reload dnsmasq. Sure you’d miss out on the reporting side (which is actually the only reason I switched to pi-hole last year) but it would run on literally any system that runs Linux and dnsmasq. As for DHCP, I think pi-hole uses dnsmasq for that too. However I’ve wasnt able to get pi-hole to accept my custom DHCP rules for PXE boot images (saves me hunting for USB sticks if someone hands me a trashed system and it’s been invaluable over the years) so I’ve continued to run dhcpd separately from pi-hole. But you don’t even need to do that, all you really need is your existing DHCP server to accept custom DNS resolvers and any consumer router should let you do that. Just make sure you disable DHCP in pi-hole.
- encom 6y ago
  I've made this exact argument before, but it was unpopular. I maintain that if your software distrubution model is writing ISO files to SD cards, it's about as retarded as piping `curl` into `bash`. I too run a Gentoo server at home (fist bump), and I'm running `dnsmasq` for filtering and caching, and `stubby` for DNS-over-TLS, and I run this beauty of a cron job every morning: curl -s --compressed -o /var/lib/dnsmasq/hostnames.txt https://raw.githubusercontent.com/notracking/hosts-blocklists/master/{hostnames.txt,domains.txt} | sed -e '/::/d' -e 's/0.0.0.0//g' -e '/thepiratebay/d' > /var/lib/dnsmasq/domains.txt && rc-service dnsmasq restart
jacobush 6y ago
But don't new browsers and Android use their own DNS servers?!
- aembleton 6y ago
  Yes, but you can change them.
baicunko 6y ago
I've always planned on building a free DNS using pi-hole. Any comments on this? Will you use it? (I understand privacy is an issue, how to better address this?)
iRobbery 6y ago
Neat app, not using it though due to lack of quality control in the blocklists. Are there any changes yet to the quality control of the blocklists used, or is the author still copying lists from the internet without scrutiny?
windex 6y ago
Donated once to this fantastic project. I have it running on a VPS+wireguard+firewall and all devices configured to use it even when I am out and about and using the mobile. It performs well enough that all of my family is on it now as well. It's chugging along fine on a 3$ a month VPS and accessible only when logged in via wireguard. Wireguard is working so well, that I am now thinking of starting up additional services for the family to use. Voip/Filestore, pic library etc etc... all firewalled of course.
Tepix 6y ago
Looks good! Is anyone else getting this during the update? [i] Target: https://hosts-file.net/ad_servers.txt [] Status: Connection Refused [] List download failed: no cached list available Looking at the query log, I see a fairly large amount of requests 24/7 by my Xiaomi robot vacuum and my Xiaomi desk LED Desk Lamp. I've blocked both of them. Is there any way of disabling the wifi on the desk light completely? Right now i've connected the lamp to my Wifi and blocked it at the router to prevent it from starting its own WiFi network.
- move-on-by 6y ago
  That hosts server was shut down. They don’t maintain a blocklist anymore and removed it from the internet.
- surround 6y ago
  I’m not familiar with the desk lamp, but take a look at Valetudo for your vacuum. https://github.com/Hypfer/Valetudo https://github.com/Hypfer/Valetudo
rubidium 6y ago
Good place to ask: in addition to setting up pi-hole or https://nextdns.io/ https://nextdns.io/, what browser or device based blockers should be used? Anyone have the run down on Adblock plus Privacy badger UBlock origin Etc??
bni 6y ago
Does it support blocking YouTube ads yet? I mean the short video ads that interrupt the videos
- aembleton 6y ago
  No they come from the same domain as the video that you are trying to watch. If you want to block YouTube ads, then use uBlockOrigin.
  - ekko911 6y ago
    I though they had multiple domains instead for most ads? As seen here (however this is 4 years ago) - https://discourse.pi-hole.net/t/how-do-i-block-ads-on-youtube/253 https://discourse.pi-hole.net/t/how-do-i-block-ads-on-youtub... If this is still true, this pi hole update might solve those ads at least?
akerro 6y ago
Which docker image do I use on raspberry pi 1 B? None of them seems to work, all crash on step `[20] pihole exited 267.`
Havoc 6y ago
Per client blocking looking fab. ...I've got some sketchy IOTs that I've been meaning to lock down a little more.
drukenemo 6y ago
Literally 1/3 of my traffic is blocked by Pi-Hole as it's tracking/ad crap. That's impressive stuff!
liotier 6y ago
Is there any value in Pi-hole for people already running Unbound with a bunch of adblock blacklists ? With OPNsense, it is a three-click setup. Found one feature: per-client blocking. Anything else ?
- surround 6y ago
  I run Unbound alongside Pi-Hole. I’m not familiar with all the features of OPNsense, but pi-hole is convenient because it - automatically updates the block lists each week - supports regex filters - has a admin web interface which makes it easy to view statistics and filtering log, edit the whitelist/blacklist, etc.
  - liotier 6y ago
    Integration of Unbound in OPNsense has the basics - the web interface lets one edit access lists, blacklists etc. but no statistics dashboard or sophisticated log processing. It supports lists with regex though. Updating automatically requires a cron job, which has to be added by the administrator using the GUI - adding it automatically is a future feature.
formalsystem 6y ago
I had setup Pi-hole and it was blocking something like 66% of my internet traffic which amounted to ads and spyware. A couple of days later, it just mysteriously stopped working and I couldn't for the life of me figure out why. My theory is that AT&T detected my blocking and blocked my internet as a result. Is that too much of a tin foil hat theory? How can I know for sure? I don't know too much about computer networking, only the basics.
ThePowerOfFuet 6y ago
I have no connection to NextDNS other than as a very satisfied user, but my Pi-hole got decommissioned a few weeks ago as a result of my discovery of NextDNS. I also run their DNS53-to-DoH proxy on a small VM and that VM's IP is the first DNS server in the DNS server list included with DHCP leases (with NextDNS's public IPs as the second and third, losing host-level granularity/logging if the VM is down for whatever reason).

587 points by Iolaum 6y ago

Pi-Hole has made my home browsing experience so much better since setting it up. Minimal resource overhead, maximum results - and if you care about stats those are available too but I just turned all logging off. Now if it could just filter out YouTube ads...

xienze 6y ago
> Now if it could just filter out YouTube ads... Ive heard that the problem is that the native YT apps come with a big list of IP addresses for the ad servers, instead of doing lookups.
- dahfizz 6y ago
  If true, it would be pretty easy to grab those ip addresses from the binary and add them to a firewall. A firewall is a little more than what I would trust to a raspberry pie, though...
- kgwxd 6y ago
  I thought it was streaming the ads right along with the main content making it impossible to block.
disiplus 6y ago
> vanced.app
- nobodyshere 6y ago
  I'd rather recommend this one: https://newpipe.schabi.org/ https://newpipe.schabi.org/ At least it is opensource and works great.
  - disiplus 6y ago
    it broke down for me after 10min of use. no amount of reinstall or cleaning cache helped.
    - agumonkey 6y ago
      it has frail feet but it does work more often than not
      - the_pwner224 6y ago
        Interestingly it's been working perfectly for me with no issues for almost 1 year. A bit surprised to learn that it is not stable for a bunch of people.
        agumonkey 6y ago
        Well I think it's just a matter of lag between bugfix and updates on my side. Which means from time to time I get a guru error. Other than that it's quite stable.
    - KCUOJJQJ 6y ago
      Maybe coincidentally after the 10 minutes YouTube changed something? Once or twice NewPipe stopped working for me suddenly but an update helped. BTW F-Droid gets updates of NewPipe a bit later than GitHub it seems.
  - j1elo 6y ago
    I used NewPipe for a while and it was very nice, enjoyed how well it works. However I started wanting to see videos on my TV (Chromecast), and that's where the abilities of NewPipe fell short. They have an open issue [0] since a couple years ago, but so far it is not a feature yet. [0]: https://github.com/TeamNewPipe/NewPipe/issues/668 https://github.com/TeamNewPipe/NewPipe/issues/668
    - dastx 6y ago
- j1elo 6y ago
  They very recently moved to require an special additional app just for installing their new .apks file (which is a file containing multiple .apk inside), called SAI. That would be fine by me, if it wasn't because SAI requires Android 5.0, while my Nvidia Tegra -like tablet (Xiaomi MiPad 1) is stuck on Android 4.4 :-( (no, Lineage and friends is not a good replacement, they all break the camera, and yet worse, suck battery like crazy)
tfehring 6y ago
AdGuard DNS works well for YouTube ads IME. https://adguard.com/en/adguard-dns/overview.html https://adguard.com/en/adguard-dns/overview.html
- surround 6y ago
  I’m pretty sure that the on-device app blocks youtube ads, not the DNS filtering. Although I think it is indeed possible to block youtube ads through DNS filtering, it’s just really difficult & only works temporarily before needing to block new domains.
  - tfehring 6y ago
    I actually looked into this a bit after posting that comment, since it occurred to me that I don't actually know exactly what's blocking YouTube ads for me. (I'm still not sure, which is why I didn't edit my previous comment after doing that research.) Empirically, I don't get YouTube ads in the iOS app. I do use Firefox Focus as a content blocker, in addition to AdGuard DNS. I don't use the AdGuard app, and it was my understanding that Firefox Focus only blocked ads in Safari, so I assumed it was AdGuard DNS. The documentation for AdGuard DNS seems to indicate that it shouldn't work for this, but it seems like either that documentation or the documentation for iOS content blockers is missing something. Unless YouTube has just decided not to serve me ads for some reason. (I'm not complaining either way.)
kgwxd 6y ago
If you're on Android, you can use the YT site instead of the app and Firefox with uBlock Origin will block the ads.
askvictor 6y ago
I had something working a while ago for YT ad blocking in chromecast; the underlying problem there is that the chromecast is hard-coded to use Google's DNS servers (8.8.8.8, etc) instead of your networks. So you need to set up your network to intercept DNS requests to 8.8.8.8 and 8.8.4.4 and instead send these to your own ad-blocked DNS server. My network setup no longer lets me do this, and I don't care enough to make it work. Just pay for YT premium if you don't want ads (to all those people complaining about wanting an option to pay and not be tracked/advertised to/etc - this is a great opporunity to put your money where your mouth is)
- slau 6y ago
  Just don’t allow outbound DNS except from your pihole, and the Chromecast will use whatever DNS server you give it. Also, make sure to block UDP and TCP on port 53, as well as UDP on port 443 (Chrome snitching).
  - askvictor 6y ago
    I imagine at some point, Chromecast will start using DNS-over-HTTPS and move the goalposts elsewhere.

surround 6y ago

Pi-hole is very easy to set up, and it works so well you can basically forget about it from that point on. Blocking ads is nice, but it’s also a huge boon for privacy. I run uBlock origin on all my browsers, but Pi-hole still blocks 30-50% of requests on my network. It’s also really nice to be able to glance at the logs and get an idea of what’s going on on your network, or if there’s any unusual activity. I’m especially excited to see CNAME inspection. I was tired of trying to figure out what domains like “xuenl4v1szy8g.cloudfront.net” were doing.

ciarannolan 6y ago
>I’m especially excited to see CNAME inspection. I was tired of trying to figure out what domains like “xuenl4v1szy8g.cloudfront.net” were doing. Is there a good explainer for CNAME inspection? I'm not finding anything good with my Google Fu.
- deleted 6y ago
  [deleted]
- dastx 6y ago
  Some ad agencies starting asking hosters to add a CNAME record to one of their domains. Let's say I have your own blog running on dastx.me, and I wanted some ads from adgiant.com. As an adblocker you've added `* .adgiant.com` to your blacklist and I'm an asshole and try to circumvent such adblocking measure. Them young millennials and their tech. Stealing me out of my money! So I go to adgiant.com and ask them if there is something i can do. adgiant.com asks me to add a new DNS record of `CNAME definitely-not-an-ad-subdomain.dastx.me -> terribleads.adgiant.com`. This way, whenever I wanna call terrible-ads.adgiant.com, I instead use `definitely-not-an-ad-subdomain.dastx.me`. When it comes to adblocking this is an issue because adblocking lists are usually based on a blacklist. They'll have `*.adgiant.com` on the list but not `definitely-not-an-ad-subdomain.dastx.me`, thus my ads will start working. We could of course ad every subdomain we come across to the blacklist, but suddenly our adblock list doubles, triples, quadruples or more. What adblocking software do now, is they do a dns lookup for every domain, and consider all domains in the result as the same. So if either of previous domains are in the block list, both domains are considered blocked. This CNAME method is also a huge security issue, but I'm not gonna go into that.

disiplus 6y ago

does anybody know how to properly secure the the DNS server from replay attacks with iptables. i have a pihone running on a cheap vps on internet, but i connect to it with a vpn and that's draining my smartphone battery. i want to be able to change only the dns settings and point to my pi-hole. but at that time the recommendation was to not run the dns part on the internet because it could be used for dns replay attacks. i found some iptables rules on the net at time but was not sure are they ok. i did not want the ip address blacklisted because i was running some other services on that server.

surround 6y ago
The official documentation includes a tutorial on how to use pi-hole with OpenVPN. This section describes how to use the VPN for only DNS requests: https://docs.pi-hole.net/guides/vpn/only-dns-via-vpn/ https://docs.pi-hole.net/guides/vpn/only-dns-via-vpn/ A Wireguard setup would probably be even less resource intensive if you know how to set it up (there’s no official tutorial for Wireguard). Do not open your pi to the internet, I doubt the iptables rules would be sufficient to protect it.
- ignoramous 6y ago
  > ...there’s no official tutorial for Wireguard To run a split wireguard-tunnel to a DNS server, add its IP to the allowed-IPs list: https://www.reddit.com/r/WireGuard/comments/bqccdz/split_tunnel_for_only_dns_possible/ https://www.reddit.com/r/WireGuard/comments/bqccdz/split_tun... If you're on an Android phone, apps like Blokada (plain old DNS), Nebulo (DoH and DoT), Intra (DoH) can split tunnel traffic to a DNS server of your choice. Note that, Android 9+ supports DoT, out of the box. Look for the Private DNS setting.
neurostimulant 6y ago
I have migrated wireguard since several months ago and the battery life improvements is tremendous compared to openvpn. Previously I can't enable vpn 24/7 as my phone's battery will be drained before the end of the day, but now with wireguard I can enable it all day without draining the battery too much.

ycombonator 6y ago

I host pihole on Digital Ocean. Updated DNS on all my home clients. Smooth and adfree

nobodyshere 6y ago
I do it on a PoE powered raspberry pi. Minimal effort, zero maintenance, no fees other than the initial purchase.
- hbcondo714 6y ago
  Do you use a PoE switch for this?
  - rand49an 6y ago
    Either a switch or an injector.
  - nobodyshere 6y ago
    I use a ubiquiti switch. I've decided to build my network with PoE in mind and one central location to power it all, backed up by a UPS.
- c0nsumer 6y ago
  I do this too. After throwing around a bunch of other ideas, I realized that a Pi is cheap enough and the one-shot cost is nice. If it dies, I just update the MAC address for its DHCP reservation to the new pi, spend 10 minutes setting up a new instance, and that's that. It just ends up working.
  - yjftsjthsd-h 6y ago
    The dream is to network boot the thing, so you literally plug a new pi in to network+power and it automatically boots and starts running stuff:) (Well, a Pi also needs a 1-time step to enable network boot, but still)

A4ET8a8uTh0 6y ago

Per client blocking is clearly the biggest change. I am excited about this.

barney54 6y ago
What is the use case of per client blocking?
- beervirus 6y ago
  Blocking Facebook stuff on every device except my wife’s phone.
  - Spivak 6y ago
    Why not just tell your DHCP server to give her the regular DNS servers? Is this situation where she wants ad blocking but still wants to use FB?
    - beervirus 6y ago
      Yeah, ad blocking in general is what makes the web tolerable.
    - slau 6y ago
      Not OP, but in my case, most of my VLANs can’t perform DNS requests to WAN. Only the pi.hole server is able to do that (and other devices in the DMZ). Reasoning: appliances like Chromecast/Apple TV/whatever will often ignore DHCP DNS settings if it doesn’t resolve, and they’ll reach out to 8.8.8.8/8.8.4.4 directly.
- A4ET8a8uTh0 6y ago
  I have several users and multiple devices in our household. FB is not allowed anywhere near my PC, but wife has to currently switch between piholed and not piholed wifi. It just allows for a much better control. Heavens know not everyone is like me.
- 6y ago

j1elo 6y ago

Server is down, right? Not for this case (which I assume is caused by the HN effect) but one downside of this kind of blockers (I also use uBlock in the browser) is that when something doesn't work well in a website, I'm never confident that it's because the site is broken and not because my blockers are breaking it :-) I know, you can just disable the blocker and try again, but doing so from my phone is not very convenient...

popotamonga 6y ago

When i uninstalled it broke my linux dns, keeps getting changed to localhost automatically. And om not expert enough on linux to fix it.

foob4r 6y ago

Woohoo been waiting for this for months. I host pihole on a home server in a docker container and spend 5 mins a month just updating it. No other administration. Definitely use it to get rid of trackers and ads. (I should add that I also pay for about dozen publications/newspapers that I read frequently in lieu of not seeing ads)

asadhaider 6y ago
Look at Watchtower [0] to keep your containers up to date automatically. [0] https://containrrr.github.io/watchtower/ https://containrrr.github.io/watchtower/

xref 6y ago

Is there a way to quickly disable/re-enable pihole for the network? With AdGuard DNS or uBlock Origin I still get into situations where occasionally they break a site completely and I have to temporarily disable the plugin (or switch to cell tower dns) to get the site working, so I’d want a quick way out of pi-holing traffic as well

city41 6y ago
You can navigate to the admin console (easily done on any machine on your network) and disable it for a certain amount of time very easily https://i.imgur.com/K6VgV2G.png https://i.imgur.com/K6VgV2G.png Note this is from pihole 4.3, but I can't image 5 would remove this feature.
kylegordon 6y ago
The Web UI has a Disable button, and also quick options for permanent, 10 seconds, 30 seconds, 5 minutes, custom, etc. I think there's also an API as well. I can toggle it via Alexa and Home-Assistant. It's a feature that's been around for 2 years or more
- xref 6y ago
  “Alexa, shut pihole” Thanks for the tip, I don’t have any home assistants but this would be the first integration I’d set up
- domoritz 6y ago
  I just noticed that the home assistant addon has been deprecated: https://github.com/hassio-addons/addon-pi-hole https://github.com/hassio-addons/addon-pi-hole. I hope that it comes back eventually.
  - GekkePrutser 6y ago
    They recommend the AdGuard Home one now... That's why they have replaced it. I also don't like it as AdGuard is a commercial company, and I have zero need for the added features like parental control. But I don't really care, I run all the dockers that have nothing to do with home assistant outside of hassio anyway.

iou 6y ago

Alternatively for MAX_lazyness and convenience I've been using https://nextdns.io https://nextdns.io, does all the same stuff and is the alternative to cloudflare in Firefox for DNS-over-Https (DOH)

ciarannolan 6y ago
Is there an advantage in sending all of your DNS queries to a for-profit company vs. setting up your own Pi-hole? Their privacy policy seems legit[0] but why trust them at all when Pi-hole is an option? [0] https://nextdns.io/privacy https://nextdns.io/privacy
- jzig 6y ago
  max laziness and convenience ;)
  - iou 6y ago
    ^^ this though they do also have some additional security protections for typosquatting, safebrowsing, homoglyphs, threat-intelligence which is also nice. All of which could be done on a pihole though not out of the box when I last used it ~2 years ago.
- dastx 6y ago
  Also, unless you go through the trouble of setting up unbound, your requests would need to go to an upstream server anyway, so might as well send them to one with the best privacy policy.
- dogma1138 6y ago
  No additional hardware required, you can use it to provide some protection to your family without having to worry about remote access to the Pi-Hole to configure things, works for your devices on the go, cheaper than running pi-hole in the cloud yourself unless. Pricing wise it’s over 2 years worth of service for the price of an original Pi, a good SD card and a case. The only circumstances where Pi Hole is unquestionably superior is if you are on a network that redirects all DNS requests there are still some ISPs that do that however if you are on such network you probably want to either get off it ASAP or use a VPN.

yalogin 6y ago

I have never used this but how does it block ads on https pages? Or am I misunderstanding pi-hole?

snazz 6y ago
Browsing sites served over HTTPS still requires querying a DNS server to figure out what IP address to connect to. Pi-hole acts as a DNS server and returns invalid results when asked for the IP of a blocked site. Ads are served from a separate domain from content, so they can be blocked without affecting the content.
- yalogin 6y ago
  Oh great point. Thanks for the explanation.

jftuga 6y ago

Pi-hole on Apple Watch - just ran up a quick proof of concept. Would there be any use/interest in this? https://www.reddit.com/r/pihole/comments/gathus/pihole_on_apple_watch_just_ran_up_a_quick_proof/ https://www.reddit.com/r/pihole/comments/gathus/pihole_on_ap...

herman_toothrot 6y ago
I don't know, but I do wish it could be run directly on my router
- toomuchtodo 6y ago
  Docker container?
surround 6y ago
That’s pretty neat! Do you plan on open sourcing it? I’m hesitant to trust an application with my pi-hole api token (and with it, all of my browsing/network data).
- jftuga 6y ago
  It's not my project. I am using it from within Test Flight. It is great for non-technical people who just need to temporarily disable Pi-Hole in order to get some sort of functionality to work that wouldn't otherwise. One idea that I want to explore is to create an Alexa Skill to temporarily disable Pi-Hole. This has probably been done already.
  - jlgaddis 6y ago
    I don't have a link handy but someone mentioned in an HN comment a few days ago that they created a "shortcut" on iOS that simply hits the Pi-hole URL to temporarily disable blocking. Seemed like a great way to handle that problem -- especially for the non-technical people on your network.

tryptophan 6y ago

My pihole blocks about 20% of queries. I have noticed literally 0 changes in my internet or computer using experience since installing it. It's baffling how much useless telemetry and other crap there is, slowing internet down and wasting cpu cycles.

HumblyTossed 6y ago
And battery on mobile/laptop.
Tepix 6y ago
There's one thing i noticed: When I click on a twitter link, the first request goes via twitter analytics and gets blocked. I have to click it again, the second time it doesn't go to twitter analytics and the request goes through.

jonahx 6y ago

I get a "This connection is not private warning" when trying to read this.

phs318u 6y ago
Me too. Ironic. Not sure what that page holds but you can find out all about Pi-hole here: https://github.com/pi-hole/pi-hole https://github.com/pi-hole/pi-hole
surround 6y ago
https://web.archive.org/web/20200510233013/https://pi-hole.net/2020/05/10/pi-hole-v5-0-is-here/ https://web.archive.org/web/20200510233013/https://pi-hole.n...

senectus1 6y ago

haha, just got around to setting up my pi-hole again this weekend... I was wondering why it didn't install 5.0 Just jumped onto it and kicked off a "pihole -up" and off it goes upgrading beautifully. pihole is a massively underrated project.

gclawes 6y ago

Is the cert on pi-hole.net broken for anyone else? It's returning a cert for CN = *.sucuri.net

Havoc 6y ago
Yeah
- gclawes 6y ago
  HN hug of death maybe.
aftbit 6y ago
I get SSL_ERROR_BAD_CERT_DOMAIN - Websites prove their identity via certificates. Firefox does not trust this site because it uses a certificate that is not valid for pi-hole.net. The certificate is only valid for the following names: *.sucuri.net, sucuri.net
surround 6y ago
Snapshot: https://web.archive.org/web/20200510233013/https://pi-hole.net/2020/05/10/pi-hole-v5-0-is-here/ https://web.archive.org/web/20200510233013/https://pi-hole.n... Side note: it was working for me about an hour ago, but not anymore
laveur 6y ago
Yup

deleted 6y ago

[deleted]

pragmatic 6y ago

Ok, I give, what is a "gravity database"?

asadhaider 6y ago
Pi-Hole maintains a gravity list (list of domains to block), which is constructed from all the block lists to which you subscribe (public lists), along with your whitelist. [0] [0] https://discourse.pi-hole.net/t/does-pi-hole-keep-the-lists-updated/13224/2 https://discourse.pi-hole.net/t/does-pi-hole-keep-the-lists-...

ryankrage77 6y ago

> Much more efficient memory use. This is more impressive than it sounds. My pihole currently uses about 25MB of RAM with over half a million blocked domains and around 20 clients.

swaits 6y ago
I'm curious what lists you're using that gets you to 500k blocked domains?
- llacb47 6y ago
  That's nothing... I have 2 million.
- StavrosK 6y ago
  They decided to go with a whitelist approach.
- escuier 6y ago
  https://dbl.oisd.nl https://dbl.oisd.nl has about a million. Using it with minimal whitelisting for about a year, works fine

lonelappde 6y ago

I set up pihole on docker on Windows and it worked great until I rebooted and then the pihoke server (both ports 53 and 80) was unreachable from outside docker even though docker claimed to be forwarding the ports. So I switched to AdGuard DNS on my devices.

aembleton 6y ago
Had the container started up?

x3blah 6y ago

"Javascript is required. Please enable javascript before you are allowed to see this page." Required to read the text of the announcement. No. Required to make donations via Stripe. Yes. RSS does not require Javascript. Looks like the full text announcement. https://pi-hole.net/feed/ https://pi-hole.net/feed/ Alternatively: echo 159.203.180.3 pi-hole.net >> /etc/hosts

x3blah 6y ago
Looks like they fixed the issue. The above is no longer needed to avoid the Sucuri interstitial page.

hendry 6y ago

Docker image broke for sometime back and its one of the projects that doesn't fix bugs before implementing new features: https://github.com/pi-hole/docker-pi-hole/issues/559 https://github.com/pi-hole/docker-pi-hole/issues/559 Good luck guys!

cgranier 6y ago

So, what's the easiest way to install this on a Comcast household network?

muzakthings 6y ago
I have Comcast. I did it with this guide: https://willdrevo.com/blocking-ads-with-pihole-mac-os-x-iphone-raspberry-pi/ https://willdrevo.com/blocking-ads-with-pihole-mac-os-x-ipho...
- cgranier 6y ago
  Thanks. I'll take a look at it.

whalesalad 6y ago

Just did a `pihole -up` from 4.x and it went off without a hitch. Love the UX of the entire Pihole stack!

fulafel 6y ago

PSA: A RPi running Pi-hole is not a fire-and-forget item. The networked software on it, including pi-hole, sometimes has security holes discovered and exploited, and has to be kept up to date. See eg https://natedotred.wordpress.com/2020/03/28/cve-2020-8816-pi-hole-remote-code-execution/ https://natedotred.wordpress.com/2020/03/28/cve-2020-8816-pi... & https://www.reddit.com/r/pihole/comments/73tvdq/cve201714491_dnsmasq_vulnerability_and_pihole/ https://www.reddit.com/r/pihole/comments/73tvdq/cve201714491... & https://www.cvedetails.com/vulnerability-list.php?vendor_id=8351&product_id=14557&version_id=0&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&cweid=0&order=1&trc=16&sha=c1974d4b960eaac58e9ed44d9ad3a1136cbe3411 https://www.cvedetails.com/vulnerability-list.php?vendor_id=... (afaik Pi-hole is built on dnsmasq)

Doxin 6y ago
Setting up automatic updates is probably a good idea.
- willyyr 6y ago
  Can you recommend a good way to make sure the Pi and Pi-hole are always up to date? I imagine a simple cron with pihole -up is not sufficient?
  - marsokod 6y ago
    The default way would be to install the package unattendedupgrade which will install security updates on your system every day. Depending on how pihole is installed, this may not upgrade it. I personally have it installed with docker and uses watchtower for updates, but the risk with this mechanism is that it can break things.
  - apexalpha 6y ago
    I've set a cron job on the raspberry pi at my parents' house. It's a debian based system with only PiHole running so I just pihole -up and apt update && upgrade every month or so.

aetherspawn 6y ago

I just realised that if your router runs OpenWrt, you can install PiHole (an equivalent of, rather) directly onto your router by installing the following packages [1] dnsmasq adblock luci-app-adblock You may also need libustream-mbedtls Just tried it, works great. With a few small lists, the amount of blocked DNS requests is floating at around 30%. [1]: https://openwrt.org/docs/guide-user/services/ad-blocking https://openwrt.org/docs/guide-user/services/ad-blocking

theandrewbailey 6y ago
I remember seeing those packages, and wondered how effective they were.
deleted 6y ago
[deleted]
netsec1337 6y ago
https://command.honestsec.com https://command.honestsec.com sounds promising... looks like the system includes a secure router with secured double layer dns filtering (local at source and upstream resolver).

Max_aaa 6y ago

I run my pihole within LXD on my home server, found it much easier than to maintain another device. Also much more responsive.

fomine3 6y ago

I prefer blocking ads by browser extension for PC/iOS and device local MiTM solution (like AdGuard) for Android because these solutions can block more precisely and easier to unblock things permanently or temporary, compared to DNS server solution like Pi-hole or NextDNS. Why choose DNS solution? I suspect the reasons are maybe like for lower resource usage (especially for smartphones), works for smart device like TV.

matt-attack 6y ago
Content Blockers only work in Safari. There are a host of other apps that I use that are susceptible to ads and tracking. (e.g. Apple News, Apollo (reddit app), hacker news apps, etc. )
- jereees 6y ago
  MiTM solutions work for other apps too.
technovader 6y ago
There's a chrome extension where you can disable the ad-blocking on Pihole temporarily.
- porker 6y ago
  Not knowing how to disable it temporarily has been the one thing stopping me from adding Pihole to our network (need to test ads for clients sometimes...) so thank you.

jojo14 6y ago

Dear Pi-hole devs & maintainers: thank you very much !

pizza 6y ago

Does anyone know if pi-hole lets you see per-client bandwidth usage?

technocratia 6y ago
It's a DNS server so it has no way of knowing the bandwidth usage of the clients, the traffic is not flowing trough the pi-hole, it just responds to the DNS queries sent to it by the clients.
dtparr 6y ago
It can't. There pihole only sees your DNS requests, not any other traffic, so it can't tell if you pulled 100 KB or 100 GB from that domain you just looked up. It does show you DNS requests counts and such per device, but that's a poor proxy for bandwidth.

8589934591 6y ago

Can someone please explain how exactly does this work? So I have an ubuntu system. Is it ok to just install it in my local system alone and use it? Or should I be doing something to connect to a modem or something? I currently use my phone as the hotspot for my computer. If I install it say in a remote server in digital ocean, how can I use my phone/computer to use pi hole? Still a noob when it comes to networking so any help is appreciated thanks :)

jve 6y ago
Not an expert with PiHole other than having set-up one myself not so long ago. It is a DNS server. Basically whatever you put into DNS Server list on your device (some host on local network, some host with public IP) - your device will send DNS queries to THAT host. More often than not, you will configure your router to hand out your local devices these DNS servers via DHCP. So that answers the question: you can host it on local network or use remote server (given you have public IP and can open port 53/UDP). If you don't have firewall there, you will probably be configuring host local firewall to allow using DNS from hosts@home. It may get complicated if you have a dynamic address for your home router.
StreamBright 6y ago
You can install it on any device you want. Just make sure you point to it as your DNS server. My setup: 2x Raspberry Pi running Pi-hole 1x OpenWRT running DHCP DHCP answers with DNS servers rpi1 and rpi2 IP addresses. Does this make sense?

syphilis2 6y ago

I like Pi-hole, but pi@pihole:~ $ pihole -up [i] Checking for updates... [i] Pi-hole Core: up to date [i] Web Interface: up to date [i] FTL: up to date [] Everything is up to date! pi@pihole:~ $ pihole -v Pi-hole version is v4.4 (Latest: v5.0) AdminLTE version is v4.3.3 (Latest: v5.0) FTL version is v5.0 (Latest: v5.0)

technovader 6y ago
Were you on the beta? Try this pihole checkout master
- syphilis2 6y ago
  Thanks for the suggestion, it's neat that pihole maintains a git repo like this. I didn't get a chance to try it out though, I just installed from scratch.

IntelMiner 6y ago

Cross-posting from my comment on Reddit's /r/Linux I'm a little disappointed that they seem to be very uninterested on how to get it working on "unsupported" configurations My x86 gateway currently runs on Gentoo (PFsense kept having random crashing issues) and it's something I'd love to add to it as far as I can tell all Pi-Hole needs is - Lighttpd + PHP (web management portal) - DNSMASq (DNS) - DHCPD (DHCP) - git (blocklist updates?) There was a single github issue tracker where someone got it working fairly easily (essentially saying "please install package X/Y/Z" during setup) which was closed by the developer as "only two people have asked about Gentoo" I know Gentoo is fairly niche as far as distributions go, but seeing popular software moving away from "here's how to compile/install it" to "here's a docker container/here's what "we" support" is very disheartening

laumars 6y ago
Pihole comes with some nice features but the core tool could be written in a single shell script (I know this because that’s exactly what I used to do for years before pi-hole even existed). At its core, all you really need is curl / wget to pull a few text files and then reload dnsmasq. Sure you’d miss out on the reporting side (which is actually the only reason I switched to pi-hole last year) but it would run on literally any system that runs Linux and dnsmasq. As for DHCP, I think pi-hole uses dnsmasq for that too. However I’ve wasnt able to get pi-hole to accept my custom DHCP rules for PXE boot images (saves me hunting for USB sticks if someone hands me a trashed system and it’s been invaluable over the years) so I’ve continued to run dhcpd separately from pi-hole. But you don’t even need to do that, all you really need is your existing DHCP server to accept custom DNS resolvers and any consumer router should let you do that. Just make sure you disable DHCP in pi-hole.
encom 6y ago
I've made this exact argument before, but it was unpopular. I maintain that if your software distrubution model is writing ISO files to SD cards, it's about as retarded as piping `curl` into `bash`. I too run a Gentoo server at home (fist bump), and I'm running `dnsmasq` for filtering and caching, and `stubby` for DNS-over-TLS, and I run this beauty of a cron job every morning: curl -s --compressed -o /var/lib/dnsmasq/hostnames.txt https://raw.githubusercontent.com/notracking/hosts-blocklists/master/{hostnames.txt,domains.txt} | sed -e '/::/d' -e 's/0.0.0.0//g' -e '/thepiratebay/d' > /var/lib/dnsmasq/domains.txt && rc-service dnsmasq restart

jacobush 6y ago

But don't new browsers and Android use their own DNS servers?!

aembleton 6y ago
Yes, but you can change them.

baicunko 6y ago

I've always planned on building a free DNS using pi-hole. Any comments on this? Will you use it? (I understand privacy is an issue, how to better address this?)

iRobbery 6y ago

Neat app, not using it though due to lack of quality control in the blocklists. Are there any changes yet to the quality control of the blocklists used, or is the author still copying lists from the internet without scrutiny?

windex 6y ago

Donated once to this fantastic project. I have it running on a VPS+wireguard+firewall and all devices configured to use it even when I am out and about and using the mobile. It performs well enough that all of my family is on it now as well. It's chugging along fine on a 3$ a month VPS and accessible only when logged in via wireguard. Wireguard is working so well, that I am now thinking of starting up additional services for the family to use. Voip/Filestore, pic library etc etc... all firewalled of course.

Tepix 6y ago

Looks good! Is anyone else getting this during the update? [i] Target: https://hosts-file.net/ad_servers.txt [] Status: Connection Refused [] List download failed: no cached list available Looking at the query log, I see a fairly large amount of requests 24/7 by my Xiaomi robot vacuum and my Xiaomi desk LED Desk Lamp. I've blocked both of them. Is there any way of disabling the wifi on the desk light completely? Right now i've connected the lamp to my Wifi and blocked it at the router to prevent it from starting its own WiFi network.

move-on-by 6y ago
That hosts server was shut down. They don’t maintain a blocklist anymore and removed it from the internet.
surround 6y ago
I’m not familiar with the desk lamp, but take a look at Valetudo for your vacuum. https://github.com/Hypfer/Valetudo https://github.com/Hypfer/Valetudo

rubidium 6y ago

Good place to ask: in addition to setting up pi-hole or https://nextdns.io/ https://nextdns.io/, what browser or device based blockers should be used? Anyone have the run down on Adblock plus Privacy badger UBlock origin Etc??

bni 6y ago

Does it support blocking YouTube ads yet? I mean the short video ads that interrupt the videos

aembleton 6y ago
No they come from the same domain as the video that you are trying to watch. If you want to block YouTube ads, then use uBlockOrigin.
- ekko911 6y ago
  I though they had multiple domains instead for most ads? As seen here (however this is 4 years ago) - https://discourse.pi-hole.net/t/how-do-i-block-ads-on-youtube/253 https://discourse.pi-hole.net/t/how-do-i-block-ads-on-youtub... If this is still true, this pi hole update might solve those ads at least?

akerro 6y ago

Which docker image do I use on raspberry pi 1 B? None of them seems to work, all crash on step `[20] pihole exited 267.`

Havoc 6y ago

Per client blocking looking fab. ...I've got some sketchy IOTs that I've been meaning to lock down a little more.

drukenemo 6y ago

Literally 1/3 of my traffic is blocked by Pi-Hole as it's tracking/ad crap. That's impressive stuff!

liotier 6y ago

Is there any value in Pi-hole for people already running Unbound with a bunch of adblock blacklists ? With OPNsense, it is a three-click setup. Found one feature: per-client blocking. Anything else ?

surround 6y ago
I run Unbound alongside Pi-Hole. I’m not familiar with all the features of OPNsense, but pi-hole is convenient because it - automatically updates the block lists each week - supports regex filters - has a admin web interface which makes it easy to view statistics and filtering log, edit the whitelist/blacklist, etc.
- liotier 6y ago
  Integration of Unbound in OPNsense has the basics - the web interface lets one edit access lists, blacklists etc. but no statistics dashboard or sophisticated log processing. It supports lists with regex though. Updating automatically requires a cron job, which has to be added by the administrator using the GUI - adding it automatically is a future feature.

formalsystem 6y ago

I had setup Pi-hole and it was blocking something like 66% of my internet traffic which amounted to ads and spyware. A couple of days later, it just mysteriously stopped working and I couldn't for the life of me figure out why. My theory is that AT&T detected my blocking and blocked my internet as a result. Is that too much of a tin foil hat theory? How can I know for sure? I don't know too much about computer networking, only the basics.

ThePowerOfFuet 6y ago

I have no connection to NextDNS other than as a very satisfied user, but my Pi-hole got decommissioned a few weeks ago as a result of my discovery of NextDNS. I also run their DNS53-to-DoH proxy on a small VM and that VM's IP is the first DNS server in the DNS server list included with DHCP leases (with NextDNS's public IPs as the second and third, losing host-level granularity/logging if the VM is down for whatever reason).