9 ms·
WireHole: Set up Pihole, WireGuard, and Unbound instantly
- pkulak 6y agoVery interesting, thanks for making this! Why the extra unbound DNS server? I assume PiHole is using it, but why not just point PiHole at the final server?
- homarp 6y agohttps://docs.pi-hole.net/guides/unbound/ https://docs.pi-hole.net/guides/unbound/ explains why and how unbound is used.
- byteknight 6y agoThanks for that
- pkulak 6y agoThank you, that's really cool. I've been using DNS over TLS, but it's really complicated to set up. Just running your own recursive DNS actually seems easier. :D
- luizfelberti 6y agoAnother good reason for having unbound is enabling internal DNS resolution for things that are in the VPN. For example, resolving build-server.mycompany to the in-VPN IP of your build server, and so on.
- byteknight 6y agoYou can do that with just pihole FYI You can set up DNS records
- matrixagent 6y agoIf I'm reading the docker-compose file correctly, this creates an open dns resolver that is accessible to the outside, as Docker by default bypasses the firewall, see https://github.com/chaifeng/ufw-docker https://github.com/chaifeng/ufw-docker. I'm not quite sure about that, though, so I'd be happy to be corrected and learn more about how your setup works exactly.
- byteknight 6y agoEdit: I was wrong and I'm removing it to prevent spreading false information. Please see below. EDIT 2: Just provided instructions in the repo for how to configure DDNS: https://github.com/IAmStoxe/wirehole#configuring-for-dynamic-dns-ddns https://github.com/IAmStoxe/wirehole#configuring-for-dynamic... Also modified it so only the port 51820 is exposed preventing any unintentional exposure.
- matrixagent 6y agoAhh, so as long as I only list single ports and not pairs, it is not exposed to the host, because the other number of a pair is the port to be exposed on the host. And therefor it is not exposed to the public network in this case. Makes sense, thanks for the explanation!
- dsissitka 6y agoAre you sure? From https://docs.docker.com/compose/compose-file/ https://docs.docker.com/compose/compose-file/: > Either specify both ports (HOST:CONTAINER), or just the container port (an ephemeral host port is chosen). It sounds like you get a random publicly accessible port unless you specify a non publicly accessible IP. I'm not sure whether having a DNS server listening on a non standard port would be an issue though.
- deleted 6y ago[deleted]
- byteknight 6y agoSorry! I was wrong you are correct. but nonetheless you're ingress rules in your cloud provider will not allow anything but that's single port so it's not really a big deal provided you close everything else off in your firewall. I will make an update to see how I can work around this
- jradd 6y agoYou can try setting up a vpn and no tcp/udp is necessary. Pinhole could be accessed over local network.
- byteknight 6y agoIf you want to automate the deployment and setup a free forever Oracle cloud server and deploy this automatically check out my other project: https://medium.com/@devinjaystokes/automating-the-deployment-of-your-forever-free-pihole-and-wireguard-server-dce581f71b7 https://medium.com/@devinjaystokes/automating-the-deployment...
- ahnick 6y agoWhat is the appeal of Oracle cloud?
- ohyeshedid 6y agoLast I saw, the free accounts offer 2 vm's with double the memory, and more bandwidth, than competitors free offerings.
- Dangeranger 6y agoTrue, but then you have to deal with Oracle. So you will still lose money in the end.
- ohyeshedid 6y agoYa know, I almost edited the comment to specifically say I only looked, and can't speak to the quality of service because I won't do business with Oracle when at all possible.
- byteknight 6y agoFree tier is quiet extensive and "forever". Not just a trial.
- ancorevard 6y agoNow, if you can script this for a Raspberry Pi, then the solution is complete.
- byteknight 6y agoCan run that on a pi
- ancorevard 6y agonice, what's the performance penalty of running on docker?
- drexlspivey 6y agoI wrote a guide for the Pihole + Wireguard setup for anyone interested to try it https://drexl.me/guides/wireguard-pihole-vpn-setup.html https://drexl.me/guides/wireguard-pihole-vpn-setup.html
- byteknight 6y agoEDIT: I guess I was rude? Sorry about that.
- carlinmack 6y agoWeird to see the OP of a post being aggressive towards other commenters
- fancyfredbot 6y agoYou made the front page of HN - well done! You don't need to be defensive now.
- deleted 6y ago[deleted]
- choward 6y agoIt's related to this post so the people reading it may find it interesting so why not?
- byteknight 6y agoFair. Perhaps I took it personally.
- Shared404 6y agoDon't know why you're being downvoted for this comment. Owning up is a hard thing to do, and should be respected.
- jradd 6y agoSo I’ve never setup a vpn before, I’ve been trying to decide how to make this simple for windows clients and phones. Must I have a vpn client? I’m using IPSec, ssl, and LDAP on the public end. I don’t want a client app. A gateway/router should suffice I hope.
- kdtsh 6y agoWireGuard is growing in popularity but I’m not aware of any router firmwares which have a WireGuard client built-in (maybe the popular open source firmwares). Many routers have OpenVPN clients built in.
- jpillora 6y agoMikroTik have recent added support https://forum.mikrotik.com/viewtopic.php?f=1&t=165248 https://forum.mikrotik.com/viewtopic.php?f=1&t=165248
- maximente 6y agoi really like my GL inet router, which has the ability to be a VPN client or server built in to the router GUI. wireguard, openvpn, and tor (!) are options at the router level. their router's UI is built on top of OpenWrt, so you can always fall back to OpenWrt GUI as well for configuring more advanced setups. https://www.gl-inet.com/solutions/vpn/ https://www.gl-inet.com/solutions/vpn/
- kd913 6y agoI can understand the benefit of automating these things but I think it would probably be better for people to setup these things manually first. At least to understand what each step is doing. Otherwise, people are trusting rather a core piece of infrastructure with a random docker image online. I found personally that there are several aspects of this automation that needs tweaking. * If you need ipv6 support this config needs to be overhauled. * Wireguard config should have ipv6 addresses set to avoid potential leakages (even if ipv6 is disabled). * This setup would benefit from some ddns mechanism as most people do not have static ip setups. * Firefox is beginning to have https only modes in which case maybe I would like to adjust lighthttp to work with that. The list goes on.
- byteknight 6y ago* I will update the IPv6 stuff * Also the wireguard config * I will look into how I can allow the user to provide that information as the IP is pulled within the doctor container * Noted on Firefox Thanks for the detailed comment EDIT: Just provided instructions in the repo for how to configure DDNS: https://github.com/IAmStoxe/wirehole#configuring-for-dynamic-dns-ddns https://github.com/IAmStoxe/wirehole#configuring-for-dynamic... Also modifed it so only the port 51820 is exposed preventing any unintentional exposure.
- clankyclanker 6y agoHave you considered producing a patch for the FreedomBox folks? Getting it into Debian would make it easily available to lots of users. https://salsa.debian.org/freedombox-team/freedombox/ https://salsa.debian.org/freedombox-team/freedombox/
- byteknight 6y agoI have not but that's only because I had never heard of it. Will check it out
- windexh8er 6y agoYou can minimize a bit of the manual installation of Docker by leveraging the convenience script that's maintained by them [0]. [0] https://get.docker.com/ https://get.docker.com/
- woodruffw 6y agoAt the risk of splintering interest: Algo[1] and Streisand[2] are two popular open source projects that do nearly identical things. Both also have the advantage of supporting a wide variety of cloud providers by default. Algo installs the absolute minimum needed to get you online with a well-configured VPN; Streisand comes with a whole bunch of bells and whistles (including some that are easy to misconfigure). FD: My employer maintains Algo. [1]: https://github.com/trailofbits/algo https://github.com/trailofbits/algo [2]: https://github.com/StreisandEffect/streisand https://github.com/StreisandEffect/streisand
- byteknight 6y agoCan't speak for streisand, but algo is amazing. I originally wanted to use that for "baremetal" type deployments, but ultimately was having trouble with the systemd-resolve service. Probably my own ignorance, but ultimately felt I could make a more secure alternative with docker :)
- rsync 6y agoWe can't talk about these without talking about nextdns.io which, in my opinion, is the most elegant way of solving this problem. I wanted to run a pihole for years but never got around to building it into my dns infrastructure. Nextdns, on the other hand, was a quick afternoon setup ...
- cinntaile 6y agoJust to drive his point home, it takes 5 minutes to get nextdns.io up and running. Want ad-blocking/domainblocking on your mobile phone? Install the app, enter the code and you're done. I used to have a pi-hole, but the rpi broke so now I only use nextdns.io for everything. But you're not in control since it's in running in the cloud, so there's that.
- kaszanka 6y agoMaybe NextDNS is more elegant or easier to set up, but I felt that depending on its free plan was too risky (what if it eventually goes away?) and didn't really want to pay for a subscription when I already had a server at home to run PiHole on. I didn't really like needing to go over the Internet to configure it either - the PiHole admin panel is just another intranet site.
- byteknight 6y agoJust added instructions for using DDNS: https://github.com/IAmStoxe/wirehole#configuring-for-dynamic-dns-ddns https://github.com/IAmStoxe/wirehole#configuring-for-dynamic...
- reilly3000 6y agoAwesome work! I think you saved me many hours, as I was going to tackle this over the weekend. Props for making those suggested security changes right away. I was just looking at my DNS cache last night and was appalled at the number of ad and telemetry requests are happening.
- byteknight 6y ago<3
- 2Gkashmiri 6y agoCan anyone recommend an easy way to tunnel an entire network over zerotier? I am able to use zerotier perfectly but access is on a per device basis. Could we tunnel the current network with its gateway as a zerotier pc ?
- fegul 6y agoI think OPNsense (an offshoot of pfsense) has this capability built in.
- fulafel 6y agoHow does the auto-update work? Or if there is no auto-update, how does this handle the risk of being pwned from unpatched vulnerabilities?
- BOOSTERHIDROGEN 6y agoThank you for making this, I have to change variable "availability_domain_number" { default = 2 } it works now, for someone not very technical for average HN user, this is awesome. How do I add more peers ?
- byteknight 6y agoin docker-compose.yml under wireguard's environment section change PEER to the total number. https://github.com/IAmStoxe/wirehole/blob/master/docker-compose.yml#L35 https://github.com/IAmStoxe/wirehole/blob/master/docker-comp...
- maigret 6y agoWhat does this tooling do? Of course I could Google the components and look it up, and I already know some of those so I can imagine what it might do. But it would be so much better to get the author stance. Ideally for users the first paragraph on both Medium and GitHub would be something in the order of "Use this tutorial to accomplish x through the use of y and z."
- morazow 6y agoLooks nice! I have similar setup and custom unbound docker container based on distroless. One suggestion: In unbound use more privacy-centric dns providers. https://www.privacytools.io/providers/dns/ https://www.privacytools.io/providers/dns/
- byteknight 6y agoVery nice! I had not heard about distroless. I will look into an alternate configuration with that perhaps - Thanks! I will also update the README with a guide on choosing other providers.
- donclark 6y agoNoob here. Has anyone done a youtube video on this yet? I searched but I did not find. Thank you very much in advance!