5 ms·

Can I heavily recommend the use of them as a pihole + Wireguard VPN + DNSCryptProxy Server. Pihole -> Great use for a network wide adblocker/DHCP server. Wire

by kd913 5y ago

Can I heavily recommend the use of them as a pihole + Wireguard VPN + DNSCryptProxy Server. Pihole -> Great use for a network wide adblocker/DHCP server. Wireguard VPN -> In combination with a DDNS setup and some port forwarding enables the use of a global private VPN. I think it's a prerequisite for a decent home-automation setup. DNSCryptProxy -> Great for ensuring all DNS requests on the network via DNS over HTTPS. Kind of useful because frankly ISPs are sniffing DNS traffic. Also useful for bypassing DNS based ISP filters. The above basically enabled me to create a 5 country wide private VPN by giving VPNs to family members. It enables me to print/scan things from abroad, access CPU resources/servers/GPUs/Webcams/automation and obviously browse as if I am in another place. My family when they are abroad, can now work as if they aren't. It also saves power (reducing analytics traffic), improves privacy and takes about a weekend to setup. They also make great personal gifts too.

deleted 5y ago
[deleted]
aweiland 5y ago
Any good tutorials on setting up Wireguard? This (and Pihole) have been on my todo list for a while.
- kd913 5y ago
  I should probably write a blog on how to do this. I have a setup guide for myself, but unfortunately it contains a lot of obviously private details that I can't post (ie access to my cloudflare/VPN stuff). A lot of my stuff is ad-hoc from my personal exploration and experience on Linux. In regards to the wireguard specific stuff, this isn't a bad guide. https://mikkel.hoegh.org/2019/11/01/home-vpn-server-wireguard/ https://mikkel.hoegh.org/2019/11/01/home-vpn-server-wireguar... The harder part with the VPN stuff is the following. 1) Setting up a clear route of forwarding traffic to the pihole. To do so, you would need to setup netplan/systemd-networkd so your pi gets a static private IP. (Not that easy if you are doing a full ipv6 route too.) 2) Setup a DDNS mechanism (as you most likely are getting a dynamic IP). My suggestion for this was to get a domain name (8 quid a year) and use cloudflare as a DDNS host. You also need to punch a UDP port through your router to forward to your pi. 3) Then setup the rest of the wireguard stuff. 4) Setup the pihole and ensure all interfaces are covered so your VPN has a DNS server. Part 2 is the hardest bit as I kind of needed some custom scripting to ensure cloudflare had working routes to my networks. e.g. https://gist.github.com/Kedstar99/2d8ab0e9bec3a5629562b4ab010a1847 https://gist.github.com/Kedstar99/2d8ab0e9bec3a5629562b4ab01... The above script obviously running as a systemd service that restarts automatically. Obviously you can use something else like noip or some other DDNS solution.
- gen220 5y ago
  I did this a few months ago. I’d previously tried a few years ago, and found no good online resources. Now they’re a dime a dozen. The community around WG has gotten much easier for noobs to get into, and the porcelain around the tool itself has made it quite easy to use, IMO.
- awoimbee 5y ago
  The easiest way is to use some kind of manager on top of wireguard. Tailscale is very good and free for a single user (or with headscale) Otherwise there is innernet, wiretrustee, ...
- mongol 5y ago
  I like wg-netns. It allows setup of a wireguard tunnel, similar to wg-quick does, in a Linux network namespace. So I can run some processes using the VPN, and others without. By specifying the namespace in a systemd service file, I can let a service use a specific VPN. https://github.com/dadevel/wg-netns https://github.com/dadevel/wg-netns
- josteink 5y ago
  > Any good tutorials on setting up Wireguard? This (and Pihole) have been on my todo list for a while. Pihole pretty much installs itself (it even has a pre-made image). WireGuard will take reading, testing and failing. I recommend doing these things one thing at a time, and doing the Pihole first.
- unethical_ban 5y ago
  You can set up a Pi-Hole (DNS sinkhole) and Pi-VPN (Wireguard installer and CLI-frontend for small deployments) very quickly. And you can do it on any debian VM or computer, not just Pi. Once you have the base OS ready to go, it will take you less than 30 minutes if you know how to muck with your DHCP/firewall settings in your router. https://github.com/pi-hole/pi-hole/#one-step-automated-install https://github.com/pi-hole/pi-hole/#one-step-automated-insta... Install Pi-Hole, then edit your DHCP server to hand out the Pi-Hole as the DNS server. https://pivpn.io/ https://pivpn.io/ After installing Pi-hole, install this. Choose Wireguard, not OpenVPN. port-forward the Wireguard UDP port to your VPN server. use the "pivpn" command to create client configs and the "qr" subcommand to scan the config into your phone.
- petre 5y ago
  The easiest way on the Pi is to install the HomeAssistant plugin, but it's quite easy to set up on a Linux too. Generate two keys, copy paste them in a five line config, same thing on the client. On a phone install the app and scan a QR code that you rsync over to your PC. There's a tutorial on the Wg website.
- thedougd 5y ago
  If you're a Linux person, just skip all the other non-sense and create a systemd-networkd file. It's by far the simplest solution I've used, and doesn't require goofy unit files to start/stop/restart via wg tool. https://www.freedesktop.org/software/systemd/man/systemd.netdev.html#%5BWireGuard%5D%20Section%20Options https://www.freedesktop.org/software/systemd/man/systemd.net... Then choose your firewall of choice to setup NAT and forwarding. I used firewalld, but not sure I'd recommend it. It's just the first solution I got working.
- phamilton 5y ago
  I'd recommend just using Tailscale. It's wonderful.
  - rasfincher 5y ago
    Tailscale is great. It's really changed my world and it's so dang simple.
- newman314 5y ago
  I used trailofbits/algo a long time ago for initial setup. Worked well at the time.
- andylynch 5y ago
  I use pivpn - it’s a pretty straightforward helper for both openvpn and wireguard
thrwyoilarticle 5y ago
I tried using a Pi4 for a pihole and it kept crashing. Overheating I think. But, if I solve that, the SD card would kill it eventually.
- eldaisfish 5y ago
  you can disable all logging in pihole - which i do and my sd card from 2016 is still going strong.
- bityard 5y ago
  Not if you get a good SD card, or a USB SSD.
  - thrwyoilarticle 5y ago
    When I was trying, boot from USB wasn't available.
- somehnguy 5y ago
  What power supply were you using? My Pi 4 running 2 instances of Octoprint kept crashing until I switched to their official power supply. On previous models I always got away with whatever power supply I had around but the 4 doesn't play around when it comes to power consumption.
  - thrwyoilarticle 5y ago
    The one it came with!
    - knodi123 5y ago
      I had to replace the one mine came with. It was new-ish, so I was able to get it for free under warranty, but be aware- quality control for their power supplies is not great (at least as of ~2017)
    - somehnguy 5y ago
yumraj 5y ago
> DNSCryptProxy -> Great for ensuring all DNS requests on the network via DNS over HTTPS. Kind of useful because frankly ISPs are sniffing DNS traffic. Also useful for bypassing DNS based ISP filters. If you're using PiHole, you can just use cloudflared to do DoH. https://docs.pi-hole.net/guides/dns/cloudflared/ https://docs.pi-hole.net/guides/dns/cloudflared/ On a different note, biggest reason I've never installed a VPN at home is because I just prefer a deny-everything home network and worry I'll misconfigure something and cause a security issue.
- newman314 5y ago
  YMMV but I’ve noticed that cloudflared has stability issues over time whereas dnscrypt has been rock solid for me (I run both on different systems). Probably going switch everything to dnscrypt esp since it supports odoh now.
  - yumraj 5y ago
    cloudflared service itself has been running fine. If there were other issues, such as connectivity, then I don't know. Didn't experience any. OTOH, I'm beginning to migrate to pfsense and pfblockerng at home. So, it is possible that I may retire my pi-hole at some point. Currently I'm running both as I transition and test.
    - beezischillin 5y ago
      I migrated away from cloudflared to dnscrypt-proxy because cloudflared didn't start up properly for me. On each reboot I had to manually stop and start it otherwise it was flooding the logs with failures. It was a bit weird and frustrating to diagnose.
- kd913 5y ago
  I use DNSCryptProxy because I can use it with Firefox as a local TRR server, supports additional filtering, supports DNSCrypt and ODoH caching and is open source. It also picks from 140 or so anonymous DoH relays, with specifics for nologs and dnscrypt support. Why would I go for just 1 arbitrary provider rather than the lowest latency choice out of 140? I also think the latter point is a bit overblown. So long as you keep your kernel updated and you only expose a single high UDP port, it should all be fine. I have ufw enabled on each pi, along with various logging mechanisms in place to see if things seem reasonable. That and 2fa for actual ssh access.
beezischillin 5y ago
I ended up Tailscale for Wireguard myself. I was really worried about letting all these server software out on the wide open internet because I can't guarantee I'll be around 24/7 to monitor in case of a security problem and this way I can be lazier. :) The added benefit is that I can force all devices to use PiHole while connected to Tailscale and have DNS-adblocking on the go!
- firecall 5y ago
  Upvote for Tailscale. I find it super useful! Even if just for remoting into various boxes; the kids for instance often tether their PCs off their phones or I'm tethered and want to remote to my LAN. (I have terrible internet)
1vuio0pswjnm7 5y ago
I do something similar but different choice of software. There is much more that is possible using this approach (distributing exact same hardware with preinstalled configs to each network particpant). These RPis are gateways. They are gateways to an overlay network controlled by users and not surveilled by "tech" companies trying to sell ad services. I like to imagine them as modern day IMPs. https://en.wikipedia.org/wiki/Interface_Message_Processor https://en.wikipedia.org/wiki/Interface_Message_Processor
synergy20 5y ago
for $18 you can have this instead : https://www.amazon.com/dp/B0932J39HC?ref=myi_title_dp&th=1 https://www.amazon.com/dp/B0932J39HC?ref=myi_title_dp&th=1 I run pihole with 256MB version(which is $1 less) for two years fanlessly, and this includes enclosure too, load the software and hook it to my wireless router's ethernet port and just forgot about it.

by kd913 5y ago

deleted 5y ago

[deleted]

aweiland 5y ago

Any good tutorials on setting up Wireguard? This (and Pihole) have been on my todo list for a while.

kd913 5y ago
I should probably write a blog on how to do this. I have a setup guide for myself, but unfortunately it contains a lot of obviously private details that I can't post (ie access to my cloudflare/VPN stuff). A lot of my stuff is ad-hoc from my personal exploration and experience on Linux. In regards to the wireguard specific stuff, this isn't a bad guide. https://mikkel.hoegh.org/2019/11/01/home-vpn-server-wireguard/ https://mikkel.hoegh.org/2019/11/01/home-vpn-server-wireguar... The harder part with the VPN stuff is the following. 1) Setting up a clear route of forwarding traffic to the pihole. To do so, you would need to setup netplan/systemd-networkd so your pi gets a static private IP. (Not that easy if you are doing a full ipv6 route too.) 2) Setup a DDNS mechanism (as you most likely are getting a dynamic IP). My suggestion for this was to get a domain name (8 quid a year) and use cloudflare as a DDNS host. You also need to punch a UDP port through your router to forward to your pi. 3) Then setup the rest of the wireguard stuff. 4) Setup the pihole and ensure all interfaces are covered so your VPN has a DNS server. Part 2 is the hardest bit as I kind of needed some custom scripting to ensure cloudflare had working routes to my networks. e.g. https://gist.github.com/Kedstar99/2d8ab0e9bec3a5629562b4ab010a1847 https://gist.github.com/Kedstar99/2d8ab0e9bec3a5629562b4ab01... The above script obviously running as a systemd service that restarts automatically. Obviously you can use something else like noip or some other DDNS solution.
gen220 5y ago
I did this a few months ago. I’d previously tried a few years ago, and found no good online resources. Now they’re a dime a dozen. The community around WG has gotten much easier for noobs to get into, and the porcelain around the tool itself has made it quite easy to use, IMO.
awoimbee 5y ago
The easiest way is to use some kind of manager on top of wireguard. Tailscale is very good and free for a single user (or with headscale) Otherwise there is innernet, wiretrustee, ...
mongol 5y ago
I like wg-netns. It allows setup of a wireguard tunnel, similar to wg-quick does, in a Linux network namespace. So I can run some processes using the VPN, and others without. By specifying the namespace in a systemd service file, I can let a service use a specific VPN. https://github.com/dadevel/wg-netns https://github.com/dadevel/wg-netns
josteink 5y ago
> Any good tutorials on setting up Wireguard? This (and Pihole) have been on my todo list for a while. Pihole pretty much installs itself (it even has a pre-made image). WireGuard will take reading, testing and failing. I recommend doing these things one thing at a time, and doing the Pihole first.
unethical_ban 5y ago
You can set up a Pi-Hole (DNS sinkhole) and Pi-VPN (Wireguard installer and CLI-frontend for small deployments) very quickly. And you can do it on any debian VM or computer, not just Pi. Once you have the base OS ready to go, it will take you less than 30 minutes if you know how to muck with your DHCP/firewall settings in your router. https://github.com/pi-hole/pi-hole/#one-step-automated-install https://github.com/pi-hole/pi-hole/#one-step-automated-insta... Install Pi-Hole, then edit your DHCP server to hand out the Pi-Hole as the DNS server. https://pivpn.io/ https://pivpn.io/ After installing Pi-hole, install this. Choose Wireguard, not OpenVPN. port-forward the Wireguard UDP port to your VPN server. use the "pivpn" command to create client configs and the "qr" subcommand to scan the config into your phone.
petre 5y ago
The easiest way on the Pi is to install the HomeAssistant plugin, but it's quite easy to set up on a Linux too. Generate two keys, copy paste them in a five line config, same thing on the client. On a phone install the app and scan a QR code that you rsync over to your PC. There's a tutorial on the Wg website.
thedougd 5y ago
If you're a Linux person, just skip all the other non-sense and create a systemd-networkd file. It's by far the simplest solution I've used, and doesn't require goofy unit files to start/stop/restart via wg tool. https://www.freedesktop.org/software/systemd/man/systemd.netdev.html#%5BWireGuard%5D%20Section%20Options https://www.freedesktop.org/software/systemd/man/systemd.net... Then choose your firewall of choice to setup NAT and forwarding. I used firewalld, but not sure I'd recommend it. It's just the first solution I got working.
phamilton 5y ago
I'd recommend just using Tailscale. It's wonderful.
- rasfincher 5y ago
  Tailscale is great. It's really changed my world and it's so dang simple.
newman314 5y ago
I used trailofbits/algo a long time ago for initial setup. Worked well at the time.
andylynch 5y ago
I use pivpn - it’s a pretty straightforward helper for both openvpn and wireguard

thrwyoilarticle 5y ago

I tried using a Pi4 for a pihole and it kept crashing. Overheating I think. But, if I solve that, the SD card would kill it eventually.

eldaisfish 5y ago
you can disable all logging in pihole - which i do and my sd card from 2016 is still going strong.
bityard 5y ago
Not if you get a good SD card, or a USB SSD.
- thrwyoilarticle 5y ago
  When I was trying, boot from USB wasn't available.
somehnguy 5y ago
What power supply were you using? My Pi 4 running 2 instances of Octoprint kept crashing until I switched to their official power supply. On previous models I always got away with whatever power supply I had around but the 4 doesn't play around when it comes to power consumption.
- thrwyoilarticle 5y ago
  The one it came with!
  - knodi123 5y ago
    I had to replace the one mine came with. It was new-ish, so I was able to get it for free under warranty, but be aware- quality control for their power supplies is not great (at least as of ~2017)
  - somehnguy 5y ago

yumraj 5y ago

> DNSCryptProxy -> Great for ensuring all DNS requests on the network via DNS over HTTPS. Kind of useful because frankly ISPs are sniffing DNS traffic. Also useful for bypassing DNS based ISP filters. If you're using PiHole, you can just use cloudflared to do DoH. https://docs.pi-hole.net/guides/dns/cloudflared/ https://docs.pi-hole.net/guides/dns/cloudflared/ On a different note, biggest reason I've never installed a VPN at home is because I just prefer a deny-everything home network and worry I'll misconfigure something and cause a security issue.

newman314 5y ago
YMMV but I’ve noticed that cloudflared has stability issues over time whereas dnscrypt has been rock solid for me (I run both on different systems). Probably going switch everything to dnscrypt esp since it supports odoh now.
- yumraj 5y ago
  cloudflared service itself has been running fine. If there were other issues, such as connectivity, then I don't know. Didn't experience any. OTOH, I'm beginning to migrate to pfsense and pfblockerng at home. So, it is possible that I may retire my pi-hole at some point. Currently I'm running both as I transition and test.
  - beezischillin 5y ago
    I migrated away from cloudflared to dnscrypt-proxy because cloudflared didn't start up properly for me. On each reboot I had to manually stop and start it otherwise it was flooding the logs with failures. It was a bit weird and frustrating to diagnose.
kd913 5y ago
I use DNSCryptProxy because I can use it with Firefox as a local TRR server, supports additional filtering, supports DNSCrypt and ODoH caching and is open source. It also picks from 140 or so anonymous DoH relays, with specifics for nologs and dnscrypt support. Why would I go for just 1 arbitrary provider rather than the lowest latency choice out of 140? I also think the latter point is a bit overblown. So long as you keep your kernel updated and you only expose a single high UDP port, it should all be fine. I have ufw enabled on each pi, along with various logging mechanisms in place to see if things seem reasonable. That and 2fa for actual ssh access.

beezischillin 5y ago

I ended up Tailscale for Wireguard myself. I was really worried about letting all these server software out on the wide open internet because I can't guarantee I'll be around 24/7 to monitor in case of a security problem and this way I can be lazier. :) The added benefit is that I can force all devices to use PiHole while connected to Tailscale and have DNS-adblocking on the go!

firecall 5y ago
Upvote for Tailscale. I find it super useful! Even if just for remoting into various boxes; the kids for instance often tether their PCs off their phones or I'm tethered and want to remote to my LAN. (I have terrible internet)

1vuio0pswjnm7 5y ago

I do something similar but different choice of software. There is much more that is possible using this approach (distributing exact same hardware with preinstalled configs to each network particpant). These RPis are gateways. They are gateways to an overlay network controlled by users and not surveilled by "tech" companies trying to sell ad services. I like to imagine them as modern day IMPs. https://en.wikipedia.org/wiki/Interface_Message_Processor https://en.wikipedia.org/wiki/Interface_Message_Processor

synergy20 5y ago

for $18 you can have this instead : https://www.amazon.com/dp/B0932J39HC?ref=myi_title_dp&th=1 https://www.amazon.com/dp/B0932J39HC?ref=myi_title_dp&th=1 I run pihole with 256MB version(which is $1 less) for two years fanlessly, and this includes enclosure too, load the software and hook it to my wireless router's ethernet port and just forgot about it.