14 ms·

Setting up a Pi Hole made my home network faster

423 points by pmoriarty 4y ago

0daystock 4y ago
Won't be long now until IoT and other crap-ware devices catch on to this trend and start hard-coding DNS servers in code, or worse, using DNS encryption to avoid this sort of routine blocking by end-users. I wonder how people are thinking about solving this problem.
- Group_B 4y ago
  One of many reasons why I don’t even bother with IoT devices. Don’t need all this crap to be connected to wifi. There was nothing wrong with it before.
  - Deritiod 4y ago
    It's not crap just because you don't see a benefit. In my opinion, additional being a curios software engineer I find it quite interesting. Necessary? Perhaps not but helpful. Heating valves for example.
    - aksss 4y ago
      Not that I’m terribly experienced with it, but a lot of home automation can be done without “IoT” — specifically without the crapware Trojan controllers that come with consumer solutions from Best Buy. ISY994 for example. Easy solutions for remote access via apps (vpn to home) and notifications as well. It’s not as easy to set up as a plug and play controller from Google, but it’s far more private.
      - Deritiod 4y ago
        I include your example. The definition of iot from Wikipedia also does it. But honestly why I hate my iot window blinds device it's the perfect excuse to use vlan at home.
- lapser 4y ago
  This is already happening. The likes of Google Home et al already hardcode their own servers. I noticed that no DNS requests were being made through my Pi Hole, so when I looked, it turned out their DNS servers were hardcoded. However, I'm more worried about when they start hardcoding DoH servers.
  - doubled112 4y ago
    Same on DoH. I can’t filter it or redirect it like I can with plain old DNS.
    - lapser 4y ago
      Yes, really the only way would be to set up a MITM proxy on your network and enforce all traffic goes through that. Also means accepting a CA.
      - 1vuio0pswjnm7 4y ago
        Been using this solution myself for a number of years. Works remarkably well. I do not even use DNS recursion or any remote DNS requests because I can load bulk DNS data into the proxy's memory. There is only ever one nonrecursive request to a localhost authoritative DNS server and the answer is always the same: the address of the proxy. Ironically perhaps, DoH outside the browser can be used to gather the bulk DNS data, thanks to HTTP/1.1 pipelining. Many years ago I anticipated that "developers" would no longer allow end users to choose DNS servers. The developers' work, i.e., software, was dropping in market value and they began to adopt a Trojan Horse "business model". End users could use the software for free with the expectation that few would notice/complain about increased surveillance and data collection, or injected advertising. The so-called "MITM proxy" is neither a new nor radical idea. Corporations routinely "MITM" TLS traffic from their networks. Enterprise hardware/software companies have provided turnkey solutions. The issue is not limited to addresses for DNS servers. For example, WhatsApp hardcodes IP addresses in their mobile app. For that problem I use an application firewall. The PiHole is essentially a slightly modified version of dnsmasq running on a RPi. It is funny that no one has tried using other DNS software. Given a choice of DNS software, I would not choose dnsmasq. It also still seems that no one has presented a "PiHole" that uses a forward proxy instead of a DHCP/DNS server. Similar to corporations, home users need a turnkey solution for monitoring their home networks.
- timbit42 4y ago
  Have your gateway/firewall block all traffic from the LAN IP of the device from exiting the LAN. If it's running on Win/Mac/Linux/Android/iOS, block the app from talking to the gateway, or even the entire LAN.
  - pdimitar 4y ago
    That's what I do with my printer. I love the company (Brother) and they make IMO the best printers and MFPs but I am quite paranoid already and I just block any WAN traffic. The printer is (and should be) really only used from the LAN anyway.
- phillipseamore 4y ago
  I already translate all port 53 traffic to my local resolver and block known DoH addresses.
  - gruez 4y ago
    If they're really evil, they'd proxy all traffic through a single host (eg. d2v3i0u0qtn52v.cloudfront.net), so you have to choose between no IOT features, or getting subjected to all the ads/telemetry.
    - everdrive 4y ago
      >so you have to choose between no IOT features I'll bring out the fainting couch. These devices are enough of a poison pill that you're better off without them. You can problem block them with Pihole, but you're one update away from either circumventing the Pihole, or breaking your IoT device because something got changed on the manufacturer's end.
      - gruez 4y ago
        At that point you're better off not connecting the device to the internet at all.
        bee_rider 4y ago
        I think we might be at that point currently.
    - rsync 4y ago
      No - as I’ve said upthread, the real evil is running DoH on the www host. Now what ?
- teeray 4y ago
  DNAT ftw
- dylan604 4y ago
  Can you not just block the specific addresses? Sure, you'll probably have to do some log digging to find out which ones, but I'm guessing someone else on the internet has already done it.
  - Gigachad 4y ago
    Sure, then the devices throw up an error and refuse to function. I noticed that most smart TV streaming apps refused to run if they failed to connect to their ad servers.
- n4bz0r 4y ago
  > I wonder how people are thinking about solving this problem. Not sure what potential issues are are being mentioned here, but I'd say a separate VLAN for IoT devices + QoS [0] should rule out most of the concerns. [0] https://en.m.wikipedia.org/wiki/Quality_of_service https://en.m.wikipedia.org/wiki/Quality_of_service
- DistractionRect 4y ago
  I solve this with a DNS based firewall. Essentially it's just DNS filtering on steriods. You start with an empty (or preseeded) ipset, and a firewall rule that says to reject/drop all outbound traffic if the destination isn't in the ipset. Dnsmasq is setup as the default dns provider in DHCP, and it's setup to add all resolved IPs to the ipset (with an expiration so stale entries get removed). Then it's just DNS filtering per the usual. DoH, DoQUIC, DoT, etc don't work as their hardcoded IPs are blocked by default, and DNS filtering knocks out domain resolution of the endpoints. Even if an alternate resolver is allowed through the firewall, none of it's responses get into the ipset, so it's still broken (and is a sign I need to update the DNS filter). Works a treat on my IoT devices
  - BLKNSLVR 4y ago
    I really like the concept of this approach, I'd say it's worth writing a blog post / article describing the process and details so others can duplicate it.
  - afraca 4y ago
    This is very very similar to something developed by SIDN labs called "DNS Resolution Required", you can read the blog post here: https://www.sidnlabs.nl/en/news-and-blogs/dns-resolution-required-can-help-make-the-internet-safer https://www.sidnlabs.nl/en/news-and-blogs/dns-resolution-req...
- anthropodie 4y ago
  You solve that by not buying such crap-ware. You buy open hardware systems.
  - ghostpepper 4y ago
    I would love if there was an open 4K HDR TV but I think only a very niche audience actually cares about this so most manufacturers will not see a market opportunity
    - throwaway2037 4y ago
      I see your point. Real question: In today's world, what is the difference between a TV and a computer monitor + RasPi? I guess the biggest issue will be streaming on services with very strict operating system / browser requirements. For example, can you stream Netflix @ 4K via RasPi? I assume no, due to super strict DRM. It is a little bit surprising to me that the big streaming companies have not creating an open source operating system (similar to Android) that can be used by manuf to create TVs. Then, smaller manuf can find ways to offer bloatware- / adware-free options. Maybe this already exists, and this comment makes no sense!
      - krageon 4y ago
        Size. You cannot get the quality and size of a TV in a monitor form factor.
      - piperswe 4y ago
        Size, OLED, HDR, and eARC are three things I can't find in a monitor. I don't know of any 55" OLED monitors that support Dolby Vision and can output their audio to my home audio system over eARC. OLED and Dolby Vision are important to me because HDR makes such a huge difference in properly mastered content. eARC is important because my audio system is able to take advantage of Dolby Atmos metadata and I don't want to lose that. I could just pass my HDMI inputs through my receiver, but my receiver doesn't support passing through 4k 120Hz which I appreciate using with my Xbox. HDR and OLED are available in some monitor models, but to my knowledge there aren't any 55" monitors with HDR and OLED, and especially eARC.
- zeroflow 4y ago
  There is a workaround by enabling NAT and forcing all traffic to piHole / pfblockerNG https://docs.netgate.com/pfsense/en/latest/recipes/dns-redirect.html https://docs.netgate.com/pfsense/en/latest/recipes/dns-redir...
  - rsync 4y ago
    How does this help with DoH? If the dns request is over 443 and the DoH server is the same host as the served resource, what can be done ?
    - jamiek88 4y ago
      Could you MITM and inspect for dns request packets?
      - rsync 4y ago
        Yes - I postulated this elsewhere in this thread. The next step in the arms race would then be to implement DoHoH. Sigh.
- asix66 4y ago
  I couple PiHole with a pfsense router. In pfsense all DNS queries are blocked except to my pihole. This thwarts an IoT device or streaming devices, etc., from bypassing pihole. Then I block known DoH servers on both pfsense and pihole---which is not perfect, since it's really a game of whack-a-mole, but better than not.
- mmcnl 4y ago
  It's already happening, but hardcoding also causes other issues. You have to be really big before you can depend on a hardcoded DNS server.
- RachelF 4y ago
  Microsoft already does this in Windows 8, 10 and 11 with their "telemetry" servers. The DNS queries for these bypass any of your own DNS settings. They even bypass host file overrides.
  - no_time 4y ago
    On the upside, the endpoints are nicely documented by both MS and independent researchers. Also, Windows enforces packet filtering rules on it's own phoning home so a well configured firewall like SimpleWall will be relatively secure from a spying perspective. https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Cyber-Sicherheit/SiSyPHus/Workpackage4_Telemetry.pdf https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Cyber-Si... https://www.henrypp.org/product/simplewall https://www.henrypp.org/product/simplewall
- heavyset_go 4y ago
  Already happening, Google products like the Chromecast serve up plenty of obnoxious ads these days, and hardcode Google DNS. Even blocking Google DNS still allows ads to get through. This is a big reason why I will never buy another Chromecast branded product, or Google product, again. Congratulations on successfully monetizing my time and annoying me into swearing off Google products altogether.
- e2le 4y ago
  > Smart devices manufacturers often “hard-code” in a public DNS server, like Google’s 8.8.8.8, and their devices ignore whatever DNS server is assigned by your router - such as your PiHole. > Nearly 70% of smart TVs and 46% of game consoles were found to contain hardcoded DNS settings - allowing them to simply ignore your local network’s DNS server entirely. On average, Smart TVs generate an average of 60 megabytes of outgoing Internet traffic per day, all the while bypassing tools like PiHole. https://labzilla.io/blog/force-dns-pihole https://labzilla.io/blog/force-dns-pihole For those devices which ignore DHCP/NDP provided DNS addresses, you could create a firewall to redirect outgoing port 53 traffic to your own server.
monkellipse 4y ago
Can confirm, pihole is great. I put in two for redundancy, helps make sure nothing gets through. No negative impact on network perf, as it only touches DNS and plenty fast for that.
- albert_e 4y ago
  you have them as primary and secondary for failover?
  - monkellipse 4y ago
    Yes, exactly. DNS settings on router makes that easy, just give each pihole a static address and point DNS to them. The address are listed in priority.
quyleanh 4y ago
I would like to use Adguard Home instead of Pi Hole for better up stream DNS query.
- 2OEH8eoCRo0 4y ago
  I prefer Adguard as well.
- NelsonMinar 4y ago
  I use the free level of NextDNS. Not self-hosted, for better and worse.
- vladvasiliu 4y ago
  What do you mean? What's wrong with PiHole's upstream queries?
- nicolas_ 4y ago
  Same here. I have it coupled with Tailscale to enjoy the same benefits remotely on my phone https://nicolaslouge.com/post/install-adguard-home-raspberry-pi-enable-remote-acces-via-tailscale/ https://nicolaslouge.com/post/install-adguard-home-raspberry...
kayson 4y ago
While the interface may not be as pretty, you can do the same thing if you're running pfsense using the pfblocker-ng package: https://docs.netgate.com/pfsense/en/latest/packages/pfblocker.html https://docs.netgate.com/pfsense/en/latest/packages/pfblocke... You can also so geo-based IP blocking Combined with pfsense's recursive resolved (unbound), it makes for a pretty great home dns setup.
- pdimitar 4y ago
  I know some of these words. [cries in not being network-admin educated] Jokes aside, I'd love a blog post on this. Seriously. Very likely to apply the knowledge as well.
  - kayson 4y ago
    I would suggest starting with the pfsense documentation. It's great!
- lousken 4y ago
  i am considering pfsense for my homelab setup - can you easily troubleshoot issues and whitelist addresses if you need to?
  - harmon 4y ago
  - zeroflow 4y ago
    Yeah. You have a live logging tab and can either put the URL into a whitelist rule by clicking on the plus icon or manually input it into a whitelist setting.
  - slickdork 4y ago
    I recommend opnsense [0] over pfsense. I ran pfsense for 5 years and it is great, but there was some bad blood [1] between the two projects and the community. [0] https://opnsense.org/ https://opnsense.org/ [1] https://teklager.se/en/pfsense-vs-opnsense/ https://teklager.se/en/pfsense-vs-opnsense/
jrmg 4y ago
Like any other project I run everything in a Docker container, and this project should be no different. What is the advantage of this in this case?
- NegativeLatency 4y ago
  Specifically relating to pihole (as of previous versions) it wasn’t the cleanest install uninstall experience and left a bunch of crap behind on my system. I now run it in a docker container because of this, but I can’t speak to OPs motivations
  - mmcnl 4y ago
    I run everything in a Docker container because I have 50+ services running, and I don't want to spend any time on their inner workings. I truly couldn't care less. I only manage the access layers (configuration parameters, volumes, ports and reverse proxy). Using Docker every application is the same from a management perspective.
- dspillett 4y ago
  > What is the advantage of this in this case? Not specific to PiHole, but perhaps keeping the OPs infrastructure management consistent may have monitoring and maintenance benefits. And specifically mentioned in the very next sentence: > The Pi Hole project already has a nice Docker project utilizing compose. It is a supported configuration for PiHole so it fits in nicely, no need to even product their own docker based solution. Not much of a docker user myself (I've tinkered, and we use it for some things in DayJob, but for my own stuff I use VMs or occasionally LCX if I do want a container instead), but the answer to your questions was really quite obvious.
- ocdtrekkie 4y ago
  Any special setup amongst your network takes excess work to maintain. In the case of Pihole, I gave up on maintaining it because I was running it on a Raspberry Pi, and found that it was annoyingly hard to keep a Pi running stable for a long period of time. Had I a convenient way to set it up in a Docker container, it would've been better. Of course, since I don't run anything in Docker at home, that would also constitute a special setup I have to maintain.
deleted 4y ago
[deleted]
ferminaut 4y ago
I know some folks are anti Ubiquiti Unifi on here, but you can run pihole (along with a bunch of other stuff) right on a UDM/UDM-Pro. IMO it makes the most sense to run this on the router, and you can run it in a docker container. If you're looking for a fun hour or two project, check out: https://github.com/boostchicken-dev/udm-utilities/tree/master/run-pihole https://github.com/boostchicken-dev/udm-utilities/tree/maste...
- pcl 4y ago
  I run a PiHole and a Tailscale exit node on my Unifi routers (previous generation). The Tailscale exit node lets me do both site-to-site VPNs and site-specific egress. The one thing keeping me from site network nirvana is that I haven't quite figured out how to set up a wifi network on the Ubiquiti device that routes all traffic through a given other exit node, however. Someday!
  - deleted 4y ago
    [deleted]
  - gonehome 4y ago
    I just setup tailscale yesterday to access a local urbit node and it’s seriously great! They really solved what has always been a major pain with local hosting and made it really easy to use. I ended up using NextDNS over pihole, but only because it was just easier to get the same result.
  - oceanswave 4y ago
    Does setting the gateway address on the wifi network to be your tailscale exit node ip work?
  - vamega 4y ago
    What router do you have? I've got a USG and was wondering if it was possible to run PiHole on the USG.
- moffkalast 4y ago
  Ah I just opened this thread to ask why isn't this a standard feature on routers at this point, and lo and behold. I hope it becomes more ubiquitous (hah) even on lower cost ones eventually.
agomez314 4y ago
How does this compare to using Brave Browser with ad blocking?
- sneak 4y ago
  It blocks a lot of the phone-home from Apple devices that is built in to the OS and happens outside of the browser.
- newscracker 4y ago
  It’s different but has some similarities. This blocks all kinds of configured (DNS) requests from your devices, even from apps and operating systems, whereas Brave browser only blocks ads on the browser. One drawback is that this solution does DNS level blocking, and cannot handle any web page element-level blocking that may be possible in some browsers.
fareesh 4y ago
I use OpenWRT and Ad blocking on my router - is the pi hole solution superior?
prometheus1909 4y ago
I keep seeing posts about Pi Holes and it looks good, but I have previously dealt with ads by appending their delivering sites to my /etc/hosts, i.e. 0.0.0.0 trashsite1.com 0.0.0.0 trashsite2.com The only downside I see is that my approach is not network-wide. Any other reasons I should reconsider?
- pcl 4y ago
  Probably the biggest two selling points are the crowdsourced deny list and the fact that all types of devices will benefit, including "smart" TVs etc.
- mFixman 4y ago
  Similarly, why is PiHole better than using a browser ad-blocker?
  - eyluo 4y ago
    My understanding is that PiHole stops the ads from being downloaded in the first place, hence the increased network performance.
    - dserodio 4y ago
      uBlock prevents then from being downloaded too
      - aulin 4y ago
        ublock only works inside Firefox on mobile, this blocks most ads in every app, smart tvs, iot devices
  - majkinetor 4y ago
    You should have both. One is for network wide effects, so anything on your network will have ads blocked (smart TV, projector, phones etc.), another is for youtube and friends.
  - 4y ago
godelski 4y ago
Every time I've tried pihole it has failed on services like YouTube. Can someone explain this to me and how I solve it? I know it's not just me, it even happened to Linus Tech Tips but I constantly hear responses "works for me" which are unhelpful. If ublock works fine, why can't pihole? I'm actually interested in a technical answer.
- datfrojo 4y ago
  Pihole only works if ads are served from a distinct domain name from content. This works in most cases but YouTube serves ads and content from the same place so pihole can’t prevent. As uBlock works client side it does not face this limitation
  - godelski 4y ago
    So wouldn't there be a way to intercept the data and apply the same blocking that uBlock does and then resend it? I know it would have a delay, but that'd probably be worth it to me tbh.
    - nabakin 4y ago
      It would be very hard to do so because SSL prevents middlemen from intercepting and modifying data. You'd have to install custom SSL certificates on all devices connected to your network like businesses do. PiHole would then use a copy of that custom certificate to decrypt the SSL, inspect/modify the contents, re-encrypt the contents with a normal SSL certificate, and send it off to its final destination. I've looked into this and it seems like there is no software out there that makes this easy. For it to be convenient enough to make sense, I think there would have to be some router 'login' page which makes downloading and installing the certificate as easy as possible. But, even 'easy as possible' would probably be too inconvenient for any guests who just want to use your wifi. Maybe it could be optional somehow. Don't install the custom certificate? Fine but you'll still get ads. Install the custom certificate? Awesome, your ads will be blocked.
- ziml77 4y ago
  PiHole blocks at a DNS level, uBlock blocks down to the page element level. If the ads are coming from the same domain as actual content, a DNS block can't be used since you'd be blocking the content that you're trying to view.
anthropodie 4y ago
If you liked PiHole I think you will like AdGuardHome more!
russellbeattie 4y ago
You'll need to make sure that you block popular DNS IPs like 8.8.8.8 because some devices (like Amazon's Fire Tablets) hard code the DNS address as backups.
codemac 4y ago
I found this basically only helped for laptops. Our phones and smart devices all use either DoH or hardcode a specific DNS resolver. I haven't spent the time going all the way down to re-routing all port 53 traffic, but I doubt it'll do much. To me the future of the home network is largely dead as long as I can't reasonably manage the software on these devices.
- goodburb 4y ago
  Hardcoded devices/software is a very good point, not sure why the text is faded/downvoted.
- Gigachad 4y ago
  Proprietary software and hardware is malware. Stallman told us this decades ago.
- cassianoleal 4y ago
  > Our phones and smart devices all use either DoH or hardcode a specific DNS resolver My phone uses whatever DNS I configure it to use. When I'm at home, it uses my PiHole. If you mean individual apps going their own way, that's a different problem.
- vonseel 4y ago
  I'm not sure about Android, but you can disable iCloud Private Relay by returning NXDOMAIN for the domains below. These are Adguard filtering rules, but you can configure something similar using dnsmasq or Pihole. ||mask.icloud.com^$dnsrewrite=NXDOMAIN;; ||mask-h2.icloud.com^$dnsrewrite=NXDOMAIN;; ||mask-api.icloud.com^$dnsrewrite=NXDOMAIN;; ||mask-t.apple-dns.net^$dnsrewrite=NXDOMAIN;; ||mask.apple-dns.net^$dnsrewrite=NXDOMAIN;; ||mask-api.fe.apple-dns.net^$dnsrewrite=NXDOMAIN;; I use these to automatically disable iCloud private relay, and I also have rules on my edgerouter to force certain devices to use my adguard instances for port 53 traffic, and it works well.
hackerbrother 4y ago
Side note- Pi Hole's client activity graphs are great for seeing how much you slept at night, or how long you've been out of the house!
amq 4y ago
A hosted alternative to pi-hole which will work wherever you go, also with a smartphone on mobile data: NextDNS.
goodburb 4y ago
You can get similar/higher speeds without ad-blocking by using DNSmasq's "all-server" with at least two upstream servers for forwarding.
walrus01 4y ago
for those who want something effective outside of their home network... ublock origin works fine as a plugin in firefox on android, and blocks ads just as effectively on firefox on desktop. the ability to install arbitrarily chosen firefox compatible plugins on firefox on android is a huge deal for me. it makes it almost as powerful and useful as firefox desktop. the only time I need to touch chrome anymore is when using some rare 1% of online shopping website that seems to think a firefox useragent is a bot.
ggping 4y ago
> I can now block all unwanted Ads and Metrics network wide. I love pihole - but this is still slightly exaggerated. DNS-based sinkholin does have its limitations.
ctur 4y ago
For those not wanting the overhead of running a service on your network, NextDNS sells what is basically managed pihole. I’ve used it for about a year and have been very happy. It also lets you use it on mobile devices for when you aren’t on your home network.
- nukemandan 4y ago
  you can configure to use a self hosted DNS. I do this coupled with a VPN that was very easy to install and configure: https://dietpi.com https://dietpi.com . this VPN I access with ddns for free. only fixed cost was the pi to run in (pi version 1 ram if by far enough for just pihole +unbound)
- sphars 4y ago
  I moved to NextDNS after my SD card died on my Pi. One of the biggest features is that I can enable this on my phone using Android's Private DNS feature, which means it works for mobile data without having to run a VPN. Covers all networks with no extra configuration. Highly recommend.
- notRobot 4y ago
  +1. Been using it for a year too, highly recommend!
- jen729w 4y ago
  Very slick try-before-you-buy experience. And excellent, realistic pricing. I’ll be giving this a go.
- aetherspawn 4y ago
  +1 for NextDNS, best $20 annually I ever spent. Been using it for close to two years.
- stavros 4y ago
  Same, and I love the pricing. 20 €/yr seems very reasonable for such a service, I'm happy to be paying for it.
- Vladimof 4y ago
beebmam 4y ago
If only it were possible to buy a Raspberry Pi at MSRP!
zacharycohn 4y ago
This was the kick in the pants I needed to finally set up one of these. It took 20 minutes to get up and running, and half of that time was finding a wall USB adapter to power it. Easy peasy lemon squeezy.
EVa5I7bHFq9mnYK 4y ago
Obviously, people whose products rely on those ads and telemetry, won't be happy and will try to retaliate, for example, by refusing you service. This frequently happens because of my usage of VPNs and ublock. In that case I have an option to quickly turn vpn/ublock off for that specific web site or service. In your case it's not so easy.
- heavyset_go 4y ago
  Plenty of ad-serving companies have found their way around DNS adblocking, including the top players in that market. Encrypted DNS looks like any other encrypted stream, there's no reason for subversive apps to rely on DHCP provided DNS servers when they can be guaranteed to serve ads without them.
- galleywest200 4y ago
  In the Pihole interface you have the option to disable the blocking for a few minutes at a time when you absolutely must get somewhere.
  - pixxel 4y ago
    Wouldn’t pausing pihole allow, say, a Roku box or “smart” TV to exfiltrate data that was previously blocked? This is why I use a VPN for certain websites to bypass pihole filtering.
- jaimex2 4y ago
  Given Apple is doing this on their products its a choice they'll have to make. They either put up with it or lose active users along with word of mouth.
TheBlerch 4y ago
I remember seeing an online service that provides the functionality of Pi Hole, blocking ads, protecting privacy and significantly speeding up browsing. Anyone familiar with it? If you’ve tried it, did you like it?
- evad3r 4y ago
  Looks like it was commented on here: https://news.ycombinator.com/item?id=31552552 https://news.ycombinator.com/item?id=31552552
zcbenz 4y ago
I have both Pi Hole and browser ad blocker plugin, the biggest problem is, sometimes a website does not function well or everything just loads extremely slow, I then have to spend some time debugging my network to know what is going wrong.
- deleted 4y ago
  [deleted]
zamadatix 4y ago
I love ad blockers such as this and uBlock Origin, they truly will make your experience cleaner than even offering to pay for services will, but you have to be careful to not fall into the "wow, <x> percent/count of my requests were for ads that's crazy!" trap when looking at their statistics. Often when services cannot reach something they are set to retry so it's very easy to turn 1 actual request into 100s of blocked retry-requests in statistics panel.
Falkon1313 4y ago
I was excited to try this once as a weekend project. Got it all set up and working so my desktop sent DNS through the Pi. Then went to set the router to use it instead, and it was a no-go. Comcast routers don't allow you to change the DNS settings. Of course I could've bought a new router and set that up to work between the Pi and the Comcast one, but that was more than I wanted to put into it. Now I have a different service with a different router, so if I can ever find the Pi, maybe I'll try it again.
- whatatita 4y ago
  I'd highly recommend going the network-wide route with router DNS settings. You might have some luck finding a pi here: https://rpilocator.com/ https://rpilocator.com/ . I set up a Pi-hole for my home network easy enough on a Fritzbox router, with the Pi-hole as DNS. I've since gone a step further, and now use the Pi-hole for DHCP too. The router now just routes.
charcircuit 4y ago
This article didn't actually test their network's latency / throughput before and after this. I don't think ads / metrics passively use a ton of bandwidth no I doubt the author's claims.
- WalterGR 4y ago
  Have you read about the subject or measured it on your own? Use the networking section of the developer tools in your browser. On a mainstream site I was just visiting, the page itself was about 50 kilobytes and it downloaded just under 3 megabytes of ad and tracking JS.
signa11 4y ago
instead of relying on an upstream dns, why not just run a caching recursive resolver, unbound for example ? your queries are not leaked…
Brajeshwar 4y ago
Pi-Hole is brilliant. I set up[1] one few years back and used for over a year. Here are the issues; - When I'm away from home and traveling, if something goes wrong, the Pi-Hole is usually the single source of that error, and is hard to solve by talking to my wife to walkthrough the settings. - A few websites (India in my case), mostly government ones, do not work when Ads are blocked. Try paying LIC Premium or even login to LIC of India with your DNS modified, Ads Blocked! - Wife want ads in some of her apps, "What did you do to my Ads!" Since then, the family was on NextDNS[2] for almost two years - premium member hitting million+ request a month from a 4-member family. With NextDNS slow to update when macOS changes the way they deal with Private Relay, I stumbled on AdGuard's DNS[3] (in beta now). I already bought the lifetime (family) AdGuard license sometime back. So, I tried it and am on it now. With the current setup, the last-mile choices of blocking ads or not blocking (for some website) is at the client (wife, daughter, and other devices). This works good so far -- everyone have a choice without being totally locked down. I have also taught my 13-year old daughter to keep a watch on Little Snitch. Here is the typical settings for all of the devices in our family, which works well when inside the home or outside. Apple's Private Relay (ON) > AdGuard with DNS Routing (OFF/ON) > (Optional VPN when needed) > Balanced/Bonded common ROUTER with minimal locked down settings > All of the ISP's entry routers. Nonetheless, I've been meaning to tinker so I can have Pi-Hole sitting between our family and the Internet but optionally circumventable easily -- perhaps a big Amber Button which even my 5-year old can press and go into the Internet momentarily. Edit: I forgot to add my thinking/concept/philosophy in all of this -- We should be able to walk out from most entrapments/situations/entities with minimal or no change needed. 1. https://brajeshwar.com/2019/pi-hole-blocking-ads-at-home/ https://brajeshwar.com/2019/pi-hole-blocking-ads-at-home/ 2. https://nextdns.io https://nextdns.io 3. https://adguard-dns.io/ https://adguard-dns.io/
- throwaway2037 4y ago
  <<premium member hitting million+ request a month from a 4-member family>> Cripes! That is amazing data. Thank you to share.
- Root_Denied 4y ago
  I also ran into the issue of a wife who didn't like the fact that I had set up a pihole, apparently it blocked a number of shopping websites she was regularly looking at. At the end of the day I looked at a few of the sites with her and whitelisted a couple of them, but basically told her that (based on the lists I was using) if the pihole was blocking the site entirely then it was either straight spam marketing or the site itself was malicious in some way.
jwithington 4y ago
Advertising powers the free and open web. Never sure how to feel about Pi Hole…
- mikefallen 4y ago
  A lot of shady advertising brokers also push malware. And many sites are only able to be used with some type of ad blocker because of how intrusive the ads are. Also the bandwidth savings can be huge in bandwidth constrained environments.
- krolden 4y ago
  There was a free and open web before it became littered with ads.
  - aulin 4y ago
    There even was a web where ads and content coexisted nicely. And a web where saying something was more important then selling something.
- hibernator149 4y ago
  My favourite channels on Youtube, once they become large enough they start to include sponsoring/ads. Production quality goes up, but my enjoyment and trust goes down. I prefer the old hobbyist internet over this manipulative and shallow ad-driven one. So I install adblockers on every system and I don't understand people that look at ads to support content creators. If you want to support, then why don't you use Patreon or subscriptions? (I wish micropayments had worked out)
  - jwithington 4y ago
    I do support a number of creators on Patreon and I myself make a tinyyyyy bit of money from Patreon. Your question is better asked to the creators in question I think. They prefer to provide you content through an ad-supported model.
- krageon 4y ago
cookiengineer 4y ago
Note that pi-hole can also be used by only installing the DNS resolver, without the web server and UI, which allows it to be installed on any tiny Linux system as well. Additionally I can recommend the "Privacy" web browser on Android combined with the "Rethink DNS" firewall. Both are amazing tools that help speed up your phone, and allow you to even filter ads out of specific apps that use e.g. an embedded cloudflare DoH resolving mechanism. If you want to dig deeper, there's always the Aurora App Warden and Permission Manager X which allows you to modify other Apps and remove their Activities and Services that are coming from ad frameworks. [1] https://www.stoutner.com/privacy-browser-android/ https://www.stoutner.com/privacy-browser-android/ [2] https://github.com/celzero/rethink-app https://github.com/celzero/rethink-app
nunez 4y ago
indeed. i use our pi for pi-hole and homebridge (single source for all of our wifi smart things). works amazingly; rock solid uptime too.
Ninjinka 4y ago
Still looking for a solution to block Hulu ads on a smart TV. ublock works in browsers, but no such luck on the Chromecast.
8fingerlouie 4y ago
I ran Pi Hole (and AdguardHome) for years, but eventually just upgraded to NextDNS instead. It works almost the same (minus the DHCP stuff), but instead of just working on your LAN, it works on every device all the time.
- aleppe7766 4y ago
  It works with any device you can install it on but not for example on cheap tv sticks, smart devices and other IoT stuff which still may be infested with adware phoning home every second. I’ve been using pi-hole at home and NextDNS/VPN outside as they’re more complementary than overlapping.
  - 8fingerlouie 4y ago
    I have my router hand out NextDNS resolvers per subnet, so that each VLAN uses a different NextDNS configuration. I use the NextDNS CLI[1], so i can take advantage of local DNS caching while at the same time using NextDNS. [1]: https://github.com/nextdns/nextdns/wiki https://github.com/nextdns/nextdns/wiki
teekert 4y ago
I run the combo Wireguard/Adguard, what is nice is that only the Wireguard clients have the DNS filter and the rest of the network is not affected. Also I have the filter when away from home. And another advantage to setting Adguard as DNS server in the router is that the clients are split in the analytics overview (otherwise it looks like there is only one client, the router and you can't set different filters for different clients). I do still have issues with keeping Wireguard running when I switch from lan to wan with my phone, so for now I'm setting it as conditional (only Wireguard on when outside of lan).
Roelven 4y ago
I've been running a pi-hole on my home network for years and I love it, it consistently blocks about 19% of outgoing requests. Some of the benefits for us are: - It disables (and hides) the annoying ads on our Samsung smart TV - Browsing is noticeably smoother (especially recipe websites on mobile!) - Most front-end browser trackers are blocked - It's now possible to see how often apps or devices tend to phone home by just logging into the Pihole web interface - We're not giving (most of) our DNS activity to our ISP - Updating to a newer version is a breeze with docker Some thoughts for folks considering getting one (or more): - I've not locked it down further with a firewall yet to force all DNS requests to go through the Pihole, but I'm planning to. - I won't run a Pihole container on my UDM as it will likely mess with future updates and settings, keeping things separate feels better. - Sometimes I consider adding more blocklists but every time I do, something gets annoying somewhere and I usually end up reverting to the standard config. My pet peeve has become to report login flows or frontend interactions that break when the tracking script fails to load because of my Pihole. It doesn't happen often luckily :-). (edit, formatting)
navjack27 4y ago
Yeah I run diversion and skynet on my Asus ac1900p running asuswrt-merlin. Been like that for a couple years now. It's great. Stuff like this should just run in the router if ya can.
sk00n2 4y ago
What if I told you, todays ads model is huge spam network?
snapplebobapple 4y ago
https://technitium.com/dns/ https://technitium.com/dns/ is what I switched to from pihole plus unbound and I havent looked back

423 points by pmoriarty 4y ago

Won't be long now until IoT and other crap-ware devices catch on to this trend and start hard-coding DNS servers in code, or worse, using DNS encryption to avoid this sort of routine blocking by end-users. I wonder how people are thinking about solving this problem.

Group_B 4y ago
One of many reasons why I don’t even bother with IoT devices. Don’t need all this crap to be connected to wifi. There was nothing wrong with it before.
- Deritiod 4y ago
  It's not crap just because you don't see a benefit. In my opinion, additional being a curios software engineer I find it quite interesting. Necessary? Perhaps not but helpful. Heating valves for example.
  - aksss 4y ago
    Not that I’m terribly experienced with it, but a lot of home automation can be done without “IoT” — specifically without the crapware Trojan controllers that come with consumer solutions from Best Buy. ISY994 for example. Easy solutions for remote access via apps (vpn to home) and notifications as well. It’s not as easy to set up as a plug and play controller from Google, but it’s far more private.
    - Deritiod 4y ago
      I include your example. The definition of iot from Wikipedia also does it. But honestly why I hate my iot window blinds device it's the perfect excuse to use vlan at home.
lapser 4y ago
This is already happening. The likes of Google Home et al already hardcode their own servers. I noticed that no DNS requests were being made through my Pi Hole, so when I looked, it turned out their DNS servers were hardcoded. However, I'm more worried about when they start hardcoding DoH servers.
- doubled112 4y ago
  Same on DoH. I can’t filter it or redirect it like I can with plain old DNS.
  - lapser 4y ago
    Yes, really the only way would be to set up a MITM proxy on your network and enforce all traffic goes through that. Also means accepting a CA.
    - 1vuio0pswjnm7 4y ago
      Been using this solution myself for a number of years. Works remarkably well. I do not even use DNS recursion or any remote DNS requests because I can load bulk DNS data into the proxy's memory. There is only ever one nonrecursive request to a localhost authoritative DNS server and the answer is always the same: the address of the proxy. Ironically perhaps, DoH outside the browser can be used to gather the bulk DNS data, thanks to HTTP/1.1 pipelining. Many years ago I anticipated that "developers" would no longer allow end users to choose DNS servers. The developers' work, i.e., software, was dropping in market value and they began to adopt a Trojan Horse "business model". End users could use the software for free with the expectation that few would notice/complain about increased surveillance and data collection, or injected advertising. The so-called "MITM proxy" is neither a new nor radical idea. Corporations routinely "MITM" TLS traffic from their networks. Enterprise hardware/software companies have provided turnkey solutions. The issue is not limited to addresses for DNS servers. For example, WhatsApp hardcodes IP addresses in their mobile app. For that problem I use an application firewall. The PiHole is essentially a slightly modified version of dnsmasq running on a RPi. It is funny that no one has tried using other DNS software. Given a choice of DNS software, I would not choose dnsmasq. It also still seems that no one has presented a "PiHole" that uses a forward proxy instead of a DHCP/DNS server. Similar to corporations, home users need a turnkey solution for monitoring their home networks.
timbit42 4y ago
Have your gateway/firewall block all traffic from the LAN IP of the device from exiting the LAN. If it's running on Win/Mac/Linux/Android/iOS, block the app from talking to the gateway, or even the entire LAN.
- pdimitar 4y ago
  That's what I do with my printer. I love the company (Brother) and they make IMO the best printers and MFPs but I am quite paranoid already and I just block any WAN traffic. The printer is (and should be) really only used from the LAN anyway.
phillipseamore 4y ago
I already translate all port 53 traffic to my local resolver and block known DoH addresses.
- gruez 4y ago
  If they're really evil, they'd proxy all traffic through a single host (eg. d2v3i0u0qtn52v.cloudfront.net), so you have to choose between no IOT features, or getting subjected to all the ads/telemetry.
  - everdrive 4y ago
    >so you have to choose between no IOT features I'll bring out the fainting couch. These devices are enough of a poison pill that you're better off without them. You can problem block them with Pihole, but you're one update away from either circumventing the Pihole, or breaking your IoT device because something got changed on the manufacturer's end.
    - gruez 4y ago
      At that point you're better off not connecting the device to the internet at all.
      - bee_rider 4y ago
        I think we might be at that point currently.
  - rsync 4y ago
    No - as I’ve said upthread, the real evil is running DoH on the www host. Now what ?
teeray 4y ago
DNAT ftw
dylan604 4y ago
Can you not just block the specific addresses? Sure, you'll probably have to do some log digging to find out which ones, but I'm guessing someone else on the internet has already done it.
- Gigachad 4y ago
  Sure, then the devices throw up an error and refuse to function. I noticed that most smart TV streaming apps refused to run if they failed to connect to their ad servers.
n4bz0r 4y ago
> I wonder how people are thinking about solving this problem. Not sure what potential issues are are being mentioned here, but I'd say a separate VLAN for IoT devices + QoS [0] should rule out most of the concerns. [0] https://en.m.wikipedia.org/wiki/Quality_of_service https://en.m.wikipedia.org/wiki/Quality_of_service
DistractionRect 4y ago
I solve this with a DNS based firewall. Essentially it's just DNS filtering on steriods. You start with an empty (or preseeded) ipset, and a firewall rule that says to reject/drop all outbound traffic if the destination isn't in the ipset. Dnsmasq is setup as the default dns provider in DHCP, and it's setup to add all resolved IPs to the ipset (with an expiration so stale entries get removed). Then it's just DNS filtering per the usual. DoH, DoQUIC, DoT, etc don't work as their hardcoded IPs are blocked by default, and DNS filtering knocks out domain resolution of the endpoints. Even if an alternate resolver is allowed through the firewall, none of it's responses get into the ipset, so it's still broken (and is a sign I need to update the DNS filter). Works a treat on my IoT devices
- BLKNSLVR 4y ago
  I really like the concept of this approach, I'd say it's worth writing a blog post / article describing the process and details so others can duplicate it.
- afraca 4y ago
  This is very very similar to something developed by SIDN labs called "DNS Resolution Required", you can read the blog post here: https://www.sidnlabs.nl/en/news-and-blogs/dns-resolution-required-can-help-make-the-internet-safer https://www.sidnlabs.nl/en/news-and-blogs/dns-resolution-req...
anthropodie 4y ago
You solve that by not buying such crap-ware. You buy open hardware systems.
- ghostpepper 4y ago
  I would love if there was an open 4K HDR TV but I think only a very niche audience actually cares about this so most manufacturers will not see a market opportunity
  - throwaway2037 4y ago
    I see your point. Real question: In today's world, what is the difference between a TV and a computer monitor + RasPi? I guess the biggest issue will be streaming on services with very strict operating system / browser requirements. For example, can you stream Netflix @ 4K via RasPi? I assume no, due to super strict DRM. It is a little bit surprising to me that the big streaming companies have not creating an open source operating system (similar to Android) that can be used by manuf to create TVs. Then, smaller manuf can find ways to offer bloatware- / adware-free options. Maybe this already exists, and this comment makes no sense!
    - krageon 4y ago
      Size. You cannot get the quality and size of a TV in a monitor form factor.
    - piperswe 4y ago
      Size, OLED, HDR, and eARC are three things I can't find in a monitor. I don't know of any 55" OLED monitors that support Dolby Vision and can output their audio to my home audio system over eARC. OLED and Dolby Vision are important to me because HDR makes such a huge difference in properly mastered content. eARC is important because my audio system is able to take advantage of Dolby Atmos metadata and I don't want to lose that. I could just pass my HDMI inputs through my receiver, but my receiver doesn't support passing through 4k 120Hz which I appreciate using with my Xbox. HDR and OLED are available in some monitor models, but to my knowledge there aren't any 55" monitors with HDR and OLED, and especially eARC.
zeroflow 4y ago
There is a workaround by enabling NAT and forcing all traffic to piHole / pfblockerNG https://docs.netgate.com/pfsense/en/latest/recipes/dns-redirect.html https://docs.netgate.com/pfsense/en/latest/recipes/dns-redir...
- rsync 4y ago
  How does this help with DoH? If the dns request is over 443 and the DoH server is the same host as the served resource, what can be done ?
  - jamiek88 4y ago
    Could you MITM and inspect for dns request packets?
    - rsync 4y ago
      Yes - I postulated this elsewhere in this thread. The next step in the arms race would then be to implement DoHoH. Sigh.
asix66 4y ago
I couple PiHole with a pfsense router. In pfsense all DNS queries are blocked except to my pihole. This thwarts an IoT device or streaming devices, etc., from bypassing pihole. Then I block known DoH servers on both pfsense and pihole---which is not perfect, since it's really a game of whack-a-mole, but better than not.
mmcnl 4y ago
It's already happening, but hardcoding also causes other issues. You have to be really big before you can depend on a hardcoded DNS server.
RachelF 4y ago
Microsoft already does this in Windows 8, 10 and 11 with their "telemetry" servers. The DNS queries for these bypass any of your own DNS settings. They even bypass host file overrides.
- no_time 4y ago
  On the upside, the endpoints are nicely documented by both MS and independent researchers. Also, Windows enforces packet filtering rules on it's own phoning home so a well configured firewall like SimpleWall will be relatively secure from a spying perspective. https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Cyber-Sicherheit/SiSyPHus/Workpackage4_Telemetry.pdf https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Cyber-Si... https://www.henrypp.org/product/simplewall https://www.henrypp.org/product/simplewall
heavyset_go 4y ago
Already happening, Google products like the Chromecast serve up plenty of obnoxious ads these days, and hardcode Google DNS. Even blocking Google DNS still allows ads to get through. This is a big reason why I will never buy another Chromecast branded product, or Google product, again. Congratulations on successfully monetizing my time and annoying me into swearing off Google products altogether.
e2le 4y ago
> Smart devices manufacturers often “hard-code” in a public DNS server, like Google’s 8.8.8.8, and their devices ignore whatever DNS server is assigned by your router - such as your PiHole. > Nearly 70% of smart TVs and 46% of game consoles were found to contain hardcoded DNS settings - allowing them to simply ignore your local network’s DNS server entirely. On average, Smart TVs generate an average of 60 megabytes of outgoing Internet traffic per day, all the while bypassing tools like PiHole. https://labzilla.io/blog/force-dns-pihole https://labzilla.io/blog/force-dns-pihole For those devices which ignore DHCP/NDP provided DNS addresses, you could create a firewall to redirect outgoing port 53 traffic to your own server.

monkellipse 4y ago

Can confirm, pihole is great. I put in two for redundancy, helps make sure nothing gets through. No negative impact on network perf, as it only touches DNS and plenty fast for that.

albert_e 4y ago
you have them as primary and secondary for failover?
- monkellipse 4y ago
  Yes, exactly. DNS settings on router makes that easy, just give each pihole a static address and point DNS to them. The address are listed in priority.

quyleanh 4y ago

I would like to use Adguard Home instead of Pi Hole for better up stream DNS query.

2OEH8eoCRo0 4y ago
I prefer Adguard as well.
NelsonMinar 4y ago
I use the free level of NextDNS. Not self-hosted, for better and worse.
vladvasiliu 4y ago
What do you mean? What's wrong with PiHole's upstream queries?
nicolas_ 4y ago
Same here. I have it coupled with Tailscale to enjoy the same benefits remotely on my phone https://nicolaslouge.com/post/install-adguard-home-raspberry-pi-enable-remote-acces-via-tailscale/ https://nicolaslouge.com/post/install-adguard-home-raspberry...

kayson 4y ago

While the interface may not be as pretty, you can do the same thing if you're running pfsense using the pfblocker-ng package: https://docs.netgate.com/pfsense/en/latest/packages/pfblocker.html https://docs.netgate.com/pfsense/en/latest/packages/pfblocke... You can also so geo-based IP blocking Combined with pfsense's recursive resolved (unbound), it makes for a pretty great home dns setup.

pdimitar 4y ago
I know some of these words. [cries in not being network-admin educated] Jokes aside, I'd love a blog post on this. Seriously. Very likely to apply the knowledge as well.
- kayson 4y ago
  I would suggest starting with the pfsense documentation. It's great!
lousken 4y ago
i am considering pfsense for my homelab setup - can you easily troubleshoot issues and whitelist addresses if you need to?
- harmon 4y ago
- zeroflow 4y ago
  Yeah. You have a live logging tab and can either put the URL into a whitelist rule by clicking on the plus icon or manually input it into a whitelist setting.
- slickdork 4y ago
  I recommend opnsense [0] over pfsense. I ran pfsense for 5 years and it is great, but there was some bad blood [1] between the two projects and the community. [0] https://opnsense.org/ https://opnsense.org/ [1] https://teklager.se/en/pfsense-vs-opnsense/ https://teklager.se/en/pfsense-vs-opnsense/

jrmg 4y ago

Like any other project I run everything in a Docker container, and this project should be no different. What is the advantage of this in this case?

NegativeLatency 4y ago
Specifically relating to pihole (as of previous versions) it wasn’t the cleanest install uninstall experience and left a bunch of crap behind on my system. I now run it in a docker container because of this, but I can’t speak to OPs motivations
- mmcnl 4y ago
  I run everything in a Docker container because I have 50+ services running, and I don't want to spend any time on their inner workings. I truly couldn't care less. I only manage the access layers (configuration parameters, volumes, ports and reverse proxy). Using Docker every application is the same from a management perspective.
dspillett 4y ago
> What is the advantage of this in this case? Not specific to PiHole, but perhaps keeping the OPs infrastructure management consistent may have monitoring and maintenance benefits. And specifically mentioned in the very next sentence: > The Pi Hole project already has a nice Docker project utilizing compose. It is a supported configuration for PiHole so it fits in nicely, no need to even product their own docker based solution. Not much of a docker user myself (I've tinkered, and we use it for some things in DayJob, but for my own stuff I use VMs or occasionally LCX if I do want a container instead), but the answer to your questions was really quite obvious.
ocdtrekkie 4y ago
Any special setup amongst your network takes excess work to maintain. In the case of Pihole, I gave up on maintaining it because I was running it on a Raspberry Pi, and found that it was annoyingly hard to keep a Pi running stable for a long period of time. Had I a convenient way to set it up in a Docker container, it would've been better. Of course, since I don't run anything in Docker at home, that would also constitute a special setup I have to maintain.

deleted 4y ago

[deleted]

ferminaut 4y ago

I know some folks are anti Ubiquiti Unifi on here, but you can run pihole (along with a bunch of other stuff) right on a UDM/UDM-Pro. IMO it makes the most sense to run this on the router, and you can run it in a docker container. If you're looking for a fun hour or two project, check out: https://github.com/boostchicken-dev/udm-utilities/tree/master/run-pihole https://github.com/boostchicken-dev/udm-utilities/tree/maste...

pcl 4y ago
I run a PiHole and a Tailscale exit node on my Unifi routers (previous generation). The Tailscale exit node lets me do both site-to-site VPNs and site-specific egress. The one thing keeping me from site network nirvana is that I haven't quite figured out how to set up a wifi network on the Ubiquiti device that routes all traffic through a given other exit node, however. Someday!
- deleted 4y ago
  [deleted]
- gonehome 4y ago
  I just setup tailscale yesterday to access a local urbit node and it’s seriously great! They really solved what has always been a major pain with local hosting and made it really easy to use. I ended up using NextDNS over pihole, but only because it was just easier to get the same result.
- oceanswave 4y ago
  Does setting the gateway address on the wifi network to be your tailscale exit node ip work?
- vamega 4y ago
  What router do you have? I've got a USG and was wondering if it was possible to run PiHole on the USG.
moffkalast 4y ago
Ah I just opened this thread to ask why isn't this a standard feature on routers at this point, and lo and behold. I hope it becomes more ubiquitous (hah) even on lower cost ones eventually.

agomez314 4y ago

How does this compare to using Brave Browser with ad blocking?

sneak 4y ago
It blocks a lot of the phone-home from Apple devices that is built in to the OS and happens outside of the browser.
newscracker 4y ago
It’s different but has some similarities. This blocks all kinds of configured (DNS) requests from your devices, even from apps and operating systems, whereas Brave browser only blocks ads on the browser. One drawback is that this solution does DNS level blocking, and cannot handle any web page element-level blocking that may be possible in some browsers.

fareesh 4y ago

I use OpenWRT and Ad blocking on my router - is the pi hole solution superior?

prometheus1909 4y ago

I keep seeing posts about Pi Holes and it looks good, but I have previously dealt with ads by appending their delivering sites to my /etc/hosts, i.e. 0.0.0.0 trashsite1.com 0.0.0.0 trashsite2.com The only downside I see is that my approach is not network-wide. Any other reasons I should reconsider?

pcl 4y ago
Probably the biggest two selling points are the crowdsourced deny list and the fact that all types of devices will benefit, including "smart" TVs etc.
mFixman 4y ago
Similarly, why is PiHole better than using a browser ad-blocker?
- eyluo 4y ago
  My understanding is that PiHole stops the ads from being downloaded in the first place, hence the increased network performance.
  - dserodio 4y ago
    uBlock prevents then from being downloaded too
    - aulin 4y ago
      ublock only works inside Firefox on mobile, this blocks most ads in every app, smart tvs, iot devices
- majkinetor 4y ago
  You should have both. One is for network wide effects, so anything on your network will have ads blocked (smart TV, projector, phones etc.), another is for youtube and friends.
- 4y ago

godelski 4y ago

Every time I've tried pihole it has failed on services like YouTube. Can someone explain this to me and how I solve it? I know it's not just me, it even happened to Linus Tech Tips but I constantly hear responses "works for me" which are unhelpful. If ublock works fine, why can't pihole? I'm actually interested in a technical answer.

datfrojo 4y ago
Pihole only works if ads are served from a distinct domain name from content. This works in most cases but YouTube serves ads and content from the same place so pihole can’t prevent. As uBlock works client side it does not face this limitation
- godelski 4y ago
  So wouldn't there be a way to intercept the data and apply the same blocking that uBlock does and then resend it? I know it would have a delay, but that'd probably be worth it to me tbh.
  - nabakin 4y ago
    It would be very hard to do so because SSL prevents middlemen from intercepting and modifying data. You'd have to install custom SSL certificates on all devices connected to your network like businesses do. PiHole would then use a copy of that custom certificate to decrypt the SSL, inspect/modify the contents, re-encrypt the contents with a normal SSL certificate, and send it off to its final destination. I've looked into this and it seems like there is no software out there that makes this easy. For it to be convenient enough to make sense, I think there would have to be some router 'login' page which makes downloading and installing the certificate as easy as possible. But, even 'easy as possible' would probably be too inconvenient for any guests who just want to use your wifi. Maybe it could be optional somehow. Don't install the custom certificate? Fine but you'll still get ads. Install the custom certificate? Awesome, your ads will be blocked.
ziml77 4y ago
PiHole blocks at a DNS level, uBlock blocks down to the page element level. If the ads are coming from the same domain as actual content, a DNS block can't be used since you'd be blocking the content that you're trying to view.

anthropodie 4y ago

If you liked PiHole I think you will like AdGuardHome more!

russellbeattie 4y ago

You'll need to make sure that you block popular DNS IPs like 8.8.8.8 because some devices (like Amazon's Fire Tablets) hard code the DNS address as backups.

codemac 4y ago

I found this basically only helped for laptops. Our phones and smart devices all use either DoH or hardcode a specific DNS resolver. I haven't spent the time going all the way down to re-routing all port 53 traffic, but I doubt it'll do much. To me the future of the home network is largely dead as long as I can't reasonably manage the software on these devices.

goodburb 4y ago
Hardcoded devices/software is a very good point, not sure why the text is faded/downvoted.
Gigachad 4y ago
Proprietary software and hardware is malware. Stallman told us this decades ago.
cassianoleal 4y ago
> Our phones and smart devices all use either DoH or hardcode a specific DNS resolver My phone uses whatever DNS I configure it to use. When I'm at home, it uses my PiHole. If you mean individual apps going their own way, that's a different problem.
vonseel 4y ago
I'm not sure about Android, but you can disable iCloud Private Relay by returning NXDOMAIN for the domains below. These are Adguard filtering rules, but you can configure something similar using dnsmasq or Pihole. ||mask.icloud.com^$dnsrewrite=NXDOMAIN;; ||mask-h2.icloud.com^$dnsrewrite=NXDOMAIN;; ||mask-api.icloud.com^$dnsrewrite=NXDOMAIN;; ||mask-t.apple-dns.net^$dnsrewrite=NXDOMAIN;; ||mask.apple-dns.net^$dnsrewrite=NXDOMAIN;; ||mask-api.fe.apple-dns.net^$dnsrewrite=NXDOMAIN;; I use these to automatically disable iCloud private relay, and I also have rules on my edgerouter to force certain devices to use my adguard instances for port 53 traffic, and it works well.

hackerbrother 4y ago

Side note- Pi Hole's client activity graphs are great for seeing how much you slept at night, or how long you've been out of the house!

amq 4y ago

A hosted alternative to pi-hole which will work wherever you go, also with a smartphone on mobile data: NextDNS.

goodburb 4y ago

You can get similar/higher speeds without ad-blocking by using DNSmasq's "all-server" with at least two upstream servers for forwarding.

walrus01 4y ago

for those who want something effective outside of their home network... ublock origin works fine as a plugin in firefox on android, and blocks ads just as effectively on firefox on desktop. the ability to install arbitrarily chosen firefox compatible plugins on firefox on android is a huge deal for me. it makes it almost as powerful and useful as firefox desktop. the only time I need to touch chrome anymore is when using some rare 1% of online shopping website that seems to think a firefox useragent is a bot.

ggping 4y ago

> I can now block all unwanted Ads and Metrics network wide. I love pihole - but this is still slightly exaggerated. DNS-based sinkholin does have its limitations.

ctur 4y ago

For those not wanting the overhead of running a service on your network, NextDNS sells what is basically managed pihole. I’ve used it for about a year and have been very happy. It also lets you use it on mobile devices for when you aren’t on your home network.

nukemandan 4y ago
you can configure to use a self hosted DNS. I do this coupled with a VPN that was very easy to install and configure: https://dietpi.com https://dietpi.com . this VPN I access with ddns for free. only fixed cost was the pi to run in (pi version 1 ram if by far enough for just pihole +unbound)
sphars 4y ago
I moved to NextDNS after my SD card died on my Pi. One of the biggest features is that I can enable this on my phone using Android's Private DNS feature, which means it works for mobile data without having to run a VPN. Covers all networks with no extra configuration. Highly recommend.
notRobot 4y ago
+1. Been using it for a year too, highly recommend!
jen729w 4y ago
Very slick try-before-you-buy experience. And excellent, realistic pricing. I’ll be giving this a go.
aetherspawn 4y ago
+1 for NextDNS, best $20 annually I ever spent. Been using it for close to two years.
stavros 4y ago
Same, and I love the pricing. 20 €/yr seems very reasonable for such a service, I'm happy to be paying for it.
Vladimof 4y ago

beebmam 4y ago

If only it were possible to buy a Raspberry Pi at MSRP!

zacharycohn 4y ago

This was the kick in the pants I needed to finally set up one of these. It took 20 minutes to get up and running, and half of that time was finding a wall USB adapter to power it. Easy peasy lemon squeezy.

EVa5I7bHFq9mnYK 4y ago

Obviously, people whose products rely on those ads and telemetry, won't be happy and will try to retaliate, for example, by refusing you service. This frequently happens because of my usage of VPNs and ublock. In that case I have an option to quickly turn vpn/ublock off for that specific web site or service. In your case it's not so easy.

heavyset_go 4y ago
Plenty of ad-serving companies have found their way around DNS adblocking, including the top players in that market. Encrypted DNS looks like any other encrypted stream, there's no reason for subversive apps to rely on DHCP provided DNS servers when they can be guaranteed to serve ads without them.
galleywest200 4y ago
In the Pihole interface you have the option to disable the blocking for a few minutes at a time when you absolutely must get somewhere.
- pixxel 4y ago
  Wouldn’t pausing pihole allow, say, a Roku box or “smart” TV to exfiltrate data that was previously blocked? This is why I use a VPN for certain websites to bypass pihole filtering.
jaimex2 4y ago
Given Apple is doing this on their products its a choice they'll have to make. They either put up with it or lose active users along with word of mouth.

TheBlerch 4y ago

I remember seeing an online service that provides the functionality of Pi Hole, blocking ads, protecting privacy and significantly speeding up browsing. Anyone familiar with it? If you’ve tried it, did you like it?

evad3r 4y ago
Looks like it was commented on here: https://news.ycombinator.com/item?id=31552552 https://news.ycombinator.com/item?id=31552552

zcbenz 4y ago

I have both Pi Hole and browser ad blocker plugin, the biggest problem is, sometimes a website does not function well or everything just loads extremely slow, I then have to spend some time debugging my network to know what is going wrong.

deleted 4y ago
[deleted]

zamadatix 4y ago

I love ad blockers such as this and uBlock Origin, they truly will make your experience cleaner than even offering to pay for services will, but you have to be careful to not fall into the "wow, <x> percent/count of my requests were for ads that's crazy!" trap when looking at their statistics. Often when services cannot reach something they are set to retry so it's very easy to turn 1 actual request into 100s of blocked retry-requests in statistics panel.

Falkon1313 4y ago

I was excited to try this once as a weekend project. Got it all set up and working so my desktop sent DNS through the Pi. Then went to set the router to use it instead, and it was a no-go. Comcast routers don't allow you to change the DNS settings. Of course I could've bought a new router and set that up to work between the Pi and the Comcast one, but that was more than I wanted to put into it. Now I have a different service with a different router, so if I can ever find the Pi, maybe I'll try it again.

whatatita 4y ago
I'd highly recommend going the network-wide route with router DNS settings. You might have some luck finding a pi here: https://rpilocator.com/ https://rpilocator.com/ . I set up a Pi-hole for my home network easy enough on a Fritzbox router, with the Pi-hole as DNS. I've since gone a step further, and now use the Pi-hole for DHCP too. The router now just routes.

charcircuit 4y ago

This article didn't actually test their network's latency / throughput before and after this. I don't think ads / metrics passively use a ton of bandwidth no I doubt the author's claims.

WalterGR 4y ago
Have you read about the subject or measured it on your own? Use the networking section of the developer tools in your browser. On a mainstream site I was just visiting, the page itself was about 50 kilobytes and it downloaded just under 3 megabytes of ad and tracking JS.

signa11 4y ago

instead of relying on an upstream dns, why not just run a caching recursive resolver, unbound for example ? your queries are not leaked…

Brajeshwar 4y ago

Pi-Hole is brilliant. I set up[1] one few years back and used for over a year. Here are the issues; - When I'm away from home and traveling, if something goes wrong, the Pi-Hole is usually the single source of that error, and is hard to solve by talking to my wife to walkthrough the settings. - A few websites (India in my case), mostly government ones, do not work when Ads are blocked. Try paying LIC Premium or even login to LIC of India with your DNS modified, Ads Blocked! - Wife want ads in some of her apps, "What did you do to my Ads!" Since then, the family was on NextDNS[2] for almost two years - premium member hitting million+ request a month from a 4-member family. With NextDNS slow to update when macOS changes the way they deal with Private Relay, I stumbled on AdGuard's DNS[3] (in beta now). I already bought the lifetime (family) AdGuard license sometime back. So, I tried it and am on it now. With the current setup, the last-mile choices of blocking ads or not blocking (for some website) is at the client (wife, daughter, and other devices). This works good so far -- everyone have a choice without being totally locked down. I have also taught my 13-year old daughter to keep a watch on Little Snitch. Here is the typical settings for all of the devices in our family, which works well when inside the home or outside. Apple's Private Relay (ON) > AdGuard with DNS Routing (OFF/ON) > (Optional VPN when needed) > Balanced/Bonded common ROUTER with minimal locked down settings > All of the ISP's entry routers. Nonetheless, I've been meaning to tinker so I can have Pi-Hole sitting between our family and the Internet but optionally circumventable easily -- perhaps a big Amber Button which even my 5-year old can press and go into the Internet momentarily. Edit: I forgot to add my thinking/concept/philosophy in all of this -- We should be able to walk out from most entrapments/situations/entities with minimal or no change needed. 1. https://brajeshwar.com/2019/pi-hole-blocking-ads-at-home/ https://brajeshwar.com/2019/pi-hole-blocking-ads-at-home/ 2. https://nextdns.io https://nextdns.io 3. https://adguard-dns.io/ https://adguard-dns.io/

throwaway2037 4y ago
<<premium member hitting million+ request a month from a 4-member family>> Cripes! That is amazing data. Thank you to share.
Root_Denied 4y ago
I also ran into the issue of a wife who didn't like the fact that I had set up a pihole, apparently it blocked a number of shopping websites she was regularly looking at. At the end of the day I looked at a few of the sites with her and whitelisted a couple of them, but basically told her that (based on the lists I was using) if the pihole was blocking the site entirely then it was either straight spam marketing or the site itself was malicious in some way.

jwithington 4y ago

Advertising powers the free and open web. Never sure how to feel about Pi Hole…

mikefallen 4y ago
A lot of shady advertising brokers also push malware. And many sites are only able to be used with some type of ad blocker because of how intrusive the ads are. Also the bandwidth savings can be huge in bandwidth constrained environments.
krolden 4y ago
There was a free and open web before it became littered with ads.
- aulin 4y ago
  There even was a web where ads and content coexisted nicely. And a web where saying something was more important then selling something.
hibernator149 4y ago
My favourite channels on Youtube, once they become large enough they start to include sponsoring/ads. Production quality goes up, but my enjoyment and trust goes down. I prefer the old hobbyist internet over this manipulative and shallow ad-driven one. So I install adblockers on every system and I don't understand people that look at ads to support content creators. If you want to support, then why don't you use Patreon or subscriptions? (I wish micropayments had worked out)
- jwithington 4y ago
  I do support a number of creators on Patreon and I myself make a tinyyyyy bit of money from Patreon. Your question is better asked to the creators in question I think. They prefer to provide you content through an ad-supported model.
krageon 4y ago

cookiengineer 4y ago

Note that pi-hole can also be used by only installing the DNS resolver, without the web server and UI, which allows it to be installed on any tiny Linux system as well. Additionally I can recommend the "Privacy" web browser on Android combined with the "Rethink DNS" firewall. Both are amazing tools that help speed up your phone, and allow you to even filter ads out of specific apps that use e.g. an embedded cloudflare DoH resolving mechanism. If you want to dig deeper, there's always the Aurora App Warden and Permission Manager X which allows you to modify other Apps and remove their Activities and Services that are coming from ad frameworks. [1] https://www.stoutner.com/privacy-browser-android/ https://www.stoutner.com/privacy-browser-android/ [2] https://github.com/celzero/rethink-app https://github.com/celzero/rethink-app

nunez 4y ago

indeed. i use our pi for pi-hole and homebridge (single source for all of our wifi smart things). works amazingly; rock solid uptime too.

Ninjinka 4y ago

Still looking for a solution to block Hulu ads on a smart TV. ublock works in browsers, but no such luck on the Chromecast.

8fingerlouie 4y ago

I ran Pi Hole (and AdguardHome) for years, but eventually just upgraded to NextDNS instead. It works almost the same (minus the DHCP stuff), but instead of just working on your LAN, it works on every device all the time.

aleppe7766 4y ago
It works with any device you can install it on but not for example on cheap tv sticks, smart devices and other IoT stuff which still may be infested with adware phoning home every second. I’ve been using pi-hole at home and NextDNS/VPN outside as they’re more complementary than overlapping.
- 8fingerlouie 4y ago
  I have my router hand out NextDNS resolvers per subnet, so that each VLAN uses a different NextDNS configuration. I use the NextDNS CLI[1], so i can take advantage of local DNS caching while at the same time using NextDNS. [1]: https://github.com/nextdns/nextdns/wiki https://github.com/nextdns/nextdns/wiki

teekert 4y ago

I run the combo Wireguard/Adguard, what is nice is that only the Wireguard clients have the DNS filter and the rest of the network is not affected. Also I have the filter when away from home. And another advantage to setting Adguard as DNS server in the router is that the clients are split in the analytics overview (otherwise it looks like there is only one client, the router and you can't set different filters for different clients). I do still have issues with keeping Wireguard running when I switch from lan to wan with my phone, so for now I'm setting it as conditional (only Wireguard on when outside of lan).

Roelven 4y ago

I've been running a pi-hole on my home network for years and I love it, it consistently blocks about 19% of outgoing requests. Some of the benefits for us are: - It disables (and hides) the annoying ads on our Samsung smart TV - Browsing is noticeably smoother (especially recipe websites on mobile!) - Most front-end browser trackers are blocked - It's now possible to see how often apps or devices tend to phone home by just logging into the Pihole web interface - We're not giving (most of) our DNS activity to our ISP - Updating to a newer version is a breeze with docker Some thoughts for folks considering getting one (or more): - I've not locked it down further with a firewall yet to force all DNS requests to go through the Pihole, but I'm planning to. - I won't run a Pihole container on my UDM as it will likely mess with future updates and settings, keeping things separate feels better. - Sometimes I consider adding more blocklists but every time I do, something gets annoying somewhere and I usually end up reverting to the standard config. My pet peeve has become to report login flows or frontend interactions that break when the tracking script fails to load because of my Pihole. It doesn't happen often luckily :-). (edit, formatting)

navjack27 4y ago

Yeah I run diversion and skynet on my Asus ac1900p running asuswrt-merlin. Been like that for a couple years now. It's great. Stuff like this should just run in the router if ya can.

sk00n2 4y ago

What if I told you, todays ads model is huge spam network?

snapplebobapple 4y ago

https://technitium.com/dns/ https://technitium.com/dns/ is what I switched to from pihole plus unbound and I havent looked back