8 ms·

I know some folks are anti Ubiquiti Unifi on here, but you can run pihole (along with a bunch of other stuff) right on a UDM/UDM-Pro. IMO it makes the most sens

I know some folks are anti Ubiquiti Unifi on here, but you can run pihole (along with a bunch of other stuff) right on a UDM/UDM-Pro. IMO it makes the most sense to run this on the router, and you can run it in a docker container. If you're looking for a fun hour or two project, check out: https://github.com/boostchicken-dev/udm-utilities/tree/master/run-pihole https://github.com/boostchicken-dev/udm-utilities/tree/maste...

pcl 4y ago
I run a PiHole and a Tailscale exit node on my Unifi routers (previous generation). The Tailscale exit node lets me do both site-to-site VPNs and site-specific egress. The one thing keeping me from site network nirvana is that I haven't quite figured out how to set up a wifi network on the Ubiquiti device that routes all traffic through a given other exit node, however. Someday!
- deleted 4y ago
  [deleted]
- gonehome 4y ago
  I just setup tailscale yesterday to access a local urbit node and it’s seriously great! They really solved what has always been a major pain with local hosting and made it really easy to use. I ended up using NextDNS over pihole, but only because it was just easier to get the same result.
- oceanswave 4y ago
  Does setting the gateway address on the wifi network to be your tailscale exit node ip work?
- vamega 4y ago
  What router do you have? I've got a USG and was wondering if it was possible to run PiHole on the USG.
moffkalast 4y ago
Ah I just opened this thread to ask why isn't this a standard feature on routers at this point, and lo and behold. I hope it becomes more ubiquitous (hah) even on lower cost ones eventually.
- pledg 4y ago
  It’s not a standard feature on UniFi either. It’s possible but not part of the OOTB OS.
asdkhadsj 4y ago
What sort of cost is associated with pihole, with respect mostly to very latency sensitive things like competitive gaming. Is it problematic?
- more_corn 4y ago
  No expected impact. If for some insane reason a game is also calling as servers your performance will be improved. Consider the case of a web page. The content you want (the news article) consists of say 100 get requests totaling 1mb. The content you don’t want (ads) consists of 120 get requests totaling 1.2mb. When pihole is in use the content you want does not have to contend with adversarial content. You have half as many requests, there’s 50% less data in the pipe, you get what you wanted faster. Gaming is not impacted because your games don’t call advertising servers. If they did (for some insane reason) the real game requests get served immediately not having to wait in line behind the ad content.
  - deleted 4y ago
    [deleted]
- milgrim 4y ago
  There should be no cost. Which game will constantly use DNS to resolve addresses after being launched?
  - Brybry 4y ago
    I caught a bug related to this in Project Zomboid in an early multiplayer version. Often when someone joined a server there would be a tiny bit of lag for all of the users. I figured out the server was using a java method that indirectly was doing a blocking DNS lookup. I think it was reverse DNS but I forget which method it actually was, and if it was blocking the main thread or just the networking thread. (PiHole still wouldn't have created an additional cost though.)
    - milgrim 4y ago
Vaslo 4y ago
I have the UDM pro but have been running AdGuard home. I will definitely have to check this out. Thanks!
goodburb 4y ago
For OpenWRT users, I managed to easily get it working with LXC. Sources are in "SmoothWAN" project at Github. OpenWRT natively supports LXC now. Shortcut: https://github.com/TalalMash/smoothwan-feeds/tree/main/piholeconf/net/usr/lib/piholeconf https://github.com/TalalMash/smoothwan-feeds/tree/main/pihol...
- ronjouch 4y ago
  For OpenWRT users, there's even simpler: use the "adblock" and "luci-app-adblock" packages :) . https://github.com/openwrt/packages/blob/master/net/adblock/files/README.md https://github.com/openwrt/packages/blob/master/net/adblock/... https://openwrt.org/docs/guide-user/services/ad-blocking https://openwrt.org/docs/guide-user/services/ad-blocking https://forum.openwrt.org/t/adblock-support-thread/507 https://forum.openwrt.org/t/adblock-support-thread/507
- cassianoleal 4y ago
  Never heard of smoothwan but I've been running PiHole on LXC on OpenWRT for years. It was never difficult to set it up, I just created a Debian (or Devuan, can't remember now) container and ran the PiHole install on it.
dawnerd 4y ago
Huh, I never even considered running containers on my udm pro. I’m definitely going to look into this.
para_parolu 4y ago
I have another point of view as a non-pro user. The leas thing my router is doing the better. I want my router software be as simple as possible to reduce possible bugs. Plus I want it to put all cpu time onto processing packets. I would consider using pihole like functionality if it’s baked in firmware. But definitely don’t want to install extra software.
- colordrops 4y ago
  Unless you are doing deep packet inspection, which isn't useful in most home setups anyway, even mediocre hardware is going to be more than powerful enough to process packets while running PiHole or AdGuard home.
jeffkeen 4y ago
I'm afraid to ask, but why are people anti ubiquity? I freaking love my udm-pro and am waiting for their cams to come back in stock so I can ditch my nests.
- rovr138 4y ago
  They tried to cover a breach. They sued Krebs for publishing on it. There have been other issues too.
  - ewzimm 4y ago
    Krebs had inaccurate info at the time. The breach was faked by an employee who was part of the investigation team. https://krebsonsecurity.com/2021/12/ubiquiti-developer-charged-with-extortion-causing-2020-breach/ https://krebsonsecurity.com/2021/12/ubiquiti-developer-charg...
    - chrisweekly 4y ago
      Yeah, Krebs published this updated take: "On Wednesday, a former Ubiquiti developer was arrested and charged with stealing data and trying to extort his employer while pretending to be a whistleblower. "Federal prosecutors say Nickolas Sharp, a senior developer at Ubiquiti, actually caused the “breach” that forced Ubiquiti to disclose a cybersecurity incident in January."
      - ewzimm 4y ago
        No matter how good your security is, a rogue employee with high-level access will always be a threat. Since they now have experience with this situation, I trust that Ubiquiti has dedicated more resources to preventing both employee sabotage and external breaches. This also shows that not every breach is what it seems, and investigating fully before publicly disclosing can sometimes help prevent disinformation. The “whistleblower” in this case was intentionally lying, and every customer that dedicated time to mitigation had to pay part of the cost.
8fingerlouie 4y ago
Be aware that UI is planning to consolidate the UDM/UDM Pro software (1.x) into the UDM Pro SE / UDW software branch (2.x) in the near future, and the 2.x software doesn't use Podman and instead runs the software "bare metal". IIRC the udm-utilities also work on the UDM Pro SE, though i'd be a lot more worried about "messing up" when it's not confined to a docker container.
- boostchicken 4y ago
  Worry not, I am ready for it :)
sleepdreamy 4y ago
Why are some folks anti Ubiquiti Unifi? We use this at some of our clients in the MSP space
boostchicken 4y ago
I just checked my github stats and you guys slammed ycombinator right to the top of the referrals, didn't know it was getting so much love over here.

pcl 4y ago

I run a PiHole and a Tailscale exit node on my Unifi routers (previous generation). The Tailscale exit node lets me do both site-to-site VPNs and site-specific egress. The one thing keeping me from site network nirvana is that I haven't quite figured out how to set up a wifi network on the Ubiquiti device that routes all traffic through a given other exit node, however. Someday!

deleted 4y ago
[deleted]
gonehome 4y ago
I just setup tailscale yesterday to access a local urbit node and it’s seriously great! They really solved what has always been a major pain with local hosting and made it really easy to use. I ended up using NextDNS over pihole, but only because it was just easier to get the same result.
oceanswave 4y ago
Does setting the gateway address on the wifi network to be your tailscale exit node ip work?
vamega 4y ago
What router do you have? I've got a USG and was wondering if it was possible to run PiHole on the USG.

moffkalast 4y ago

Ah I just opened this thread to ask why isn't this a standard feature on routers at this point, and lo and behold. I hope it becomes more ubiquitous (hah) even on lower cost ones eventually.

pledg 4y ago
It’s not a standard feature on UniFi either. It’s possible but not part of the OOTB OS.

asdkhadsj 4y ago

What sort of cost is associated with pihole, with respect mostly to very latency sensitive things like competitive gaming. Is it problematic?

more_corn 4y ago
No expected impact. If for some insane reason a game is also calling as servers your performance will be improved. Consider the case of a web page. The content you want (the news article) consists of say 100 get requests totaling 1mb. The content you don’t want (ads) consists of 120 get requests totaling 1.2mb. When pihole is in use the content you want does not have to contend with adversarial content. You have half as many requests, there’s 50% less data in the pipe, you get what you wanted faster. Gaming is not impacted because your games don’t call advertising servers. If they did (for some insane reason) the real game requests get served immediately not having to wait in line behind the ad content.
- deleted 4y ago
  [deleted]
milgrim 4y ago
There should be no cost. Which game will constantly use DNS to resolve addresses after being launched?
- Brybry 4y ago
  I caught a bug related to this in Project Zomboid in an early multiplayer version. Often when someone joined a server there would be a tiny bit of lag for all of the users. I figured out the server was using a java method that indirectly was doing a blocking DNS lookup. I think it was reverse DNS but I forget which method it actually was, and if it was blocking the main thread or just the networking thread. (PiHole still wouldn't have created an additional cost though.)
  - milgrim 4y ago

Vaslo 4y ago

I have the UDM pro but have been running AdGuard home. I will definitely have to check this out. Thanks!

goodburb 4y ago

For OpenWRT users, I managed to easily get it working with LXC. Sources are in "SmoothWAN" project at Github. OpenWRT natively supports LXC now. Shortcut: https://github.com/TalalMash/smoothwan-feeds/tree/main/piholeconf/net/usr/lib/piholeconf https://github.com/TalalMash/smoothwan-feeds/tree/main/pihol...

ronjouch 4y ago
For OpenWRT users, there's even simpler: use the "adblock" and "luci-app-adblock" packages :) . https://github.com/openwrt/packages/blob/master/net/adblock/files/README.md https://github.com/openwrt/packages/blob/master/net/adblock/... https://openwrt.org/docs/guide-user/services/ad-blocking https://openwrt.org/docs/guide-user/services/ad-blocking https://forum.openwrt.org/t/adblock-support-thread/507 https://forum.openwrt.org/t/adblock-support-thread/507
cassianoleal 4y ago
Never heard of smoothwan but I've been running PiHole on LXC on OpenWRT for years. It was never difficult to set it up, I just created a Debian (or Devuan, can't remember now) container and ran the PiHole install on it.

dawnerd 4y ago

Huh, I never even considered running containers on my udm pro. I’m definitely going to look into this.

para_parolu 4y ago

I have another point of view as a non-pro user. The leas thing my router is doing the better. I want my router software be as simple as possible to reduce possible bugs. Plus I want it to put all cpu time onto processing packets. I would consider using pihole like functionality if it’s baked in firmware. But definitely don’t want to install extra software.

colordrops 4y ago
Unless you are doing deep packet inspection, which isn't useful in most home setups anyway, even mediocre hardware is going to be more than powerful enough to process packets while running PiHole or AdGuard home.

jeffkeen 4y ago

I'm afraid to ask, but why are people anti ubiquity? I freaking love my udm-pro and am waiting for their cams to come back in stock so I can ditch my nests.

rovr138 4y ago
They tried to cover a breach. They sued Krebs for publishing on it. There have been other issues too.
- ewzimm 4y ago
  Krebs had inaccurate info at the time. The breach was faked by an employee who was part of the investigation team. https://krebsonsecurity.com/2021/12/ubiquiti-developer-charged-with-extortion-causing-2020-breach/ https://krebsonsecurity.com/2021/12/ubiquiti-developer-charg...
  - chrisweekly 4y ago
    Yeah, Krebs published this updated take: "On Wednesday, a former Ubiquiti developer was arrested and charged with stealing data and trying to extort his employer while pretending to be a whistleblower. "Federal prosecutors say Nickolas Sharp, a senior developer at Ubiquiti, actually caused the “breach” that forced Ubiquiti to disclose a cybersecurity incident in January."
    - ewzimm 4y ago
      No matter how good your security is, a rogue employee with high-level access will always be a threat. Since they now have experience with this situation, I trust that Ubiquiti has dedicated more resources to preventing both employee sabotage and external breaches. This also shows that not every breach is what it seems, and investigating fully before publicly disclosing can sometimes help prevent disinformation. The “whistleblower” in this case was intentionally lying, and every customer that dedicated time to mitigation had to pay part of the cost.

8fingerlouie 4y ago

Be aware that UI is planning to consolidate the UDM/UDM Pro software (1.x) into the UDM Pro SE / UDW software branch (2.x) in the near future, and the 2.x software doesn't use Podman and instead runs the software "bare metal". IIRC the udm-utilities also work on the UDM Pro SE, though i'd be a lot more worried about "messing up" when it's not confined to a docker container.

boostchicken 4y ago
Worry not, I am ready for it :)

sleepdreamy 4y ago

Why are some folks anti Ubiquiti Unifi? We use this at some of our clients in the MSP space

boostchicken 4y ago

I just checked my github stats and you guys slammed ycombinator right to the top of the referrals, didn't know it was getting so much love over here.