6 ms·

The issue there is pihole is only useful on your local network. You could expose it to the internet but that's a horrible idea. You could also VPN into your hom

by gojou 4y ago

The issue there is pihole is only useful on your local network. You could expose it to the internet but that's a horrible idea. You could also VPN into your home network I guess but that's often not feasible.

pluc 4y ago
There are PiHole-as-a-Service... services out there
mrchucklepants 4y ago
I do exactly this. I have WireGuard running on my pihole server. All my devices are set to connect automatically when off my home network.
martin_a 4y ago
> You could expose it to the internet but that's a horrible idea. Been there, done that. It was a mistake. Not sure which attacks my public PiHole was part of, but I surely was part of some. It's a shame, I'd really like to offer this as a service to friends, because I think they would be able to change the DNS settings of their routers and enjoy a safer surfing experience. I don't want to get started with distributing key pairs to connect to a VPN and whatnot. PiHole really has a sweet spot there with its ease-of-use but it fails in regards of security/protection against becoming part of DNS-based attacks.
- bush-bby 4y ago
  > Been there, done that. It was a mistake. Not sure which attacks my public PiHole was part of, but I surely was part of some. How did you come to this conclusion? How did you come to know?
  - martin_a 4y ago
    The PiHole has some integrated logging where you can see the requests that were made. I had several IPs which were doing queries for the same domains dozens of times per second. That wasn't a poweruser but some kind of automated system, probably doing reflection attacks or sth. alike. I think PiHole has improved since that time, you can now set throttling, but I'm not sure I'd run a public PiHole anymore.
    - pluc 4y ago
      pihole + fail2ban google that my man
      - martin_a 4y ago
        Thanks! Only knew fail2ban from securing SSH, but yeah, works for other daemons, too...
rrix2 4y ago
My pihole listens only on my server's TailScale interface, and have MagicDNS set to use the server's tailnet IP. Phone and laptops get it using the app, LAN gets it with subnet routing.
xnyan 4y ago
As others say, use a VPN like wireguard. If bandwidth or latency over the VPN is a concern, you can setup your VPN to only route DNS requests over the VPN.
unethical_ban 4y ago
I run Pi-hole and pi-vpn on a VM at home, and have my mobile phone set to always-on VPN. I have occasionally had to disable the VPN on public wifi that blocks the high UDP port, but I think that could be gotten around with udp/443 which is used by QUIC/Google a lot. udp/53 inbound is blocked on my ATT home network.
lostlogin 4y ago
> You could also VPN into your home network I guess. It works beautifully. I think it hurts battery life on phones, but that hasn't been tested by me in any meaningful way.

by gojou 4y ago

pluc 4y ago

There are PiHole-as-a-Service... services out there

mrchucklepants 4y ago

I do exactly this. I have WireGuard running on my pihole server. All my devices are set to connect automatically when off my home network.

martin_a 4y ago

> You could expose it to the internet but that's a horrible idea. Been there, done that. It was a mistake. Not sure which attacks my public PiHole was part of, but I surely was part of some. It's a shame, I'd really like to offer this as a service to friends, because I think they would be able to change the DNS settings of their routers and enjoy a safer surfing experience. I don't want to get started with distributing key pairs to connect to a VPN and whatnot. PiHole really has a sweet spot there with its ease-of-use but it fails in regards of security/protection against becoming part of DNS-based attacks.

bush-bby 4y ago
> Been there, done that. It was a mistake. Not sure which attacks my public PiHole was part of, but I surely was part of some. How did you come to this conclusion? How did you come to know?
- martin_a 4y ago
  The PiHole has some integrated logging where you can see the requests that were made. I had several IPs which were doing queries for the same domains dozens of times per second. That wasn't a poweruser but some kind of automated system, probably doing reflection attacks or sth. alike. I think PiHole has improved since that time, you can now set throttling, but I'm not sure I'd run a public PiHole anymore.
  - pluc 4y ago
    pihole + fail2ban google that my man
    - martin_a 4y ago
      Thanks! Only knew fail2ban from securing SSH, but yeah, works for other daemons, too...

rrix2 4y ago

My pihole listens only on my server's TailScale interface, and have MagicDNS set to use the server's tailnet IP. Phone and laptops get it using the app, LAN gets it with subnet routing.

xnyan 4y ago

As others say, use a VPN like wireguard. If bandwidth or latency over the VPN is a concern, you can setup your VPN to only route DNS requests over the VPN.

unethical_ban 4y ago

I run Pi-hole and pi-vpn on a VM at home, and have my mobile phone set to always-on VPN. I have occasionally had to disable the VPN on public wifi that blocks the high UDP port, but I think that could be gotten around with udp/443 which is used by QUIC/Google a lot. udp/53 inbound is blocked on my ATT home network.

lostlogin 4y ago

> You could also VPN into your home network I guess. It works beautifully. I think it hurts battery life on phones, but that hasn't been tested by me in any meaningful way.