20 ms·

Pi-hole: Network-wide ad blocking

438 points by axiomdata316 4y ago

xurukefi 4y ago
I'm always (pleasantly) surprised to see that DNS sinkholing is still a viable option. Couldn't smart tv vendors or the like simply hardcode DNS resolvers and use DNSSEC or DoH (with certificate pinning) to circumvent it?
- kccqzy 4y ago
  They don't bother (yet). As long as they know only tech geeks are attempting this custom DNS config, and those tech geeks are unlikely to click on ads, they don't bother going the next step. Now, if Pi-hole or similar suddenly becomes mainstream, that'd be a different story.
jmakov 4y ago
Also Nextdns. Hapoy user.
- cramjabsyn 4y ago
  Hapoy hapoy jpy jpy
- activatedgeek 4y ago
  Opened the comments to put in a recommendation for NextDNS. The free plan allows 300k DNS queries and is more than enough for me across three devices (Mac/iPhone/iPad). I have not needed an ad-blocker for the past 2 years and hardly see any websites breaking. Often syndicate links break, which is not a big deal for me.
- chanandler_bong 4y ago
  +100 for NextDNS. Happy paying customer here. Aside from it just working, their mobile client is a fantastic thing. When I am off wifi, my phone routes DNS to NextDNS and I get the same adblocking when I am on cellular data.
  - hbcondo714 4y ago
    Me too, my Android / Samsung phone has a "Private DNS"[1] setting where I specify my NextDNS instead of using their mobile app. [1] https://news.ycombinator.com/item?id=28365321 https://news.ycombinator.com/item?id=28365321
  - mixmastamyk 4y ago
    Sounds good, are they selling your queries?
    - ignoramous 4y ago
      Don't think they are, but if you're after privacy, of course it isn't strictly better than self-hosting AdGuard Home or Pi-Hole. As one ex, not me but some may be uncomfortable with their use of BigCloud (AWS/GCP/Cloudflare) infrastructure.
  - nehal3m 4y ago
    For those who prefer Pi-Hole, I set up a VPN server on my PfSense so my devices can use the DNS server in my home network when I'm out. The fact that traffic is encrypted is a nice bonus. I do this on a symmetrical 500Mbit fiber line, YMMV.
- JFKKFJ 4y ago
  [dead]
- kstenerud 4y ago
  I used it at home and liked it... for 10 days, after which it stopped working because I'd hit some limit. For 1 computer, 1 Amazon TV stick, and 1 phone that I barely use, 10 days max is pretty bad. So I uninstalled it and went with adguard, which doesn't arbitrarily stop working.
  - mritzmann 4y ago
    > because I'd hit some limit (..) 10 days max is pretty bad The free(!) plan includes 300,000 queries per month. That is transparent everywhere. On the website, pricing page and in the dashboard. You can even see how much you have already used. That's pretty fair for a free service for which you pay nothing. For me, that's enough for a whole month. > (..) which doesn't arbitrarily stop working 1. NextDNS sends an email before the limit is reached 2. Once the limit is reached, no more ads are blocked, but dns continues to work
    - kstenerud 4y ago
      Hey if it works for you, great. It didn't work for me. 10 days casual use for 1 person and then "pay me" is not a positive experience, so I found another solution.
      - randomguy0 4y ago
        What? It’s a paid for service.
      - Terretta 4y ago
        How many days should a paid service give you free casual use for a positive experience? You are using a consumable (CPU & data transfer, along with your desired amount of analytics data storage) that they pay for, and, shockingly, they are not ad supported.
    - blakeburch 4y ago
      I currently use a pi-hole. In a home of 2, we have 74k queries per day. That would effectively be a 4 day trial... so I can understand the other person's frustration.
- stranded22 4y ago
  Nextdns here too! I gave pihole a shot but an update went wrong and I had to muck around getting it to work again (it was also my dhcp, so was a pain whilst working from home!) Back to nextdns and it’s smooth. I have different profiles set up - a home one (for everything that can’t take DoH, including my work laptop), one for my son (his iPad), one for my wife (no logging, minimal ad blocking, allowing Facebook) and one for my devices (lots of different blockers). It also works outside of my network too. I pay the £17/year as I feel allo of this is worth supporting.
- cpressland 4y ago
  The only feature NextDNS is missing that I’d love (and am tempted to switch to Pi-Hole / Adguard to get) is Custom DNS records. I really don’t wana run my own DNS Server forwarding to NextDNS just to do this. Edit: I just discovered this is a thing “Settings > Rewrite”
- benhurmarcel 4y ago
  It's good but unfortunately their Windows and Linux clients are fairly buggy.
javchz 4y ago
I use to be anti AdBlock, as a lot of the creators I follow get food over the table thanks to ads... But man, things got out of control, the industry have gone so hostile, where a typical site went from 30% ads 70% content to the inverse and worse. What I hate the most it's how the try to scam no savvy tech people, like grandparents and for those scenarios pi hole it's a tool made in heaven (specially as there are not global adblocks extensions for mobile devices) I still don't use for my personal network, but for my senior family members that use tech only for video streaming or reading the news, this it's an amazing gift.
- ge96 4y ago
  Jim Browning fights the good fight Yeah a lot of sites (articles) there's an ad between every paragraph or they scroll you to the bottom which has those garbage sites as you try to leave.
- knodi123 4y ago
  > What I hate the most it's how the try to scam no savvy tech people, like grandparents and Oh, that's my utter bane. My mom knows better, I've taught her how the manipulations work, and then she'll show me a pertinent article on her tablet, and see an utterly outrageous clickbait link from Outbrain or Taboola or the like, like "This mom found out her kids were smoking WHAT?!" and pictures of some bugs or whatever. And she'll get a guilty and tortured expression and say "Oh, I know they're probably manipulating me, but I have to find out what this is about." No!!! You really don't have to! I tried to sneakily install ublock, but I made ONE mistake when trying to add a custom filter on a site she regularly visits, which broke her user experience for 3 minutes before I fixed it, and she demanded I immediately uninstall the "hacker programs".
  - pontilanda 4y ago
    The sad thing about clickbait is that it works wonders, and you'll never guess what happens next!
    - knodi123 4y ago
cloudking 4y ago
AdGuard on Home Assistant is another good solution, has some additional filtering options too like enforcing safe search on Google and YouTube https://www.home-assistant.io/integrations/adguard/ https://www.home-assistant.io/integrations/adguard/
mafuyu 4y ago
What finally got me to setup pi-hole on an old Raspberry Pi was getting an LG OLED TV. The webOS apps for YouTube and Plex are pretty convenient, but the TV was absolutely packed with ads via the home screen and pop-up toasts. To add insult to injury, the home screen would lag for several seconds at boot while it pulled down all those ads. And then I discovered that even after opting out of all the telemetry options, it was making DNS queries for _several_ data mining services that analyze what's being shown on the TV. I didn't Wireshark it to see what API calls it was making, but clearly opting out in the menu wasn't enough. After some passes of scanning the pi-hole logs and adding to the blacklist, my TV is snappier and ad-free. :) Definitely will not be going with LG for my next TV, though. It's mind blowing to me that this is the user experience on a TV that costs over $1k. As for the pi-hole setup itself, it's working great. It's a great backup to locally installed adblockers, and I have my EdgeRouter as the primary DHCP DNS server, which makes requests to pi-hole. Both the router and pi-hole have caching, and my DNS query latencies are good. Pi-hole also has a nice interface for pointing `.local` domains to local IP addresses, which is much easier than messing with dnsmasq settings on the EdgeRouter.
- metadat 4y ago
  I wrote a recommendation about this 7 months ago (oh my, how time flies): https://news.ycombinator.com/item?id=31707222 https://news.ycombinator.com/item?id=31707222 tl;dr: If the TV is working well enough already, it may be ill-advised to connect it to the network. The apps, while convenient, can be supplanted by an external AppleTV or similar for minimal cost relative to a nice TV. This protects the TV not only from being a privacy threat and general ad-ridden nuisance, but also from receiving potentially harmful updates that can lead to performance regressions.
  - ErikCorry 4y ago
    Offline TV plus online Chromecast works fine for me.
  - kapep 4y ago
    That just seems to shift all concerns from one device to another. Is AppleTV or similar devices so much better when it comes to privacy? Or is the selling point just that they don't show ads?
cpuguy83 4y ago
I ran into too many problems with pihole breaking sites so I just turned it off.
- muppetman 4y ago
  You should look at the oisd blacklist. It's curated to ensure that it doesn't break anything and in my testing The last 3 months, it lives up to its name very well. I haven't had any sites break or any reports from the kids about things not working. Prior to that the block list I use would sometimes stop the Apple store from working and those sorts of things, it was very annoying.
  - DavideNL 4y ago
    Or perhaps https://v.firebog.net/hosts/lists.php?type=tick https://v.firebog.net/hosts/lists.php?type=tick via https://v.firebog.net/hosts/lists.php https://v.firebog.net/hosts/lists.php which also describes 'Whitelisting Suggestions'. Alternative: https://github.com/jacklul/pihole-updatelists https://github.com/jacklul/pihole-updatelists
    - muppetman 4y ago
      There's lots of other solutions, but I've had zero problems since swithcing to osid and I pipe a lot of things (Nintendo Switch, kids iPads, my Google phones, my laptops) through it and it hasn't given me a single issue. It certainly DOES let through a few more trackers, but that's the cost of a list that doesn't cause problems.
- chanandler_bong 4y ago
  That's like saying your seatbelt is uncomfortable so you don't wear it while you're driving. Don't take it off, find a solution to make it work. Use a better block list (OISD has been mentioned already), or use NextDNS. Neither of those cause breaks in most sites and stop the most bothersome/prevalent ads.
- highdeserthackr 4y ago
muppetman 4y ago
I used to use pi-hole. Then I replaced it with adguard home. Adguard home is a single go binary, and it properly supports HTTPS and secure DNS out of the box. Pi-hole is great, Adguard home is greater I think. At the end of the day though they both provide the same service. But I like that with adguard home I can have TLS DNS so I can have my mobile phone use private DNS via it even when it's not at home.
- moontear 4y ago
  I agree. Also better DNS rewrite support for split DNS scenarios. I do like the dashboard and analysis possibilities of Pi-Hole better
- t0bia_s 4y ago
  You cannot ad blocklist in batch in AdGuard. Also developers are from Russia with headquarter in Cyprus.
  - machinekob 4y ago
    But code is open source so r*ussians who cares?
    - DavideNL 4y ago
      It's kind of suspicious though, that you cannot find any info on for example who the Adguard CEO is, on their website. Most companies have an "about us" section with info where at least you can see who the people/management are. Instead, they provide a vague page: https://adguard.com/en/contacts.html https://adguard.com/en/contacts.html
    - le-mark 4y ago
      Is anyone compiling from source or are most all installing precompiled binaries? How does one verify a binary matches the source with no additional code? This is a rhetorical question meant as an excercise for the reader.
  - muppetman 4y ago
ck2 4y ago
Not quite as good but a free fallback https://adguard-dns.io/en/public-dns.html#addresses https://adguard-dns.io/en/public-dns.html#addresses Also ublock-origin works on Firefox mobile.
- nipperkinfeet 4y ago
  I found out recently Adguard DNS also hides placeholders of blocked elements inside Android apps. I don't need MinMinGuard anymore.
  - ignoramous 4y ago
    It may or may not matter, but: MinMinGuard is FOSS, AdGuard for Android is not.
    - folmar 4y ago
      It think it is:https://github.com/AdguardTeam/ContentBlocker/blob/master/COPYING https://github.com/AdguardTeam/ContentBlocker/blob/master/CO...
    - nipperkinfeet 4y ago
      The issue is that MinMinGuard hasn't received an update in a while and has ceased functioning for me on Android 12.
- mackrevinack 4y ago
  kiwi is another mobile (chrome) browser that supports extensions as well
inamberclad 4y ago
I had a pi-hole set up for quite a little while, but my partner complained that they could no longer click on google shopping links. It boggled my mind that anyone actually clicked on these, but now I have to find a way to whitelist their devices.
- impish9208 4y ago
  You can create a group of devices for which the DNS filtering doesn’t apply to.
- thrdbndndn 4y ago
  I don't use Google shoppings, but I click Amazon shopping ads on some indie/personal sites all the time. For example, one of the them is a music database website. Its ad shows the links to buy the CDs (it's in Japan, FWIW). I find it very continent; I often just go Amazon to check info even if I don't want to buy.
- muppetman 4y ago
  Look at the oisd blocklist. It's very comprehensive (I removed all other Blocklist) and it ensures that it doesn't break any users experiences.
- LilBytes 4y ago
  As others have stated I worked around it by setting up a wifi connection with different DNS servers and adding '- No Adblock' to the SSID. Not all routers have this functionality and if it doesn't you should be able to flash Tomato or similar, or use PfSense. Depending how home baked you want to go.
- westhom 4y ago
  Exact same reason I stopped using pi-hole. It bugged out Google shopping and my partner complained. And the whitelisting / access control is annoying UX imo so I went back to normal DNS. Might return to it eventually but not enable it for every dhcp client. Edit: and her iPhone changes its MAC address randomly so the access control was tricky to maintain.
sodality2 4y ago
A truly better alternative to pi-hole while still self hosted is AdGuardHome: https://github.com/AdguardTeam/AdGuardHome#comparison-pi-hole https://github.com/AdguardTeam/AdGuardHome#comparison-pi-hol...
- moistly 4y ago
  What makes this better?
  - sodality2 4y ago
    The link is to a table comparing the two, showing how it’s better.
    - moistly 4y ago
      Gotcha, thx.
    - DavideNL 4y ago
      ...written by Adguard itself. Not exactly an independent objective comparison :)
  - 6ak74rfy 4y ago
    For me, it was the fact that AdGuard Home supports a lot of good things out of the box. For e.g., DoH/DoT for upstream resolvers, really easy to enable DoH to the AdGuard Home interface itself etc.
- djhworld 4y ago
  I looked at this and played with it a little. One crucial thing I use my pihole for is to forward traffic going to the .lan top level domain to my reverse proxy (traefik), I couldn't figure out how to do this in the pihole UI so I just added a custom config file to /etc/dnsmasq.d which works perfectly. I'm not sure what adguard uses but would be interested to here if it's possible! EDIT: just seen it supports DNS rewrites, which seems to do a similar job. Nice! I might give this a shot for a while
windex 4y ago
What I am beginning to notice is some apps and devices now seem to have "baked in" addresses and dont rely on the pihole.
- chanandler_bong 4y ago
  If your router can do it, have it route all of your DNS queries to your (pi-hole|adguard|nextdns). Doesn't matter if they are hardcoded to 8.8.8.8, anything to port 53 goes through the blocker. Asus Merlin firmware handles this nicely.
  - smolyeet 4y ago
    I finally ended up setting up my own router with opnsense which you can do for pretty cheap. Either a pc with two ports, a vm on a server if you are into that , or going dedicated hardware like mentioned above. If you really want to understand what goes on your network this is the way to go.
  - mixmastamyk 4y ago
    That brings up the question of what is the best router these days. Mine is getting long in the tooth.
    - chanandler_bong 4y ago
      I recently upgraded to an ZenWiFi Pro XT12. Expensive, but I have zero wifi issues now, and with the Merlin firmware, nearly infinite control. The only downside of the XT12 is that there are no USB ports, so you cannot have external storage. Definitely WTF, but an OK trade-off for me.
  - Havoc 4y ago
    Was considering this but concerned it’ll break company laptop dns functionality
    - chanandler_bong 4y ago
nunez 4y ago
This is absolutely essential if you care at all about reducing Internet ads. Runs on anything, is dead simple to use and you can funnel your entire home internet through it.
password4321 4y ago
Don't miss AdGuardHome https://news.ycombinator.com/item?id=33787505#33790602 https://news.ycombinator.com/item?id=33787505#33790602
hit8run 4y ago
What are you running it on? Linuxbox? A real Pi? Just curious.
- monotux 4y ago
  My setup is on a cheap thin client, buying a pic is too expensive :) I mainly use pihole for ease of setting up and its user interface. I’m using knot-resolver for upstream queries and knot for local zones. I’ve started to read up on dnstap to see if I can emulate some of the pihole statistics but pihole is still good enough.
- cyphax 4y ago
  I run it on a real Pi, a very old model B. One cpu core, little memory, yet it runs fast and even the web interface is plenty snappy.
aaron695 4y ago
[dead]
vk6flab 4y ago
My Pi-hole has been running in a Docker container on my main workstation for several years. I tend to refresh it once a month or so with a simple configuration as shown in the example files. docker pull pihole/pihole:latest docker run -d \ --name pihole \ --restart=unless-stopped \ -p 192.168.1.1:53:53/tcp \ -p 192.168.1.1:53:53/udp \ -p 80:80 \ -e TZ="Australia/Perth" \ -e PIHOLE_DNS_="1.1.1.1\;1.0.0.1" \ -e WEBPASSWORD="{redacted}" \ -e DNSMASQ_LISTENING=all \ pihole/pihole:latest
- yokoprime 4y ago
  why not docker-compose? so nice to just do the old up / down
  - lostlogin 4y ago
    I did that but it doesn’t play nice with containers on the same host and they lose wan access (but have lan access). I run it separately now.
- Yajirobe 4y ago
  Is raspberry's throughput enough to handle the load?
  - Tomte 4y ago
    It's just DNS traffic going through the device, not videos.
shrx 4y ago
It's a great project, but I'm waiting for the day it will be able to block ads that roll before youtube videos play.
- bertman 4y ago
  Which will never happen for DNS-only blockers like pi-hole. See e.g. here: https://github.com/AdguardTeam/AdGuardHome#known-limitations https://github.com/AdguardTeam/AdGuardHome#known-limitations
  - shrx 4y ago
    Adguard apparently plans to support it: https://github.com/AdguardTeam/AdGuardHome/issues/1228 https://github.com/AdguardTeam/AdGuardHome/issues/1228
- imperistan 4y ago
  I had the same thought but it is not possible. I installed as blockers on my PCs, SmartTubeNext on my Android tv and finally YT vanced on my phone
  - shrx 4y ago
    Thanks, I'll check out SmartTubeNext!
- velhartice 4y ago
  Brave browser blocks all youtube video ads.
  - hellojason 4y ago
    Seconding this. I use Brave strictly as my YouTube viewer.
account-5 4y ago
I'm thinking of getting a hi-res projector instead of a smart TV. I had a Samsung smart TV but got rid of it last year because of the ads, slow start up, bad sound, and just all-round bad anti-user crapware that was on it. Reverted back to my old (10 year old) dumb Samsung and it's much better hooked up to a streaming stick. I long for the days when all you had to consider when getting a new TV was color, resolution, picture quality, frame rate, etc. Instead of what OS it's running, how long you'll get update, how bad the advertisings going to be, as well as the above. Any recommendations for a decent projector?
- t0bia_s 4y ago
  I dont have smart TV, however I have BenQ MH550 over 3 years. Just for Kodi and pictures. It's great. Since then I'm barely go to cinema, except film festivals. And I'm partly work in film industry. Look for DLP projectors if you want watch primally films. They can adjust frequency to FPS of played media and colour reproduction is more pleasant to watch. Avoid LCD projectors. They are great for presentations and graphic in bright environment, not for film reproduction in dark room.
  - beagle3 4y ago
    Unfortunately, I can't enjoy DLP projectors due to the rainbow effect - It's LCD only for me. https://pointerclicker.com/rainbow-effect-projector/ https://pointerclicker.com/rainbow-effect-projector/
    - t0bia_s 4y ago
      I never had that issue. I also use "eco" mode that reduces brightness and contrast. In dark room full brightness could indeed hurt your eyes. And colour reproduction is not that great.
- kriz9 4y ago
  I am currently testing out Epson ls500 as a tv replacement. It has been great so far. Only downside is the ugly "periscope" on top and the throw distance being a bit too far so it takes too much space away from the living room. Epson ls800 looks like the perfect projector but is still a bit pricey. Ls800 has a much shorter throw distance and looks much better in the living room.
kevinhq 4y ago
I always reject ads: https://www.reddit.com/r/rejectads/ https://www.reddit.com/r/rejectads/
goodpoint 4y ago
So overrated.
mfashby 4y ago
Haven't seen blocky mentioned yet, another pi-hole type program but a bit more minimal https://0xerr0r.github.io/blocky/ https://0xerr0r.github.io/blocky/
lproven 4y ago
Does anyone know of a version of, or way to run, Pi-Hole on TrueNAS Core? That's what my home NAS runs, and while its list of "appliances" is quite long, it doesn't contain any network ad-blockers, AFAICS. I am not bothered on the TV. I bought a ~15YO Panasonic Viera TH-46PZ80E, a huge plasma thing that is almost totally dumb. It cost me £/$ 60 a year ago, and it's great. It talks to a cable TV box and an elderly Mac mini for playing videos. Works a treat, costs very little, and zero online advertising. I have got Kodi on it and our phones for a "ten foot UI", but using macOS is easy enough that we never need it.
- sofixa 4y ago
  The easier route would be to run AdGuard Home since it's a single Golang binary therefore quite easy to compile and run in a jail by yourself.
- zomg 4y ago
  you can run pi-hole in a docker container on truenas.
  - lproven 4y ago
    Interesting. Do you have any pointers to how to do that? TrueNAS Core is a FreeBSD distro. Docker is a Linux tool. That implies to me I'd need a Linux distro in a VM, then Docker on that, then more config on top. Which sounds hard. Which is why people run this stuff on dedicated small cheap computers. I predicted containers were the next big thing 3 years before Docker was founded, but I do not run containers on production servers. My job is writing about this stuff, not running servers. :-) I write about it because I used to run servers in production for a living, and I didn't like doing it. I prefer writing.
    - CoolCold 4y ago
      TrueNAS Scale is Linux based
      - lproven 4y ago
spicyusername 4y ago
Pi-hole is a must have in my opinion. So many sites are basically unusable without it.
jcpham2 4y ago
Simple adblock package from openwrt repo works wonders and is way simpler than dealing with a raspi or some other separate server. Some of y’all seem to enjoy bringing work home and tinkering and maintaining hardware at home - but some of us don’t I’ll keep my ad blocking on my router thank you very much
- tgv 4y ago
  My router is an integrated thingy from my provider. I can't mod it.
  - folmar 4y ago
    Daisy chaining is not very bad apart from power consumption.
bretbernhoft 4y ago
How many domains do you guys have blocked? I am at around four million domains blocked on my Pi-hole.
djhworld 4y ago
Been using this software for years, it's excellent. It's really eye opening when you have it turned off as well, like suddenly the filters are lifted and you see what the reality is for most people. Sadly the cat and mouse game between ad vendors and systems like this is, the DNS sinkholing method is either being circumvented thanks to rapidly changing/randomised hostnames outpacing the adlist authors, or ads are rendered server side. I've never been able to get it to work as the primary DNS source on the router though, so I always have to configure my devices to statically point to the IP of the pihole, but that's just a minor inconvienience (although annoying when devices like TVs don't allow you to configure DNS, or override it secretly for their own stuff)
milosmns 4y ago
I tried this a couple of times and I was never able to completely turn off YouTube ads on my LG TV, no matter how many blocklists I pulled. I wonder... is there's a special setting for DNS routing inside of the TV that allows YT to bypass pi-hole?
- randomguy0 4y ago
  Are the ads served from the same place as the video content itself?
- crackedbassoon 4y ago
  Pihole doesn’t block YouTube adds.
Helmut10001 4y ago
I use pfblockerng on my pfsense, which is the sole reason why I haven't migrated to OPNsense yet. No ads for the last 5 years in my whole private lan and wifi - what a blessing!
chris123 4y ago
How about just not watch TV?
auditor_3d 4y ago
I read recently somewhere that the sneaky part is a lot of these manufacturers supposedly hardcode dns settings in there somewhere.

438 points by axiomdata316 4y ago

I'm always (pleasantly) surprised to see that DNS sinkholing is still a viable option. Couldn't smart tv vendors or the like simply hardcode DNS resolvers and use DNSSEC or DoH (with certificate pinning) to circumvent it?

kccqzy 4y ago
They don't bother (yet). As long as they know only tech geeks are attempting this custom DNS config, and those tech geeks are unlikely to click on ads, they don't bother going the next step. Now, if Pi-hole or similar suddenly becomes mainstream, that'd be a different story.

jmakov 4y ago

Also Nextdns. Hapoy user.

cramjabsyn 4y ago
Hapoy hapoy jpy jpy
activatedgeek 4y ago
Opened the comments to put in a recommendation for NextDNS. The free plan allows 300k DNS queries and is more than enough for me across three devices (Mac/iPhone/iPad). I have not needed an ad-blocker for the past 2 years and hardly see any websites breaking. Often syndicate links break, which is not a big deal for me.
chanandler_bong 4y ago
+100 for NextDNS. Happy paying customer here. Aside from it just working, their mobile client is a fantastic thing. When I am off wifi, my phone routes DNS to NextDNS and I get the same adblocking when I am on cellular data.
- hbcondo714 4y ago
  Me too, my Android / Samsung phone has a "Private DNS"[1] setting where I specify my NextDNS instead of using their mobile app. [1] https://news.ycombinator.com/item?id=28365321 https://news.ycombinator.com/item?id=28365321
- mixmastamyk 4y ago
  Sounds good, are they selling your queries?
  - ignoramous 4y ago
    Don't think they are, but if you're after privacy, of course it isn't strictly better than self-hosting AdGuard Home or Pi-Hole. As one ex, not me but some may be uncomfortable with their use of BigCloud (AWS/GCP/Cloudflare) infrastructure.
- nehal3m 4y ago
  For those who prefer Pi-Hole, I set up a VPN server on my PfSense so my devices can use the DNS server in my home network when I'm out. The fact that traffic is encrypted is a nice bonus. I do this on a symmetrical 500Mbit fiber line, YMMV.
JFKKFJ 4y ago
[dead]
kstenerud 4y ago
I used it at home and liked it... for 10 days, after which it stopped working because I'd hit some limit. For 1 computer, 1 Amazon TV stick, and 1 phone that I barely use, 10 days max is pretty bad. So I uninstalled it and went with adguard, which doesn't arbitrarily stop working.
- mritzmann 4y ago
  > because I'd hit some limit (..) 10 days max is pretty bad The free(!) plan includes 300,000 queries per month. That is transparent everywhere. On the website, pricing page and in the dashboard. You can even see how much you have already used. That's pretty fair for a free service for which you pay nothing. For me, that's enough for a whole month. > (..) which doesn't arbitrarily stop working 1. NextDNS sends an email before the limit is reached 2. Once the limit is reached, no more ads are blocked, but dns continues to work
  - kstenerud 4y ago
    Hey if it works for you, great. It didn't work for me. 10 days casual use for 1 person and then "pay me" is not a positive experience, so I found another solution.
    - randomguy0 4y ago
      What? It’s a paid for service.
    - Terretta 4y ago
      How many days should a paid service give you free casual use for a positive experience? You are using a consumable (CPU & data transfer, along with your desired amount of analytics data storage) that they pay for, and, shockingly, they are not ad supported.
  - blakeburch 4y ago
    I currently use a pi-hole. In a home of 2, we have 74k queries per day. That would effectively be a 4 day trial... so I can understand the other person's frustration.
stranded22 4y ago
Nextdns here too! I gave pihole a shot but an update went wrong and I had to muck around getting it to work again (it was also my dhcp, so was a pain whilst working from home!) Back to nextdns and it’s smooth. I have different profiles set up - a home one (for everything that can’t take DoH, including my work laptop), one for my son (his iPad), one for my wife (no logging, minimal ad blocking, allowing Facebook) and one for my devices (lots of different blockers). It also works outside of my network too. I pay the £17/year as I feel allo of this is worth supporting.
cpressland 4y ago
The only feature NextDNS is missing that I’d love (and am tempted to switch to Pi-Hole / Adguard to get) is Custom DNS records. I really don’t wana run my own DNS Server forwarding to NextDNS just to do this. Edit: I just discovered this is a thing “Settings > Rewrite”
benhurmarcel 4y ago
It's good but unfortunately their Windows and Linux clients are fairly buggy.

javchz 4y ago

I use to be anti AdBlock, as a lot of the creators I follow get food over the table thanks to ads... But man, things got out of control, the industry have gone so hostile, where a typical site went from 30% ads 70% content to the inverse and worse. What I hate the most it's how the try to scam no savvy tech people, like grandparents and for those scenarios pi hole it's a tool made in heaven (specially as there are not global adblocks extensions for mobile devices) I still don't use for my personal network, but for my senior family members that use tech only for video streaming or reading the news, this it's an amazing gift.

ge96 4y ago
Jim Browning fights the good fight Yeah a lot of sites (articles) there's an ad between every paragraph or they scroll you to the bottom which has those garbage sites as you try to leave.
knodi123 4y ago
> What I hate the most it's how the try to scam no savvy tech people, like grandparents and Oh, that's my utter bane. My mom knows better, I've taught her how the manipulations work, and then she'll show me a pertinent article on her tablet, and see an utterly outrageous clickbait link from Outbrain or Taboola or the like, like "This mom found out her kids were smoking WHAT?!" and pictures of some bugs or whatever. And she'll get a guilty and tortured expression and say "Oh, I know they're probably manipulating me, but I have to find out what this is about." No!!! You really don't have to! I tried to sneakily install ublock, but I made ONE mistake when trying to add a custom filter on a site she regularly visits, which broke her user experience for 3 minutes before I fixed it, and she demanded I immediately uninstall the "hacker programs".
- pontilanda 4y ago
  The sad thing about clickbait is that it works wonders, and you'll never guess what happens next!
  - knodi123 4y ago

cloudking 4y ago

AdGuard on Home Assistant is another good solution, has some additional filtering options too like enforcing safe search on Google and YouTube https://www.home-assistant.io/integrations/adguard/ https://www.home-assistant.io/integrations/adguard/

mafuyu 4y ago

What finally got me to setup pi-hole on an old Raspberry Pi was getting an LG OLED TV. The webOS apps for YouTube and Plex are pretty convenient, but the TV was absolutely packed with ads via the home screen and pop-up toasts. To add insult to injury, the home screen would lag for several seconds at boot while it pulled down all those ads. And then I discovered that even after opting out of all the telemetry options, it was making DNS queries for _several_ data mining services that analyze what's being shown on the TV. I didn't Wireshark it to see what API calls it was making, but clearly opting out in the menu wasn't enough. After some passes of scanning the pi-hole logs and adding to the blacklist, my TV is snappier and ad-free. :) Definitely will not be going with LG for my next TV, though. It's mind blowing to me that this is the user experience on a TV that costs over $1k. As for the pi-hole setup itself, it's working great. It's a great backup to locally installed adblockers, and I have my EdgeRouter as the primary DHCP DNS server, which makes requests to pi-hole. Both the router and pi-hole have caching, and my DNS query latencies are good. Pi-hole also has a nice interface for pointing `.local` domains to local IP addresses, which is much easier than messing with dnsmasq settings on the EdgeRouter.

metadat 4y ago
I wrote a recommendation about this 7 months ago (oh my, how time flies): https://news.ycombinator.com/item?id=31707222 https://news.ycombinator.com/item?id=31707222 tl;dr: If the TV is working well enough already, it may be ill-advised to connect it to the network. The apps, while convenient, can be supplanted by an external AppleTV or similar for minimal cost relative to a nice TV. This protects the TV not only from being a privacy threat and general ad-ridden nuisance, but also from receiving potentially harmful updates that can lead to performance regressions.
- ErikCorry 4y ago
  Offline TV plus online Chromecast works fine for me.
- kapep 4y ago
  That just seems to shift all concerns from one device to another. Is AppleTV or similar devices so much better when it comes to privacy? Or is the selling point just that they don't show ads?

cpuguy83 4y ago

I ran into too many problems with pihole breaking sites so I just turned it off.

muppetman 4y ago
You should look at the oisd blacklist. It's curated to ensure that it doesn't break anything and in my testing The last 3 months, it lives up to its name very well. I haven't had any sites break or any reports from the kids about things not working. Prior to that the block list I use would sometimes stop the Apple store from working and those sorts of things, it was very annoying.
- DavideNL 4y ago
  Or perhaps https://v.firebog.net/hosts/lists.php?type=tick https://v.firebog.net/hosts/lists.php?type=tick via https://v.firebog.net/hosts/lists.php https://v.firebog.net/hosts/lists.php which also describes 'Whitelisting Suggestions'. Alternative: https://github.com/jacklul/pihole-updatelists https://github.com/jacklul/pihole-updatelists
  - muppetman 4y ago
    There's lots of other solutions, but I've had zero problems since swithcing to osid and I pipe a lot of things (Nintendo Switch, kids iPads, my Google phones, my laptops) through it and it hasn't given me a single issue. It certainly DOES let through a few more trackers, but that's the cost of a list that doesn't cause problems.
chanandler_bong 4y ago
That's like saying your seatbelt is uncomfortable so you don't wear it while you're driving. Don't take it off, find a solution to make it work. Use a better block list (OISD has been mentioned already), or use NextDNS. Neither of those cause breaks in most sites and stop the most bothersome/prevalent ads.
highdeserthackr 4y ago

muppetman 4y ago

I used to use pi-hole. Then I replaced it with adguard home. Adguard home is a single go binary, and it properly supports HTTPS and secure DNS out of the box. Pi-hole is great, Adguard home is greater I think. At the end of the day though they both provide the same service. But I like that with adguard home I can have TLS DNS so I can have my mobile phone use private DNS via it even when it's not at home.

moontear 4y ago
I agree. Also better DNS rewrite support for split DNS scenarios. I do like the dashboard and analysis possibilities of Pi-Hole better
t0bia_s 4y ago
You cannot ad blocklist in batch in AdGuard. Also developers are from Russia with headquarter in Cyprus.
- machinekob 4y ago
  But code is open source so r*ussians who cares?
  - DavideNL 4y ago
    It's kind of suspicious though, that you cannot find any info on for example who the Adguard CEO is, on their website. Most companies have an "about us" section with info where at least you can see who the people/management are. Instead, they provide a vague page: https://adguard.com/en/contacts.html https://adguard.com/en/contacts.html
  - le-mark 4y ago
    Is anyone compiling from source or are most all installing precompiled binaries? How does one verify a binary matches the source with no additional code? This is a rhetorical question meant as an excercise for the reader.
- muppetman 4y ago

ck2 4y ago

Not quite as good but a free fallback https://adguard-dns.io/en/public-dns.html#addresses https://adguard-dns.io/en/public-dns.html#addresses Also ublock-origin works on Firefox mobile.

nipperkinfeet 4y ago
I found out recently Adguard DNS also hides placeholders of blocked elements inside Android apps. I don't need MinMinGuard anymore.
- ignoramous 4y ago
  It may or may not matter, but: MinMinGuard is FOSS, AdGuard for Android is not.
  - folmar 4y ago
    It think it is:https://github.com/AdguardTeam/ContentBlocker/blob/master/COPYING https://github.com/AdguardTeam/ContentBlocker/blob/master/CO...
  - nipperkinfeet 4y ago
    The issue is that MinMinGuard hasn't received an update in a while and has ceased functioning for me on Android 12.
mackrevinack 4y ago
kiwi is another mobile (chrome) browser that supports extensions as well

inamberclad 4y ago

I had a pi-hole set up for quite a little while, but my partner complained that they could no longer click on google shopping links. It boggled my mind that anyone actually clicked on these, but now I have to find a way to whitelist their devices.

impish9208 4y ago
You can create a group of devices for which the DNS filtering doesn’t apply to.
thrdbndndn 4y ago
I don't use Google shoppings, but I click Amazon shopping ads on some indie/personal sites all the time. For example, one of the them is a music database website. Its ad shows the links to buy the CDs (it's in Japan, FWIW). I find it very continent; I often just go Amazon to check info even if I don't want to buy.
muppetman 4y ago
Look at the oisd blocklist. It's very comprehensive (I removed all other Blocklist) and it ensures that it doesn't break any users experiences.
LilBytes 4y ago
As others have stated I worked around it by setting up a wifi connection with different DNS servers and adding '- No Adblock' to the SSID. Not all routers have this functionality and if it doesn't you should be able to flash Tomato or similar, or use PfSense. Depending how home baked you want to go.
westhom 4y ago
Exact same reason I stopped using pi-hole. It bugged out Google shopping and my partner complained. And the whitelisting / access control is annoying UX imo so I went back to normal DNS. Might return to it eventually but not enable it for every dhcp client. Edit: and her iPhone changes its MAC address randomly so the access control was tricky to maintain.

sodality2 4y ago

A truly better alternative to pi-hole while still self hosted is AdGuardHome: https://github.com/AdguardTeam/AdGuardHome#comparison-pi-hole https://github.com/AdguardTeam/AdGuardHome#comparison-pi-hol...

moistly 4y ago
What makes this better?
- sodality2 4y ago
  The link is to a table comparing the two, showing how it’s better.
  - moistly 4y ago
    Gotcha, thx.
  - DavideNL 4y ago
    ...written by Adguard itself. Not exactly an independent objective comparison :)
- 6ak74rfy 4y ago
  For me, it was the fact that AdGuard Home supports a lot of good things out of the box. For e.g., DoH/DoT for upstream resolvers, really easy to enable DoH to the AdGuard Home interface itself etc.
djhworld 4y ago
I looked at this and played with it a little. One crucial thing I use my pihole for is to forward traffic going to the .lan top level domain to my reverse proxy (traefik), I couldn't figure out how to do this in the pihole UI so I just added a custom config file to /etc/dnsmasq.d which works perfectly. I'm not sure what adguard uses but would be interested to here if it's possible! EDIT: just seen it supports DNS rewrites, which seems to do a similar job. Nice! I might give this a shot for a while

windex 4y ago

What I am beginning to notice is some apps and devices now seem to have "baked in" addresses and dont rely on the pihole.

chanandler_bong 4y ago
If your router can do it, have it route all of your DNS queries to your (pi-hole|adguard|nextdns). Doesn't matter if they are hardcoded to 8.8.8.8, anything to port 53 goes through the blocker. Asus Merlin firmware handles this nicely.
- smolyeet 4y ago
  I finally ended up setting up my own router with opnsense which you can do for pretty cheap. Either a pc with two ports, a vm on a server if you are into that , or going dedicated hardware like mentioned above. If you really want to understand what goes on your network this is the way to go.
- mixmastamyk 4y ago
  That brings up the question of what is the best router these days. Mine is getting long in the tooth.
  - chanandler_bong 4y ago
    I recently upgraded to an ZenWiFi Pro XT12. Expensive, but I have zero wifi issues now, and with the Merlin firmware, nearly infinite control. The only downside of the XT12 is that there are no USB ports, so you cannot have external storage. Definitely WTF, but an OK trade-off for me.
- Havoc 4y ago
  Was considering this but concerned it’ll break company laptop dns functionality
  - chanandler_bong 4y ago

nunez 4y ago

This is absolutely essential if you care at all about reducing Internet ads. Runs on anything, is dead simple to use and you can funnel your entire home internet through it.

password4321 4y ago

Don't miss AdGuardHome https://news.ycombinator.com/item?id=33787505#33790602 https://news.ycombinator.com/item?id=33787505#33790602

hit8run 4y ago

What are you running it on? Linuxbox? A real Pi? Just curious.

monotux 4y ago
My setup is on a cheap thin client, buying a pic is too expensive :) I mainly use pihole for ease of setting up and its user interface. I’m using knot-resolver for upstream queries and knot for local zones. I’ve started to read up on dnstap to see if I can emulate some of the pihole statistics but pihole is still good enough.
cyphax 4y ago
I run it on a real Pi, a very old model B. One cpu core, little memory, yet it runs fast and even the web interface is plenty snappy.

aaron695 4y ago

[dead]

vk6flab 4y ago

My Pi-hole has been running in a Docker container on my main workstation for several years. I tend to refresh it once a month or so with a simple configuration as shown in the example files. docker pull pihole/pihole:latest docker run -d \ --name pihole \ --restart=unless-stopped \ -p 192.168.1.1:53:53/tcp \ -p 192.168.1.1:53:53/udp \ -p 80:80 \ -e TZ="Australia/Perth" \ -e PIHOLE_DNS_="1.1.1.1\;1.0.0.1" \ -e WEBPASSWORD="{redacted}" \ -e DNSMASQ_LISTENING=all \ pihole/pihole:latest

yokoprime 4y ago
why not docker-compose? so nice to just do the old up / down
- lostlogin 4y ago
  I did that but it doesn’t play nice with containers on the same host and they lose wan access (but have lan access). I run it separately now.
Yajirobe 4y ago
Is raspberry's throughput enough to handle the load?
- Tomte 4y ago
  It's just DNS traffic going through the device, not videos.

shrx 4y ago

It's a great project, but I'm waiting for the day it will be able to block ads that roll before youtube videos play.

bertman 4y ago
Which will never happen for DNS-only blockers like pi-hole. See e.g. here: https://github.com/AdguardTeam/AdGuardHome#known-limitations https://github.com/AdguardTeam/AdGuardHome#known-limitations
- shrx 4y ago
  Adguard apparently plans to support it: https://github.com/AdguardTeam/AdGuardHome/issues/1228 https://github.com/AdguardTeam/AdGuardHome/issues/1228
imperistan 4y ago
I had the same thought but it is not possible. I installed as blockers on my PCs, SmartTubeNext on my Android tv and finally YT vanced on my phone
- shrx 4y ago
  Thanks, I'll check out SmartTubeNext!
velhartice 4y ago
Brave browser blocks all youtube video ads.
- hellojason 4y ago
  Seconding this. I use Brave strictly as my YouTube viewer.

account-5 4y ago

I'm thinking of getting a hi-res projector instead of a smart TV. I had a Samsung smart TV but got rid of it last year because of the ads, slow start up, bad sound, and just all-round bad anti-user crapware that was on it. Reverted back to my old (10 year old) dumb Samsung and it's much better hooked up to a streaming stick. I long for the days when all you had to consider when getting a new TV was color, resolution, picture quality, frame rate, etc. Instead of what OS it's running, how long you'll get update, how bad the advertisings going to be, as well as the above. Any recommendations for a decent projector?

t0bia_s 4y ago
I dont have smart TV, however I have BenQ MH550 over 3 years. Just for Kodi and pictures. It's great. Since then I'm barely go to cinema, except film festivals. And I'm partly work in film industry. Look for DLP projectors if you want watch primally films. They can adjust frequency to FPS of played media and colour reproduction is more pleasant to watch. Avoid LCD projectors. They are great for presentations and graphic in bright environment, not for film reproduction in dark room.
- beagle3 4y ago
  Unfortunately, I can't enjoy DLP projectors due to the rainbow effect - It's LCD only for me. https://pointerclicker.com/rainbow-effect-projector/ https://pointerclicker.com/rainbow-effect-projector/
  - t0bia_s 4y ago
    I never had that issue. I also use "eco" mode that reduces brightness and contrast. In dark room full brightness could indeed hurt your eyes. And colour reproduction is not that great.
kriz9 4y ago
I am currently testing out Epson ls500 as a tv replacement. It has been great so far. Only downside is the ugly "periscope" on top and the throw distance being a bit too far so it takes too much space away from the living room. Epson ls800 looks like the perfect projector but is still a bit pricey. Ls800 has a much shorter throw distance and looks much better in the living room.

kevinhq 4y ago

I always reject ads: https://www.reddit.com/r/rejectads/ https://www.reddit.com/r/rejectads/

goodpoint 4y ago

So overrated.

mfashby 4y ago

Haven't seen blocky mentioned yet, another pi-hole type program but a bit more minimal https://0xerr0r.github.io/blocky/ https://0xerr0r.github.io/blocky/

lproven 4y ago

Does anyone know of a version of, or way to run, Pi-Hole on TrueNAS Core? That's what my home NAS runs, and while its list of "appliances" is quite long, it doesn't contain any network ad-blockers, AFAICS. I am not bothered on the TV. I bought a ~15YO Panasonic Viera TH-46PZ80E, a huge plasma thing that is almost totally dumb. It cost me £/$ 60 a year ago, and it's great. It talks to a cable TV box and an elderly Mac mini for playing videos. Works a treat, costs very little, and zero online advertising. I have got Kodi on it and our phones for a "ten foot UI", but using macOS is easy enough that we never need it.

sofixa 4y ago
The easier route would be to run AdGuard Home since it's a single Golang binary therefore quite easy to compile and run in a jail by yourself.
zomg 4y ago
you can run pi-hole in a docker container on truenas.
- lproven 4y ago
  Interesting. Do you have any pointers to how to do that? TrueNAS Core is a FreeBSD distro. Docker is a Linux tool. That implies to me I'd need a Linux distro in a VM, then Docker on that, then more config on top. Which sounds hard. Which is why people run this stuff on dedicated small cheap computers. I predicted containers were the next big thing 3 years before Docker was founded, but I do not run containers on production servers. My job is writing about this stuff, not running servers. :-) I write about it because I used to run servers in production for a living, and I didn't like doing it. I prefer writing.
  - CoolCold 4y ago
    TrueNAS Scale is Linux based
    - lproven 4y ago

spicyusername 4y ago

Pi-hole is a must have in my opinion. So many sites are basically unusable without it.

jcpham2 4y ago

Simple adblock package from openwrt repo works wonders and is way simpler than dealing with a raspi or some other separate server. Some of y’all seem to enjoy bringing work home and tinkering and maintaining hardware at home - but some of us don’t I’ll keep my ad blocking on my router thank you very much

tgv 4y ago
My router is an integrated thingy from my provider. I can't mod it.
- folmar 4y ago
  Daisy chaining is not very bad apart from power consumption.

bretbernhoft 4y ago

How many domains do you guys have blocked? I am at around four million domains blocked on my Pi-hole.

djhworld 4y ago

Been using this software for years, it's excellent. It's really eye opening when you have it turned off as well, like suddenly the filters are lifted and you see what the reality is for most people. Sadly the cat and mouse game between ad vendors and systems like this is, the DNS sinkholing method is either being circumvented thanks to rapidly changing/randomised hostnames outpacing the adlist authors, or ads are rendered server side. I've never been able to get it to work as the primary DNS source on the router though, so I always have to configure my devices to statically point to the IP of the pihole, but that's just a minor inconvienience (although annoying when devices like TVs don't allow you to configure DNS, or override it secretly for their own stuff)

milosmns 4y ago

I tried this a couple of times and I was never able to completely turn off YouTube ads on my LG TV, no matter how many blocklists I pulled. I wonder... is there's a special setting for DNS routing inside of the TV that allows YT to bypass pi-hole?

randomguy0 4y ago
Are the ads served from the same place as the video content itself?
crackedbassoon 4y ago
Pihole doesn’t block YouTube adds.

Helmut10001 4y ago

I use pfblockerng on my pfsense, which is the sole reason why I haven't migrated to OPNsense yet. No ads for the last 5 years in my whole private lan and wifi - what a blessing!

chris123 4y ago

How about just not watch TV?

auditor_3d 4y ago

I read recently somewhere that the sneaky part is a lot of these manufacturers supposedly hardcode dns settings in there somewhere.