pihole is only doing DNS filtering. Can still be good but not at all similar to the content filtering that can be done by client-side extensions. It's also beco

pihole is only doing DNS filtering. Can still be good but not at all similar to the content filtering that can be done by client-side extensions. It's also becoming less effective over time due to increased adoption of domain-fronting and DoT/DoH. To get there with a hosted appliance you can run on a Raspberry Pi, you'd neet an intercepting and rewriting HTTPS proxy with the TLS certificates trusted by the client. Possible (corporates and ISPs/governments do this) but a lot more effort and security footguns than blackholing DNS lookups. Sidenote: Most HTTPS packets will still carry the destination domain unencrypted (ECH is still not widely adopted and can be filtered). So even if DoT prevents pihole from being effective, you can still route all your HTTPS traffic through something like sniproxy and drop packages based on SNI extension information. You won't need to set up certicates for this and pretty straightforward on any Linux/BSD router.