11 ms·

I set up pi-hole recently after hearing about it for years. I was kind of surprised at a lack of really basic features (imo): There isn't any kind of "dry run"

I set up pi-hole recently after hearing about it for years. I was kind of surprised at a lack of really basic features (imo): There isn't any kind of "dry run" or "phantom" mode, where requests are not actually blocked, but appear marked in the log UI as "would be blocked". This is super important because I want to see all the things my home network is doing that would be blocked before I actually hit the big red button. I want to fix up the allow/denylist before going live. It's also not possible (or not clear) how to have different behavior for different clients. For my "smart tv" which I begrudgingly have to allow on my network occasionally for software updates, I want to treat it with the strictest possible list. But for my phone, I don't want that same list. There's a concept of "groups" so perhaps this is user error on my part, but the UI does not make this clear.

jkingsman 2y ago
I think log-don't-enforce and per-client block profiles are probably basic to people who work with networking regularly, but are probably pretty far out of reach for the average home user who are probably needing to expand their networking knowledge just to distribute custom DNS via DHCP. So, I agree that those would be lovely features but are, I think, a ways beyond what I would assume the p90 of pihole users would need or be able to use.
bdcp 2y ago
For the seconds question, it is indeed Groups. I have my SO's phone bypass everything. It's the way she wants it. Yea i agree it's not super UX friendly.
ge96 2y ago
I think I'll never buy a smart TV what an ultimate ahole move to put ads in there. It's like the Kindles where you have to read these ads before you can open your book (of course you can pay a 1-time fee). Like buying a movie on YouTube and having to watch ads in it or can't see full res unless you're on an allowed device. If UBO actually stops working on Chrome I'll either leave or use pihole. My cheap android phone installs games by itself eg. candy crush ugh. My own fault I get it buy a $2K phone instead of $160
- b3lvedere 2y ago
  Most non-smart 4K screens are more expensive than 4k-smart tv screens though. Really weird, because there's less stuff in it. I just want a nice 50" 4k screen with hdmi and display ports. I don't use all the other junk anyway, since i watch tv via a computer and sounds goes to a surround set.
  - progbits 2y ago
    Is there an equivalent of DDWRT/OpenWRT but for TVs? Most often those are some embedded linux board running some Android fork, shouldn't there be some TV models on the market that are a good hardware/price deal with firmware that can be replaced? Even something that just permanently shows HDMI input with no popup overlays would be good, but AOSP + VLC/Jellyfin would be even nicer.
    - RandomDistort 2y ago
      Isn't a TV that permanently shows HDMI input a big monitor? Weirdly they always seem to be more expensive than a TV though.
      - b3lvedere 2y ago
        Well yes, but i guess either big monitors use different panels or there's some shady business going on.
        bee_rider 2y ago
        Inclusive or.
      - progbits 2y ago
        Yeah exactly, as also others point out in the thread, if you want "TV-sized monitor" you will pay more than for a TV, and probably get worse panel, lower brightness, etc. Hence it would be useful to buy "smart" TV and turn it into a monitor instead.
josephg 2y ago
> For my "smart tv" which I begrudgingly have to allow on my network occasionally for software updates Why install software updates if you don’t use the “smart” features? Our smart tv has been banned from the internet for years.
- timoteostewart 2y ago
  I imagine software updates might bring improved support for various media codecs, or UI enhancements, or better Bluetooth compatibility, etc.
  - deleted 2y ago
    [deleted]
  - hsbauauvhabzb 2y ago
    Or more likely: reduced privacy settings, increased analytics, and in-menu advertisements.
  - sneak 2y ago
    I let one of my cheap smart TVs update for this reason (and not the other two identical ones I have) and now that one crashes and lags all the time, despite none of them being on the internet. Embedded device software development quality is usually even worse than webapp software development quality.
  - prmoustache 2y ago
    Why would the manyfacturer spend money on that if it had your sale already and you aren't paying any support subscription?
  - globular-toast 2y ago
    Yes, those are the "smart" features. Just plug in a Raspberry Pi and don't touch the TV after its initial setup. I'm still using the same Raspberry Pi 2 I've been using for more than 5 years now. Beats "smart" TVs that you can buy today.
nkrisc 2y ago
The way I handled this issue for my family and devices is just by having two SSIDs - one with pihole blocking and one without. If it’s interfering with something me or my wife can just switch to the unblocked network temporarily.
MyOutfitIsVague 2y ago
> It's also not possible (or not clear) how to have different behavior for different clients There's a menu item for that: Clients. You create a group, add a client to that group, and configure blocking for that group. To have what you want, you create a group that has just one client in it.
- paxys 2y ago
  It's slightly more complicated. What you are suggesting works if (1) you are using Pi-hole as a DHCP server or (2) all your devices are individually configured to use the Pi-hole IP address for DNS resolution. What's more likely though is that you just point your router's DNS setting to Pi-hole, and in that case there is only one client on the Pi-hole dashboard - your router.
  - jimsmart 2y ago
    > What's more likely though is that you just point your router's DNS setting to Pi-hole, and in that case there is only one client on the Pi-hole dashboard - your router. That depends entirely on what capabilities your router has. Many routers have a setting for the DNS info they give to clients via DHCP, which would mean every client is indeed using PiHole directly for DNS resolution. Other less capable routers, only have a setting for which upstream DNS server(s) the router should use, which of course isn't going to allow you to do anything with PiHole's group stuff. But an easy solution is simply to disable the DHCP server on the router, and simply use what is built-in to PiHole. It uses dnsmasq behind the scenes, and as DHCP servers go, it's pretty capable and configurable. This is how I use PiHole on my own network, and have done for years now (with some customised dnsmasq config, because I have strong preferences about my network setup and services). Most routers do nothing particularly special regarding DHCP anyhow, so no big deal to just turn it off, and use PiHole's stuff. FWIW, and tangent to these specific points, my upgrade to the new PiHole 6 earlier today was pretty smooth — with the exception of it defaulting to having its dashboard on port 8080 instead of my previous 80. Plus I had to tweak a couple of settings to ensure it loads my custom dnsmasq config. But no deal breakers at all.
    - 2y ago
everdrive 2y ago
You can definitely set client groups, either based on CIDR, MAC (if on the same network segment) or individual IP. From there, you can assign different domains and list to the specific groups.
BHSPitMonkey 2y ago
Is a DNS blackhole the right way to restrict your TV from doing bad things? The software running on the device might not even use DNS lookups to connect to hosts as it pleases. Your router is probably the better place to add guardrails.
- progbits 2y ago
  I recommend putting all these things on their own VLANs with strict routing rules. For example my STB is on a VLAN that has WAN access (otherwise it won't do anything), but that makes it untrustworthy so it is completely isolated from rest of LAN. On the other hand some "smart"/IoT devices are on a VLAN that has no WAN access so that they can't phone home, become a botnet, or download firmware updates that remove functionality in favor of subscription services. Only a VM running homeassistant can talk to them. This will work until amazon sidewalk / built-in LTE modems become too frequent, at that point I'll have to start ripping out the radio modules from things I buy.
  - JB_Dev 2y ago
    Call me pessimistic, but as the sidewalk pattern becomes more common for IoT, I wouldn’t be surprised if a “malfunctioning radio” just results in the device not working properly.
- xrisk 2y ago
  It’s a start for sure, a TV that’s really out to track you might well be able to circumvent these blocks, but most TVs (and indeed most tracking technologies on the web) to my understanding are not so sophisticated. For the average person who wants to enjoy some of the smart features of their TV this is a good compromise. And I’m not sure what you mean by the router being the better place to add guardrails. What sort of guardrails can you possibly add outside of blocking internet access outright to the TV? It would be near impossible to distinguish between legitimate traffic and ad/tracking traffic without resorting to something like SNI sniffing which again can be bypassed.
  - nothrabannosir 2y ago
guhcampos 2y ago
I think [1] is quite irrelevant to be honest. Blocking DNS isn't a destructive operation. I've been using pi-hole for years and I simply block everything and cherry-pick a few exceptions here and there when something breaks. I only had to really troubleshoot maybe 3-4 times in years, and half of that were related to the fact I worked for companies that had domains blocked.
- hotstickyballs 2y ago
  It's destructive if you can't reach your remote devices anymore. See also jeff geerling's "It was DNS T-Shirt" https://www.redshirtjeff.com/shop/p/it-was-dns-shirt https://www.redshirtjeff.com/shop/p/it-was-dns-shirt
  - OJFord 2y ago
    Only if they're configured to explode if not pinged for 30s or something.
  - master_crab 2y ago
    The only times I have seen this happen is when the remote devices were communicating with something on blacklist (which should be concerning anyway, but also a quick fix if not) or doing something naughty like not using the DNS server broadcast by DHCP.
btreecat 2y ago
There's also adguard home https://adguard.com/en/adguard-home/overview.html https://adguard.com/en/adguard-home/overview.html
- zikduruqe 2y ago
  It replaced my Pi-hole a long time ago.
  - zenonu 2y ago
    Running w/ my opnsense router. All-in-one.
  - hacky01 2y ago
    [dead]
NoPicklez 2y ago
You'd be hard pressed to find that an auditing mode would be helpful. Even once you hit that big red button, depending on the blocklists you use you will come across false positives that cause issues.
Mekoloto 2y ago
You need to put your SmartTV on a different VLan. The biggest risk is not samsung knowing what someone watched but what devices you have on your lan
windexh8er 2y ago
One of the most values I get out of a SaaS service is NextDNS [0]. There are competitors like ControlD [1] that are also very good. At the end of the day they both check all the boxes for me. But, the piece that really got me with NextDNS when I started using it was the unlimited number of profiles. This allows me to target any device, no matter where it is (this is fantastic for mobile devices) and keep my filtering lists in place. I selfhost a lot but still find the annual cost of NextDNS more than fair. [0] https://nextdns.io/ https://nextdns.io/ [1] https://controld.com/ https://controld.com/
simooooo 2y ago
Adguard home seems to be better in every way. Not sure if this is a feature though.

jkingsman 2y ago

I think log-don't-enforce and per-client block profiles are probably basic to people who work with networking regularly, but are probably pretty far out of reach for the average home user who are probably needing to expand their networking knowledge just to distribute custom DNS via DHCP. So, I agree that those would be lovely features but are, I think, a ways beyond what I would assume the p90 of pihole users would need or be able to use.

bdcp 2y ago

For the seconds question, it is indeed Groups. I have my SO's phone bypass everything. It's the way she wants it. Yea i agree it's not super UX friendly.

ge96 2y ago

I think I'll never buy a smart TV what an ultimate ahole move to put ads in there. It's like the Kindles where you have to read these ads before you can open your book (of course you can pay a 1-time fee). Like buying a movie on YouTube and having to watch ads in it or can't see full res unless you're on an allowed device. If UBO actually stops working on Chrome I'll either leave or use pihole. My cheap android phone installs games by itself eg. candy crush ugh. My own fault I get it buy a $2K phone instead of $160

b3lvedere 2y ago
Most non-smart 4K screens are more expensive than 4k-smart tv screens though. Really weird, because there's less stuff in it. I just want a nice 50" 4k screen with hdmi and display ports. I don't use all the other junk anyway, since i watch tv via a computer and sounds goes to a surround set.
- progbits 2y ago
  Is there an equivalent of DDWRT/OpenWRT but for TVs? Most often those are some embedded linux board running some Android fork, shouldn't there be some TV models on the market that are a good hardware/price deal with firmware that can be replaced? Even something that just permanently shows HDMI input with no popup overlays would be good, but AOSP + VLC/Jellyfin would be even nicer.
  - RandomDistort 2y ago
    Isn't a TV that permanently shows HDMI input a big monitor? Weirdly they always seem to be more expensive than a TV though.
    - b3lvedere 2y ago
      Well yes, but i guess either big monitors use different panels or there's some shady business going on.
      - bee_rider 2y ago
        Inclusive or.
    - progbits 2y ago
      Yeah exactly, as also others point out in the thread, if you want "TV-sized monitor" you will pay more than for a TV, and probably get worse panel, lower brightness, etc. Hence it would be useful to buy "smart" TV and turn it into a monitor instead.

josephg 2y ago

> For my "smart tv" which I begrudgingly have to allow on my network occasionally for software updates Why install software updates if you don’t use the “smart” features? Our smart tv has been banned from the internet for years.

timoteostewart 2y ago
I imagine software updates might bring improved support for various media codecs, or UI enhancements, or better Bluetooth compatibility, etc.
- deleted 2y ago
  [deleted]
- hsbauauvhabzb 2y ago
  Or more likely: reduced privacy settings, increased analytics, and in-menu advertisements.
- sneak 2y ago
  I let one of my cheap smart TVs update for this reason (and not the other two identical ones I have) and now that one crashes and lags all the time, despite none of them being on the internet. Embedded device software development quality is usually even worse than webapp software development quality.
- prmoustache 2y ago
  Why would the manyfacturer spend money on that if it had your sale already and you aren't paying any support subscription?
- globular-toast 2y ago
  Yes, those are the "smart" features. Just plug in a Raspberry Pi and don't touch the TV after its initial setup. I'm still using the same Raspberry Pi 2 I've been using for more than 5 years now. Beats "smart" TVs that you can buy today.

nkrisc 2y ago

The way I handled this issue for my family and devices is just by having two SSIDs - one with pihole blocking and one without. If it’s interfering with something me or my wife can just switch to the unblocked network temporarily.

MyOutfitIsVague 2y ago

> It's also not possible (or not clear) how to have different behavior for different clients There's a menu item for that: Clients. You create a group, add a client to that group, and configure blocking for that group. To have what you want, you create a group that has just one client in it.

paxys 2y ago
It's slightly more complicated. What you are suggesting works if (1) you are using Pi-hole as a DHCP server or (2) all your devices are individually configured to use the Pi-hole IP address for DNS resolution. What's more likely though is that you just point your router's DNS setting to Pi-hole, and in that case there is only one client on the Pi-hole dashboard - your router.
- jimsmart 2y ago
  > What's more likely though is that you just point your router's DNS setting to Pi-hole, and in that case there is only one client on the Pi-hole dashboard - your router. That depends entirely on what capabilities your router has. Many routers have a setting for the DNS info they give to clients via DHCP, which would mean every client is indeed using PiHole directly for DNS resolution. Other less capable routers, only have a setting for which upstream DNS server(s) the router should use, which of course isn't going to allow you to do anything with PiHole's group stuff. But an easy solution is simply to disable the DHCP server on the router, and simply use what is built-in to PiHole. It uses dnsmasq behind the scenes, and as DHCP servers go, it's pretty capable and configurable. This is how I use PiHole on my own network, and have done for years now (with some customised dnsmasq config, because I have strong preferences about my network setup and services). Most routers do nothing particularly special regarding DHCP anyhow, so no big deal to just turn it off, and use PiHole's stuff. FWIW, and tangent to these specific points, my upgrade to the new PiHole 6 earlier today was pretty smooth — with the exception of it defaulting to having its dashboard on port 8080 instead of my previous 80. Plus I had to tweak a couple of settings to ensure it loads my custom dnsmasq config. But no deal breakers at all.
  - 2y ago

everdrive 2y ago

You can definitely set client groups, either based on CIDR, MAC (if on the same network segment) or individual IP. From there, you can assign different domains and list to the specific groups.

BHSPitMonkey 2y ago

Is a DNS blackhole the right way to restrict your TV from doing bad things? The software running on the device might not even use DNS lookups to connect to hosts as it pleases. Your router is probably the better place to add guardrails.

progbits 2y ago
I recommend putting all these things on their own VLANs with strict routing rules. For example my STB is on a VLAN that has WAN access (otherwise it won't do anything), but that makes it untrustworthy so it is completely isolated from rest of LAN. On the other hand some "smart"/IoT devices are on a VLAN that has no WAN access so that they can't phone home, become a botnet, or download firmware updates that remove functionality in favor of subscription services. Only a VM running homeassistant can talk to them. This will work until amazon sidewalk / built-in LTE modems become too frequent, at that point I'll have to start ripping out the radio modules from things I buy.
- JB_Dev 2y ago
  Call me pessimistic, but as the sidewalk pattern becomes more common for IoT, I wouldn’t be surprised if a “malfunctioning radio” just results in the device not working properly.
xrisk 2y ago
It’s a start for sure, a TV that’s really out to track you might well be able to circumvent these blocks, but most TVs (and indeed most tracking technologies on the web) to my understanding are not so sophisticated. For the average person who wants to enjoy some of the smart features of their TV this is a good compromise. And I’m not sure what you mean by the router being the better place to add guardrails. What sort of guardrails can you possibly add outside of blocking internet access outright to the TV? It would be near impossible to distinguish between legitimate traffic and ad/tracking traffic without resorting to something like SNI sniffing which again can be bypassed.
- nothrabannosir 2y ago

guhcampos 2y ago

I think [1] is quite irrelevant to be honest. Blocking DNS isn't a destructive operation. I've been using pi-hole for years and I simply block everything and cherry-pick a few exceptions here and there when something breaks. I only had to really troubleshoot maybe 3-4 times in years, and half of that were related to the fact I worked for companies that had domains blocked.

hotstickyballs 2y ago
It's destructive if you can't reach your remote devices anymore. See also jeff geerling's "It was DNS T-Shirt" https://www.redshirtjeff.com/shop/p/it-was-dns-shirt https://www.redshirtjeff.com/shop/p/it-was-dns-shirt
- OJFord 2y ago
  Only if they're configured to explode if not pinged for 30s or something.
- master_crab 2y ago
  The only times I have seen this happen is when the remote devices were communicating with something on blacklist (which should be concerning anyway, but also a quick fix if not) or doing something naughty like not using the DNS server broadcast by DHCP.

btreecat 2y ago

There's also adguard home https://adguard.com/en/adguard-home/overview.html https://adguard.com/en/adguard-home/overview.html

zikduruqe 2y ago
It replaced my Pi-hole a long time ago.
- zenonu 2y ago
  Running w/ my opnsense router. All-in-one.
- hacky01 2y ago
  [dead]

NoPicklez 2y ago

You'd be hard pressed to find that an auditing mode would be helpful. Even once you hit that big red button, depending on the blocklists you use you will come across false positives that cause issues.

Mekoloto 2y ago

You need to put your SmartTV on a different VLan. The biggest risk is not samsung knowing what someone watched but what devices you have on your lan

windexh8er 2y ago

One of the most values I get out of a SaaS service is NextDNS [0]. There are competitors like ControlD [1] that are also very good. At the end of the day they both check all the boxes for me. But, the piece that really got me with NextDNS when I started using it was the unlimited number of profiles. This allows me to target any device, no matter where it is (this is fantastic for mobile devices) and keep my filtering lists in place. I selfhost a lot but still find the annual cost of NextDNS more than fair. [0] https://nextdns.io/ https://nextdns.io/ [1] https://controld.com/ https://controld.com/

simooooo 2y ago

Adguard home seems to be better in every way. Not sure if this is a feature though.