6 ms·

Stuff a Pi-hole in your router because your browser is about to betray you

106 points by tambourine_man 2y ago

flaskking 2y ago
[flagged]
deleted 2y ago
[deleted]
CharlesW 2y ago
Yes, or — if you're lazy like I am, and don't want to manage another device or container — use something like NextDNS, which has a very generous free plan and an extremely inexpensive yearly plan. Control D is a popular alternative with similar plans. In the last 3 months, NextDNS has blocked nearly 9% of 10M DNS queries from devices in my household with no ill effects that I'm aware of. (I'm not affiliated with NextDNS in any way, other than as a satisfied paying customer.)
- stavros 2y ago
  NextDNS's price of $20/year (or something like that) is the easiest purchase I've ever made. I still use uBlock origin, but like how NextDNS will block stuff from phones and other devices as well.
- philips 2y ago
  Tailscale + NextDNS is a dream. One simple app to get me back to my self hosted services and block ads. https://tailscale.com/kb/1218/nextdns https://tailscale.com/kb/1218/nextdns
  - noahjk 2y ago
    Not only can Tailscale directly integrate with NextDNS and therefore not require extra configuration on-device for DNS, but you can use Tailscale ACLs to assign different NextDNS profiles to different devices (for example, a parental control profile to a kid's device or an Apple TV, or an IoT profile, etc)
  - workfromspace 2y ago
    I did not understand the use case here. Could you please explain further? I have been using NextDNS for many years now, but I didn't get why I should use Tailscale.
- OneLeggedCat 2y ago
  Do you mean 90%?
  - CharlesW 2y ago
    Nope! NextDNS blocked 913,294 of 10,287,370 queries over the last 3 months. I'm sure the percentage would rise if I flipped on other options that they provide ("AI-Driven Threat Detection", "Block Newly Registered Domains", etc.), and I should probably revisit those.
    - Brajeshwar 2y ago
      Wow! I'm more intrigued by the fact that you did 10M queries in 3 months. I'm going to assume you're using a single profile for everything. I have separated machines/robots (that includes the TV), kids, and other profiles for business devices.
      - CharlesW 2y ago
        That's a steller idea, thanks for mentioning it! I didn't realize that different profiles assign unique DNS servers, allowing me to partition off devices that don't support DNS-over-TLS/DNS-over-HTTPS/IPv6. I don't think it'd affect total queries, but tighter rules for machines/robots, etc. should increase the percentage of blocked requests.
  - thedanbob 2y ago
    9% is reasonable. I've got pretty strict filters on my home DNS and it's currently blocking 12%. I imagine that number would be much higher if I didn't have ad block extensions on all my browsers and IoT devices on a restricted VLAN.
- nik282000 2y ago
  They are a US based company, whether they say they log your data or not, they can be compelled to log your requests and not tell you about it. Regardless they look like good alternative for users who are unable to setup or are prevented from using a pihole.
  - jedberg 2y ago
    > They are a US based company, whether they say they log your data or not, they can be compelled to log your requests and not tell you about it. If someone wanted your internet traffic, they wouldn't bother with NextDNS. They would just compel your internet provider to give it to them. This is not a real risk to using NextDNS.
    - benoau 2y ago
      I mean in theory this is absolutely correct and everyone everywhere will follow due process and the data will only become available at the individual level when a court affirms it is appropriate. As long as due process and checks and balances are respected, there's absolutely nothing to worry about lmfao.
      - jedberg 2y ago
        I think you missed my point. Your ISP already has your traffic, and is just as easy to compel as NextDNS. No one is going to NextDNS for your traffic, and even if they do, NextDNS doesn't have any information your ISP doesn't already have.
    - oefrha 2y ago
      The good ol’ everyone on the Internet is American fallacy.
      - kube-system 2y ago
        The good ol' media talks about it happening in America so it must only happen in America fallacy. ISPs can be compelled to divulge data in most places around the world.
- eth0up 2y ago
  Been using nextdns on both droid and linux and am really grateful for it. Coupled with ublock, I can browse the tubes without having a seizure. I'm so satisfied with it, that I fear someone will come along and prick me happy bubble, explaining why it's bad. But I might just look away. Nextdns is great
- NilayK 2y ago
  It’s also easy to use Pi-hole with NextDNS as the upstream server using cloudflared as the DNS-over-HTTPS tool[1] to connect to NextDNS in a secure manner [1]: https://docs.pi-hole.net/guides/dns/cloudflared/ https://docs.pi-hole.net/guides/dns/cloudflared/
- 1vuio0pswjnm7 2y ago
  Paying does not solve the online ads problem, it only adds to it by creating a market for companies that can profit from online ads while collecting even more data from internet users. DNS query data is probably as close to www browsing history as one can get. These companies can easily be acquired by Big Tech. Nothing stops them from selling out and selling their customers out. This is a win for the DNS provider, a win for Big Tech and a loss for the internet user. Google already collects fees from some people who are willing to pay in return for "no ads"; meanwhile Google still collects data on these people; it may be used to support ads shown elsewhere or for any purpose whatsoever. Paying does not stop the online ads problem. If anything it makes online ads even more attractive; they can be used to annoy people into paying fees. Some people will actually pay to have their data collected by an advertising company. As far as I know, please correct if wrong,, Pi Hole is 100% non-commercial. It is basically a modified dnsmasq with default settings that forward queries to third party DNS providers that profit from ad services, like Google. If online advertising were to decrease or disappear, then Pi Hole is not threatened. Whereas a third party DNS service like NextDNS has a financial incentive to ensure that the online ads problem persists, as it creates their "market". The disapperance of online ads, for whatever reason, would be catastrophic for NextDNS. I am not a Pi Hole user as I do nmot like dnsmasq. I use other DNS software and map DNS data collected in bulk from variety of sources into local forward proxy memory.
stavros 2y ago
This is infuriating. "This browser is shit, so here's how to install a program that makes this browser tolerable". No! Stop using Chrome! There are other browsers you could (and should) use instead!
- defrost 2y ago
  Not a great headline, the article focus is on recent version improvements and entire local network "front of house" protection for all devices, all browsers, tablets, TVs, local data phones, etc: Pi-Hole 6 appeared a few weeks ago. Since then, there have been a few small bug fixes and it's now up to version 6.0.5. The new release is lighter weight and has fewer external dependencies: it no longer needs PHP or an external web server. If you run the Docker container version on top of another Linux OS, it's lighter still, as the container is now based on Alpine Linux instead of Debian. Is it really worth setting up a dedicated ad-blocker on your own network? We decided it was high time to try. For those that want to it's an easy setup on a NAS box and gives a central dashboard for whitelisting, blacklisting, toggling ad filters, logs, etc.
  - stavros 2y ago
    Granted, Pi hole is a great project, and this new version does seem like a big improvement. It just irks me how people will stay with a hostile browser instead of spending the literal five minutes it takes to switch to another one.
  - anonymousiam 2y ago
    I nearly submitted this story myself, so I'm glad somebody did. I've been running pihole at two locations for many years. It does a great job of blocking ads and scripts on all devices. I customized one of my two locations and it stopped service DHCP on one of the two subnets after the update a few weeks ago. I reverted the update and it's been fine. (I keep good backups.) A friend who also runs it had the same problem and he provided me with his solution before I had a chance to look at it myself: listeningMode = "ALL" ### CHANGED, default = "LOCAL"
- lolinder 2y ago
hagbard_c 2y ago
An alternative option for those already running an OpenWRT router - whether that be on dedicated hardware (usually a reflashed commercial wifi access point + router) or as a virtual router (e.g. running in a container or VM, this is how I use it) - is to use the Adblock package and configure it to force local DNS (Redirect all DNS queries from specified zones to the local DNS resolver, applies to UDP and TCP protocol). This partly works but it is not effective against applications (e.g. TikTok) and devices (e.g. 'smart' televisions) using DoH (DNS over HTTPS) since that traffic is indistinguishable from normal web traffic without deep packet inspection. I have tried to run ipset-based blocklists to force such applications and devices to use 'normal' DNS but this is not really feasible as DoH servers can be hosted just about anywhere.
- PaulKeeble 2y ago
  FreshTomato also has a adblock function that can go off the usual web lists. DD-WRT I recall does as well. Just goes to show the open source firmwares in general are superior and it should be a feature people look for when buying routers.
- ndsipa_pomu 2y ago
  My setup is on a nanopi running FriendlyWRT/OpenWRT with Docker installed. PiHole is easy to run from docker - have a look at https://github.com/pi-hole/docker-pi-hole/ https://github.com/pi-hole/docker-pi-hole/
TZubiri 2y ago
[flagged]
- borski 2y ago
  That’s not what this is. You are already using a DNS server; it’s just the one your ISP built. Swapping your DNS server takes three seconds in your router interface.
  - TZubiri 2y ago
    It's taking something (DNS) to do things it wasn't designed to do (be an ads firewall) That's a definition of hacking
    - borski 2y ago
      No, it isn’t. DNS converts domain names to IP addresses. All you are doing here is saying you don’t want to talk to certain domain names. That’s not hacking; that’s literally how DNS works and what it is for. You are using it for its intended purpose, which is to map domain names to IP addresses. What those IP addresses are often changes and is dependent on the network, which is why organizations have internal DNS servers.
      - TZubiri 2y ago
        I guess it comes down to subjective definitions and semantics. I get that DNS works by converting domains to ips, I've implemented DNS server protocol in C. Whenever you 'hack' something, you can always frame it in terms of its intended purpose. You are not hacking the ping binary to ddos a website, you are merely configuring it to send ICMP packets of 1TB of size at a very high frequency. In this case DNS is originally a mechanism to convert hierarchical numerical ip adresses with geographical info, to human memorable textual names. It serves a role of helping humans memorize, of providing textual names to servers. When you use it as a firewall tool, it is not its intended purpose, I'm not against it, in fact I think dns based firewalls are great, especially at the state level. But they are strictly a creative usage of a protocol that was not designed for that purpose, and its an additive modification, you add a blacklist to a DNS that has all of the addresses and you filter some out. Therefore, it is two things, a DNS and a firewall. The firewall is not a DNS, it's a domain based blacklist something else.
TacticalCoder 2y ago
[dead]
gigel82 2y ago
Both Pi-Hole and AdGuardHome are good; I've used both and settled on AdGuardHome as I've found it to be slightly faster to resolve (with the same Quad9 upstream for both).
3eb7988a1663 2y ago
Note that when I tried PiHole years ago, travel/flight-booking sites frequently required exemptions in order to operate. Not sure if the filtering is finer grained now, but it is not entirely a risk free proposition to set this up for an entire household.
- udev4096 2y ago
  The default list is so small that I am inclined to believe you used an untested and unmaintained 3rd party block list. Use the lists from firebog.net and hagezi. They are well maintained and documented
- 000ooo000 2y ago
  FWIW the PiHole web UI and Flutterhole (Android app) have easily accessible 'disable for x mins' operations which can help for things like this.
  - master_crab 2y ago
    There’s also an iOS remote app I have used - pi-hole remote. Works wonders to temp disable pihole
  - 3eb7988a1663 2y ago
    The controls exist, but it is just one more "computer thing" to break for a non-techy audience. I thought about wiring up a physical button which would send the "disable for N minutes command" before I realized I was playing with too much fire.
    - roland35 2y ago
      That is why my wife won't use the pihole on my network - things like Google map links to hotels, Amazon shopping links, even target app pictures didn't work out of the box. I have a button on my stream deck to enable/disable pihole but I totally understand that is an annoyance for others!
- icelancer 2y ago
9x39 2y ago
Unfortunately, moving to DNS blocking could only be a brief refuge before the creeping anti-adblock efforts target it as well. Adtech and the web are identifiable by mostly unique domains, but what if that could be hidden? What if the adtech industry builds and pushes a reverse proxy tech of sorts for page content inside the page where the web server goes and loads 3rd party content for the page render before sending it you? The theoretical result could make every request looks like it comes from the domain you requested and there's nothing to discriminate on when it comes to DNS requests. Unrealistic? Today, maybe. Wait until DNS ad blocking goes mainstream, Manifestv2 addons are long since stamped out and Manifestv3 addons are proven to be gutted and defeated. If click-through rates are noticeably higher with some kind of anti-dnsblocking proxy, we'll probably see proxies everywhere. What we'd do then for ad-block is beyond me.
- userbinator 2y ago
  we'll probably see proxies everywhere. What we'd do then for ad-block is beyond me. Filtering proxies on the other end. A lot of corporate networks already MITM all traffic so they can block, monitor, and rewrite; and ironically that has been much-maligned by those working for Big Browser, ostensibly for "security" reasons. Ditto for the DoH advocates. I've been running a filtering proxy on my network since the turn of the century. This was somewhat common in the past, then waned as browsers started growing extension functionality (one wonders if growing, and then now heavily restricting, extensions was a way to discourage proxying) but I suspect it'll become more popular in the future too. https://news.ycombinator.com/item?id=36824165 https://news.ycombinator.com/item?id=36824165 https://news.ycombinator.com/item?id=36832736 https://news.ycombinator.com/item?id=36832736 ...and the fact that TLS fingerprinting is now a thing, and you'll be easily considered a "bot" by many sites if you MITM your own traffic, shows what their real intentions are.
exabrial 2y ago
Do you think Google is going to let you get away with this? pahahaha. Nope. The next thing they'll do is to claim that DNS over TLS (probably port 443 mind you) is mandatory. On a side note, Safari's latest version seems to do this, and there's no way I can figure out how to disable the behavior. Per usual, they'll claim is "for safety", but the real motive is to kneecap extremely useful tools like PiHole.
- userbinator 2y ago
  DoH is already a thing. Of course, the escalation from the user side is likely to involve more firewalls and proxies.
noobermin 2y ago
It's a bit ironic that the article is all about blocking ads whilst essentially being an ad for pihole.
- sudahtigabulan 2y ago
  Only if we agree that a tutorial on how to use grep to find things, instead of just putting up with not finding them, is an "ad for grep".
- shermantanktop 2y ago
  No, the real irony is the last bit where they beg the reader to allow the Register’s ads. > Bootnote: If any loyal Reg readers have built a Pi-hole allow-list to whitelist El Reg and its sister sites, do please let us know in the comments.
  - defrost 2y ago
    Modern comedic, self aware irony, yes. Classic Real Irony™ ? No. a literary technique, originally used in Greek tragedy, by which the full significance of a character's words or actions is clear to the audience or reader although unknown to the character.
    - shermantanktop 2y ago
      Ah, the old No Truly Ironic Scotsman. A certain Canadian pop princess knows how hard it is to please the pedants on this point.
      - defrost 2y ago
        Elisapie ?
        shermantanktop 2y ago
        TIL. No, I was thinking of https://en.m.wikipedia.org/wiki/Ironic_(song) https://en.m.wikipedia.org/wiki/Ironic_(song)
kristianp 2y ago
My Chrome browser has just announced that uBlock Origin was turned off as it's no longer supported. Time to install another browser. Edit: actually uBlock Origin Lite has been recommended as an alternative.
- from-nibly 2y ago
  It's not as good. Even ublock themselves point that out.
  - TiredOfLife 2y ago
    While not as good. It is still 100x better than dns based blocker
udev4096 2y ago
Pi-hole shouldn't be recommended anymore. The recent breaking change pretty much broke everyone's instances and also the downstream projects which has a plugin for pi-hole. Plus, pi-hole has very less configurable options and it's nothing more than a giant wrapper of dnsmasq. Instead, AdGuard Home seems to be more reliable and can be highly configurable with options to separate the DNS resolvers based on groups
- nunez 2y ago
  Agreed. AdGuard Home is much better overall.
  - shermantanktop 2y ago
    But not free as in beer? Hard to tell from their site tbh, it is possible to pay but if they have free options I didn’t wade through enough product info to find them.
    - watermelon0 2y ago
      It's a self-hosted software under GPL3 license. https://github.com/AdguardTeam/AdGuardHome https://github.com/AdguardTeam/AdGuardHome
112233 2y ago
Why is PiHole even mentioned as alternative to UbO? It is not a comparable thing! There is SO MUCH stuff you cannot do without access to the page contents. cookies. tracking parameters. "pixels". javascript. etc etc
- dredmorbius 2y ago
  PiHole, or equivalent DNS-based blocking tools protect networks, presuming your DHCP server points clients to the PiHole DNS server. ALL devices and apps on those devices which rely on the indicated DNS server benefit. uBlock Origin protects individual browser profiles only. That is, if you have uBlock Origin installed and it's enabled on a given browser profile, that specific usage is protected. Yes, uBo gives far more power in blocking online content, where it's available. But it only goes so far. With PiHole, one of the disadvantages is that when you use another network you lose all your ad / malware blocking protections. I find it jarring when I use a tool w/o any native ad-blocking on an outside network. Best practice is to use both DNS-based blocking (for global coverage on your LAN) AND uBlock Origin for browser instances where it's available (desktop generally, Firefox/Android on mobile).
  - 112233 2y ago
    Exactly. Thank you for taking the time and elaborating on the difference for those, who may be confused about it. Now compare to the article: "chrome users are forced to use less capable UbO lite. Enter PiHole!" So, basically, PiHole gives you all that you lose because of the Chrome dropping v2. I cannot read that in any other way.
    - dredmorbius 2y ago
      Quibble: PiHole gives you back some of what you lose with uBo. uBo will block more than just source-based content (though it does include very extensive domain blocklists). It will also, for example, block YouTube ads (added by YT, but not sponsorship bits within the video itself), ads identified by CSS or JS syntax, and (if you choose to do so) other Web annoyances, for example sticky header/navigation bars if those are present and you've installed the appropriate additional blocklists. PiHole can't do any of the latter, though again, it's far better than nothing, and covers more than just the browser. Example of the latter, one of the Android podcast apps I have inserts advertising, that happens to be caught (usually) by my DNS-based blackhole when I'm at home, but not when I'm travelling. It's jarring to see those ads should I fire up the app when I'm on the road.

flaskking 2y ago

[flagged]

deleted 2y ago

[deleted]

CharlesW 2y ago

Yes, or — if you're lazy like I am, and don't want to manage another device or container — use something like NextDNS, which has a very generous free plan and an extremely inexpensive yearly plan. Control D is a popular alternative with similar plans. In the last 3 months, NextDNS has blocked nearly 9% of 10M DNS queries from devices in my household with no ill effects that I'm aware of. (I'm not affiliated with NextDNS in any way, other than as a satisfied paying customer.)

stavros 2y ago
NextDNS's price of $20/year (or something like that) is the easiest purchase I've ever made. I still use uBlock origin, but like how NextDNS will block stuff from phones and other devices as well.
philips 2y ago
Tailscale + NextDNS is a dream. One simple app to get me back to my self hosted services and block ads. https://tailscale.com/kb/1218/nextdns https://tailscale.com/kb/1218/nextdns
- noahjk 2y ago
  Not only can Tailscale directly integrate with NextDNS and therefore not require extra configuration on-device for DNS, but you can use Tailscale ACLs to assign different NextDNS profiles to different devices (for example, a parental control profile to a kid's device or an Apple TV, or an IoT profile, etc)
- workfromspace 2y ago
  I did not understand the use case here. Could you please explain further? I have been using NextDNS for many years now, but I didn't get why I should use Tailscale.
OneLeggedCat 2y ago
Do you mean 90%?
- CharlesW 2y ago
  Nope! NextDNS blocked 913,294 of 10,287,370 queries over the last 3 months. I'm sure the percentage would rise if I flipped on other options that they provide ("AI-Driven Threat Detection", "Block Newly Registered Domains", etc.), and I should probably revisit those.
  - Brajeshwar 2y ago
    Wow! I'm more intrigued by the fact that you did 10M queries in 3 months. I'm going to assume you're using a single profile for everything. I have separated machines/robots (that includes the TV), kids, and other profiles for business devices.
    - CharlesW 2y ago
      That's a steller idea, thanks for mentioning it! I didn't realize that different profiles assign unique DNS servers, allowing me to partition off devices that don't support DNS-over-TLS/DNS-over-HTTPS/IPv6. I don't think it'd affect total queries, but tighter rules for machines/robots, etc. should increase the percentage of blocked requests.
- thedanbob 2y ago
  9% is reasonable. I've got pretty strict filters on my home DNS and it's currently blocking 12%. I imagine that number would be much higher if I didn't have ad block extensions on all my browsers and IoT devices on a restricted VLAN.
nik282000 2y ago
They are a US based company, whether they say they log your data or not, they can be compelled to log your requests and not tell you about it. Regardless they look like good alternative for users who are unable to setup or are prevented from using a pihole.
- jedberg 2y ago
  > They are a US based company, whether they say they log your data or not, they can be compelled to log your requests and not tell you about it. If someone wanted your internet traffic, they wouldn't bother with NextDNS. They would just compel your internet provider to give it to them. This is not a real risk to using NextDNS.
  - benoau 2y ago
    I mean in theory this is absolutely correct and everyone everywhere will follow due process and the data will only become available at the individual level when a court affirms it is appropriate. As long as due process and checks and balances are respected, there's absolutely nothing to worry about lmfao.
    - jedberg 2y ago
      I think you missed my point. Your ISP already has your traffic, and is just as easy to compel as NextDNS. No one is going to NextDNS for your traffic, and even if they do, NextDNS doesn't have any information your ISP doesn't already have.
  - oefrha 2y ago
    The good ol’ everyone on the Internet is American fallacy.
    - kube-system 2y ago
      The good ol' media talks about it happening in America so it must only happen in America fallacy. ISPs can be compelled to divulge data in most places around the world.
eth0up 2y ago
Been using nextdns on both droid and linux and am really grateful for it. Coupled with ublock, I can browse the tubes without having a seizure. I'm so satisfied with it, that I fear someone will come along and prick me happy bubble, explaining why it's bad. But I might just look away. Nextdns is great
NilayK 2y ago
It’s also easy to use Pi-hole with NextDNS as the upstream server using cloudflared as the DNS-over-HTTPS tool[1] to connect to NextDNS in a secure manner [1]: https://docs.pi-hole.net/guides/dns/cloudflared/ https://docs.pi-hole.net/guides/dns/cloudflared/
1vuio0pswjnm7 2y ago
Paying does not solve the online ads problem, it only adds to it by creating a market for companies that can profit from online ads while collecting even more data from internet users. DNS query data is probably as close to www browsing history as one can get. These companies can easily be acquired by Big Tech. Nothing stops them from selling out and selling their customers out. This is a win for the DNS provider, a win for Big Tech and a loss for the internet user. Google already collects fees from some people who are willing to pay in return for "no ads"; meanwhile Google still collects data on these people; it may be used to support ads shown elsewhere or for any purpose whatsoever. Paying does not stop the online ads problem. If anything it makes online ads even more attractive; they can be used to annoy people into paying fees. Some people will actually pay to have their data collected by an advertising company. As far as I know, please correct if wrong,, Pi Hole is 100% non-commercial. It is basically a modified dnsmasq with default settings that forward queries to third party DNS providers that profit from ad services, like Google. If online advertising were to decrease or disappear, then Pi Hole is not threatened. Whereas a third party DNS service like NextDNS has a financial incentive to ensure that the online ads problem persists, as it creates their "market". The disapperance of online ads, for whatever reason, would be catastrophic for NextDNS. I am not a Pi Hole user as I do nmot like dnsmasq. I use other DNS software and map DNS data collected in bulk from variety of sources into local forward proxy memory.

stavros 2y ago

This is infuriating. "This browser is shit, so here's how to install a program that makes this browser tolerable". No! Stop using Chrome! There are other browsers you could (and should) use instead!

defrost 2y ago
Not a great headline, the article focus is on recent version improvements and entire local network "front of house" protection for all devices, all browsers, tablets, TVs, local data phones, etc: Pi-Hole 6 appeared a few weeks ago. Since then, there have been a few small bug fixes and it's now up to version 6.0.5. The new release is lighter weight and has fewer external dependencies: it no longer needs PHP or an external web server. If you run the Docker container version on top of another Linux OS, it's lighter still, as the container is now based on Alpine Linux instead of Debian. Is it really worth setting up a dedicated ad-blocker on your own network? We decided it was high time to try. For those that want to it's an easy setup on a NAS box and gives a central dashboard for whitelisting, blacklisting, toggling ad filters, logs, etc.
- stavros 2y ago
  Granted, Pi hole is a great project, and this new version does seem like a big improvement. It just irks me how people will stay with a hostile browser instead of spending the literal five minutes it takes to switch to another one.
- anonymousiam 2y ago
  I nearly submitted this story myself, so I'm glad somebody did. I've been running pihole at two locations for many years. It does a great job of blocking ads and scripts on all devices. I customized one of my two locations and it stopped service DHCP on one of the two subnets after the update a few weeks ago. I reverted the update and it's been fine. (I keep good backups.) A friend who also runs it had the same problem and he provided me with his solution before I had a chance to look at it myself: listeningMode = "ALL" ### CHANGED, default = "LOCAL"
lolinder 2y ago

hagbard_c 2y ago

An alternative option for those already running an OpenWRT router - whether that be on dedicated hardware (usually a reflashed commercial wifi access point + router) or as a virtual router (e.g. running in a container or VM, this is how I use it) - is to use the Adblock package and configure it to force local DNS (Redirect all DNS queries from specified zones to the local DNS resolver, applies to UDP and TCP protocol). This partly works but it is not effective against applications (e.g. TikTok) and devices (e.g. 'smart' televisions) using DoH (DNS over HTTPS) since that traffic is indistinguishable from normal web traffic without deep packet inspection. I have tried to run ipset-based blocklists to force such applications and devices to use 'normal' DNS but this is not really feasible as DoH servers can be hosted just about anywhere.

PaulKeeble 2y ago
FreshTomato also has a adblock function that can go off the usual web lists. DD-WRT I recall does as well. Just goes to show the open source firmwares in general are superior and it should be a feature people look for when buying routers.
ndsipa_pomu 2y ago
My setup is on a nanopi running FriendlyWRT/OpenWRT with Docker installed. PiHole is easy to run from docker - have a look at https://github.com/pi-hole/docker-pi-hole/ https://github.com/pi-hole/docker-pi-hole/

TZubiri 2y ago

[flagged]

borski 2y ago
That’s not what this is. You are already using a DNS server; it’s just the one your ISP built. Swapping your DNS server takes three seconds in your router interface.
- TZubiri 2y ago
  It's taking something (DNS) to do things it wasn't designed to do (be an ads firewall) That's a definition of hacking
  - borski 2y ago
    No, it isn’t. DNS converts domain names to IP addresses. All you are doing here is saying you don’t want to talk to certain domain names. That’s not hacking; that’s literally how DNS works and what it is for. You are using it for its intended purpose, which is to map domain names to IP addresses. What those IP addresses are often changes and is dependent on the network, which is why organizations have internal DNS servers.
    - TZubiri 2y ago
      I guess it comes down to subjective definitions and semantics. I get that DNS works by converting domains to ips, I've implemented DNS server protocol in C. Whenever you 'hack' something, you can always frame it in terms of its intended purpose. You are not hacking the ping binary to ddos a website, you are merely configuring it to send ICMP packets of 1TB of size at a very high frequency. In this case DNS is originally a mechanism to convert hierarchical numerical ip adresses with geographical info, to human memorable textual names. It serves a role of helping humans memorize, of providing textual names to servers. When you use it as a firewall tool, it is not its intended purpose, I'm not against it, in fact I think dns based firewalls are great, especially at the state level. But they are strictly a creative usage of a protocol that was not designed for that purpose, and its an additive modification, you add a blacklist to a DNS that has all of the addresses and you filter some out. Therefore, it is two things, a DNS and a firewall. The firewall is not a DNS, it's a domain based blacklist something else.

TacticalCoder 2y ago

[dead]

gigel82 2y ago

Both Pi-Hole and AdGuardHome are good; I've used both and settled on AdGuardHome as I've found it to be slightly faster to resolve (with the same Quad9 upstream for both).

3eb7988a1663 2y ago

Note that when I tried PiHole years ago, travel/flight-booking sites frequently required exemptions in order to operate. Not sure if the filtering is finer grained now, but it is not entirely a risk free proposition to set this up for an entire household.

udev4096 2y ago
The default list is so small that I am inclined to believe you used an untested and unmaintained 3rd party block list. Use the lists from firebog.net and hagezi. They are well maintained and documented
000ooo000 2y ago
FWIW the PiHole web UI and Flutterhole (Android app) have easily accessible 'disable for x mins' operations which can help for things like this.
- master_crab 2y ago
  There’s also an iOS remote app I have used - pi-hole remote. Works wonders to temp disable pihole
- 3eb7988a1663 2y ago
  The controls exist, but it is just one more "computer thing" to break for a non-techy audience. I thought about wiring up a physical button which would send the "disable for N minutes command" before I realized I was playing with too much fire.
  - roland35 2y ago
    That is why my wife won't use the pihole on my network - things like Google map links to hotels, Amazon shopping links, even target app pictures didn't work out of the box. I have a button on my stream deck to enable/disable pihole but I totally understand that is an annoyance for others!
icelancer 2y ago

9x39 2y ago

Unfortunately, moving to DNS blocking could only be a brief refuge before the creeping anti-adblock efforts target it as well. Adtech and the web are identifiable by mostly unique domains, but what if that could be hidden? What if the adtech industry builds and pushes a reverse proxy tech of sorts for page content inside the page where the web server goes and loads 3rd party content for the page render before sending it you? The theoretical result could make every request looks like it comes from the domain you requested and there's nothing to discriminate on when it comes to DNS requests. Unrealistic? Today, maybe. Wait until DNS ad blocking goes mainstream, Manifestv2 addons are long since stamped out and Manifestv3 addons are proven to be gutted and defeated. If click-through rates are noticeably higher with some kind of anti-dnsblocking proxy, we'll probably see proxies everywhere. What we'd do then for ad-block is beyond me.

userbinator 2y ago
we'll probably see proxies everywhere. What we'd do then for ad-block is beyond me. Filtering proxies on the other end. A lot of corporate networks already MITM all traffic so they can block, monitor, and rewrite; and ironically that has been much-maligned by those working for Big Browser, ostensibly for "security" reasons. Ditto for the DoH advocates. I've been running a filtering proxy on my network since the turn of the century. This was somewhat common in the past, then waned as browsers started growing extension functionality (one wonders if growing, and then now heavily restricting, extensions was a way to discourage proxying) but I suspect it'll become more popular in the future too. https://news.ycombinator.com/item?id=36824165 https://news.ycombinator.com/item?id=36824165 https://news.ycombinator.com/item?id=36832736 https://news.ycombinator.com/item?id=36832736 ...and the fact that TLS fingerprinting is now a thing, and you'll be easily considered a "bot" by many sites if you MITM your own traffic, shows what their real intentions are.

exabrial 2y ago

Do you think Google is going to let you get away with this? pahahaha. Nope. The next thing they'll do is to claim that DNS over TLS (probably port 443 mind you) is mandatory. On a side note, Safari's latest version seems to do this, and there's no way I can figure out how to disable the behavior. Per usual, they'll claim is "for safety", but the real motive is to kneecap extremely useful tools like PiHole.

userbinator 2y ago
DoH is already a thing. Of course, the escalation from the user side is likely to involve more firewalls and proxies.

noobermin 2y ago

It's a bit ironic that the article is all about blocking ads whilst essentially being an ad for pihole.

sudahtigabulan 2y ago
Only if we agree that a tutorial on how to use grep to find things, instead of just putting up with not finding them, is an "ad for grep".
shermantanktop 2y ago
No, the real irony is the last bit where they beg the reader to allow the Register’s ads. > Bootnote: If any loyal Reg readers have built a Pi-hole allow-list to whitelist El Reg and its sister sites, do please let us know in the comments.
- defrost 2y ago
  Modern comedic, self aware irony, yes. Classic Real Irony™ ? No. a literary technique, originally used in Greek tragedy, by which the full significance of a character's words or actions is clear to the audience or reader although unknown to the character.
  - shermantanktop 2y ago
    Ah, the old No Truly Ironic Scotsman. A certain Canadian pop princess knows how hard it is to please the pedants on this point.
    - defrost 2y ago
      Elisapie ?
      - shermantanktop 2y ago
        TIL. No, I was thinking of https://en.m.wikipedia.org/wiki/Ironic_(song) https://en.m.wikipedia.org/wiki/Ironic_(song)

kristianp 2y ago

My Chrome browser has just announced that uBlock Origin was turned off as it's no longer supported. Time to install another browser. Edit: actually uBlock Origin Lite has been recommended as an alternative.

from-nibly 2y ago
It's not as good. Even ublock themselves point that out.
- TiredOfLife 2y ago
  While not as good. It is still 100x better than dns based blocker

udev4096 2y ago

Pi-hole shouldn't be recommended anymore. The recent breaking change pretty much broke everyone's instances and also the downstream projects which has a plugin for pi-hole. Plus, pi-hole has very less configurable options and it's nothing more than a giant wrapper of dnsmasq. Instead, AdGuard Home seems to be more reliable and can be highly configurable with options to separate the DNS resolvers based on groups

nunez 2y ago
Agreed. AdGuard Home is much better overall.
- shermantanktop 2y ago
  But not free as in beer? Hard to tell from their site tbh, it is possible to pay but if they have free options I didn’t wade through enough product info to find them.
  - watermelon0 2y ago
    It's a self-hosted software under GPL3 license. https://github.com/AdguardTeam/AdGuardHome https://github.com/AdguardTeam/AdGuardHome

112233 2y ago

Why is PiHole even mentioned as alternative to UbO? It is not a comparable thing! There is SO MUCH stuff you cannot do without access to the page contents. cookies. tracking parameters. "pixels". javascript. etc etc

dredmorbius 2y ago
PiHole, or equivalent DNS-based blocking tools protect networks, presuming your DHCP server points clients to the PiHole DNS server. ALL devices and apps on those devices which rely on the indicated DNS server benefit. uBlock Origin protects individual browser profiles only. That is, if you have uBlock Origin installed and it's enabled on a given browser profile, that specific usage is protected. Yes, uBo gives far more power in blocking online content, where it's available. But it only goes so far. With PiHole, one of the disadvantages is that when you use another network you lose all your ad / malware blocking protections. I find it jarring when I use a tool w/o any native ad-blocking on an outside network. Best practice is to use both DNS-based blocking (for global coverage on your LAN) AND uBlock Origin for browser instances where it's available (desktop generally, Firefox/Android on mobile).
- 112233 2y ago
  Exactly. Thank you for taking the time and elaborating on the difference for those, who may be confused about it. Now compare to the article: "chrome users are forced to use less capable UbO lite. Enter PiHole!" So, basically, PiHole gives you all that you lose because of the Chrome dropping v2. I cannot read that in any other way.
  - dredmorbius 2y ago
    Quibble: PiHole gives you back some of what you lose with uBo. uBo will block more than just source-based content (though it does include very extensive domain blocklists). It will also, for example, block YouTube ads (added by YT, but not sponsorship bits within the video itself), ads identified by CSS or JS syntax, and (if you choose to do so) other Web annoyances, for example sticky header/navigation bars if those are present and you've installed the appropriate additional blocklists. PiHole can't do any of the latter, though again, it's far better than nothing, and covers more than just the browser. Example of the latter, one of the Android podcast apps I have inserts advertising, that happens to be caught (usually) by my DNS-based blackhole when I'm at home, but not when I'm travelling. It's jarring to see those ads should I fire up the app when I'm on the road.