9 ms·

The Beauty of Having a Pi-Hole (2024)

325 points by mpweiher 1y ago

mikestew 1y ago
In case you’re like a lot of folks in HN, read the title, and say to yourself “already have one”, read TFA for the iptables config that fixes those apps and devices that bypass local DNS. For example, the New York Times app seems to now use its own hard-coded DNS servers. Without having tried it, it looks like TFA has the fix for that. EDIT: replies indicate that I, a person who is barely competent at many network tasks, might be off-base on this one. Grain of salt, and all.
- ignoramous 1y ago
  > For example, the New York Times app seems to now use its own hard-coded DNS servers. Without having tried it, it looks like TFA has the fix for that. Those commands in TFA simply reroute traffic on port 53 to Pi-Hole, which isn't enough to prevent apps from doing their own name resolution. For instance, the Telegram app has built-in DNS-over-HTTPS, which those iptables chains could do nothing about.
  - shaky-carrousel 1y ago
    You can block known DoH servers.
- elashri 1y ago
  An increasing number of them also rely on hard coded DoH servers which is harder to block/redirect. You will need to will Pi-Hole/Adguard Home on router to block them based on some curtailed lists (i.e [1]) [1] https://github.com/dibdot/DoH-IP-blocklists https://github.com/dibdot/DoH-IP-blocklists
  - rsync 1y ago
    In this arms race you are saying a current "move" is a curated list of IPs that correspond to known DoH servers ... and that's fine .. However, if the adversary decides to just query - and answer - DoH requests on the same hostname that you are trying to talk to ... isn't that a winning move ? For instance: If one had an application - or an appliance - that spoke https to endpoint.samsung.com, how would one block DoH requests addressed to the same endpoint.samsung.com ?
    - baby_souffle 1y ago
      That might work but if your Samsung example is behind cloudflare, you're basically going to have to block any and all access to cloudflare's Network. And if telemetry.example-iot.com belongs to an AWS IP, it could change to another IP in their space at any time so your only recourse would be to limit connectivity to all of AWS which would effectively prevent you from accessing most things on the internet
    - pimeys 1y ago
      I run Zenarmor in addition to Adguard at home, which can detect DoH traffic and intercept it. You have to pay for this enterprise level tool, but if you are worried about DoH, Zenarmor is so far the easiest tool to block it. In our house the only device that tries to use DoH is my partner's iPhone. It tries a few times, fails, then uses the Adguard DNS, which blocks the trackers.
      - illiac786 1y ago
        Do you have documentation of this? My understanding was always that Zenarmor simply maintains a list of known DoH servers.
    - toast0 1y ago
      If you're really serious about DNS interception, you'd setup something where a) you stop accepting A lookups, because it's 2025 and IPv4 only is dead (let's pretend anyway) b) for each AAAA lookup, return a new IPv6 address that you'll NAT to the real address (you can use this for NAT64 if you want to let clients connect to IPv4 hosts). Then only let clients connect to these IPv6 addresses you setup. If someone smuggles address resolution through, outside of DNS, their clients can't connect. (this is going to be a big PITA, but that's how these things go)
      - dullcrisp 1y ago
        I guess at that point they’d have to establish a tunnel and route ads through the same HTTPS connection as legitimate traffic.
  - jeroenhd 1y ago
    And before DoH was a thing, several Chinese apps I've used also used to do plain HTTP for DNS resolution (I only caught them by chanbecause they were doing HTTP). PiHoles only work for apps that stick to the standards and don't mind being caught.
  - TacticalCoder 1y ago
    Browsers allows corporations to prevent DoH and force DNS through company-owned DNS servers: https://support.mozilla.org/en-US/kb/dns-over-https https://support.mozilla.org/en-US/kb/dns-over-https I use these settings on all my browsers to prevent DoH and make sure traffic goes through my Pi (I run unbound directly on the Pi though, not Pi-Hole: in my experience unbound is a bit harder to set up initially but it's also more powerful than Pi-Hole... For example unbound accepts wildcards in blocklists). It's not incompatible with also blocking, at the firewall level, all known DoH servers of course. Nor is it incompatible with forcing your router to also use your Pi as a DNS.
- silverwind 1y ago
  Apps that open arbritrary UDP/TCP ports? Isn't that something the app store policies should reject?
  - epcoa 1y ago
    What is an arbitrary TCP port? Ports in isolation from an IP address aren't inherently arbitrary, they're nothing, and the IP:port pair is arbitrary. Once you allow connections to any host on the internet the port doesn't really matter - you can do whatever nefarious shit over port 80. And not allowing apps to connect to external internet servers seems pretty limiting.
  - 01HNNWZ0MV43FF 1y ago
    They're not opening listening ports on the local system, they're just ignoring the system's DNS and saying "Take me to this IP and this port" and then doing a DNS lookup themselves
- wang_li 1y ago
  > read TFA for the iptables config that fixes those apps and devices that bypass local DNS. For example, Don't worry. All the browsers and stuff are bypassing this level of control by moving to DNS-over-HTTPS. You'll either have to deploy a TLS terminating proxy on your network, or give up on this arms race.
  - notarealllama 1y ago
    Jokes on you, I do have a fortinet which does this.... Oh wait, only up to TLS 1.1 or something and it's slow. I forgot the name of the software but there used to be a few tools to terminate and reencrypt. But yeah dnssec is it's own challenge
    - gbuk2013 1y ago
      You need to get an F5 box instead. :)
  - gbuk2013 1y ago
    To be fair, if you are geeky enough to run a PiHole you will have no trouble finding the config option to turn off DoH in your browser.
    - freedomben 1y ago
      True, but I want all the devices on my home network to have DoH disabled too. Most of them I can't change directly.
    - int0x29 1y ago
      Don't turn it off in your browser. If you have control of that setting just install an ad blocker. The point of DNS block lists is to get rid of ads on phones, TVs, and other non configurable things.
      - woleium 1y ago
        And then there is amazon sidewalk, which can only be evaded by unplugging the wifi board on your tv
- iugtmkbdfil834 1y ago
  I was going to say, as a person who used pihole pretty extensively at one point, it may not be enough anymore. I am by no means a network expert, but I do recognize those shortcomings and try to compensate for them. Blanket pihole recommendation may be disservice at this point.
- bongodongobob 1y ago
  No, that's not a fix and those iptables settings are on the router. It will only catch DNS requests on port 53. Doesn't catch DoH which you can't do on a router, you need a firewall for that.
  - tenacious_tuna 1y ago
    Also, doesn't that break the network if the pihole is offline? Before I'd just override DNS on my workstation, but that iptables config would block any "unsanctioned" DNS traffic
    - bongodongobob 1y ago
      It would, yes
- RachelF 1y ago
  I've seen Windows 11 ignoring DNS settings too, for Microsoft telemetry, ads and updates.
ryandrake 1y ago
Standard reminder for whenever Pi-Hole gets brought up: You don't actually need a physical Raspberry Pi for this functionality, and you don't even need the Pi-Hole software. It's all just wrappers around dnsmasq[1], which every Linux distribution makes available via their package manager. If you have an old spare Linux system on your LAN already, doing whatever, you can just install and set up dnsmasq and point your clients' DNS settings at it! You can run it on your Internet gateway or rooted WiFi router, too. 1: https://en.wikipedia.org/wiki/Dnsmasq https://en.wikipedia.org/wiki/Dnsmasq
- mikestew 1y ago
  I was shocked that TFA’s recommended kit was $155! When did Raspberry Pi’s get so pricey?
  - ChrisLTD 1y ago
    Same. I thought it'd be ~$50.
  - deleted 1y ago
    [deleted]
  - jamesgeck0 1y ago
    I don't _think_ you need a whole Raspberry Pi 5 kit. It seems like an older Raspberry Pi 3b+ would get the job done for $35 or so. Maybe even a Raspberry Pi Zero ($5) with an micro usb ethernet adapter.
    - mikestew 1y ago
      Oh, it will definitely work on older ones. The one I have, w/o logging in and explicitly looking, is a 3-$SOMETHING, probably 3b+. Works just fine.
      - shrikant 1y ago
        My Pi-hole runs on a ~13 year old Model B, which has survived several house moves. Definitely don't need top of the line hardware for it!
incomingpain 1y ago
<3 my pihole. Currently im at 28% blocked. Typically im above 50% like OP. They have significantly higher number of domains blocked. time to update my lists: https://firebog.net/ https://firebog.net/
- jyap 1y ago
  It’s all relative. I’m at 24.4% but I have quite a few devices like Wemo light switches at the top of my DNS queries. Only have one Amazon Alexa device but that’s near the top as well. IoT devices which constantly phone home will skew things.
jstanley 1y ago
I really don't understand why people go to the trouble of using Pi-hole that only blocks at the DNS level, instead of using uBlock Origin which can block at the DOM level. uBlock Origin is easier and cheaper to set up, less maintenance, and more effective.
- blurbleblurble 1y ago
  Could be nice to have both! Plus, it's not clear that chrome will always support manifest v2. I recently learned that you can still use unlock origin in chromium by going to the extensions page and manually turning it back on, but who knows how long this will last?
- kgwxd 1y ago
  Not all internet traffic goes through a browser.
- crtasm 1y ago
  uBlock is only for your web browser - it can't help with other apps, smart devices, game consoles, etc. It's best to run both.
  - rsync 1y ago
    "uBlock is only for your web browser - it can't help with other apps, smart devices, game consoles, etc." Yes, but don't we expect all of those devices (and apps) to move to DoH resolution if they haven't already ? In that case the pihole (or nextdns, etc.) are bypassed ... I suppose you could proxy all TLS traffic and block it but if the DoH is being served by the same FQDN as the traffic you want in the first place aren't you out of options ?
    - timeinput 1y ago
      I mean I expect devices and apps to move to DoH, but they haven't yet, or at least not all of them. My experience generally on my phone at home (with DNS blocking) is better enough than my experience away from home that I'm glad I took the half a day or there about to set up a DNS blocking tool a couple years ago. A couple years ago it was like night and day. Now it is still better than nothing, and in a year or two it might not be worth running. It's definitely a moving target, but "we expect ... to move to DoH resolution" means that they haven't all moved yet, and a DNS based ad/telemetry/etc blocker still works today (for some apps / smart devices). If it works for some things today why would I turn it off because it might not work for a subset of those things tomorrow? Agreed the value proposition of setting one up is probably dropping, but I still prefer it to nothing. Now that I think of it I should probably start logging how many DNS look ups "fail" because of the DNS blocking list, and monitor for changes. If it ever gets to less than one a day it's probably not worth the couple of W to power the RaspberryPI
lambdaba 1y ago
Tailscale with NextDNS is a simpler alternative to this and is easy to set up on all your devices.
- bix6 1y ago
  Is there a tutorial you recommend?
  - lambdaba 1y ago
    There's a lot more to Tailscale but for a basic setup you just install the client on all your devices, and set DNS to the NextDNS endpoint. Any device on your network will automatically pick it up.
- eamag 1y ago
  Why is tailscale needed?
  - vaxman 1y ago
    So people with access to the TailScale control plane can easily add and remove devices from your network. https://youtu.be/bJHPfpOnDzg https://youtu.be/bJHPfpOnDzg
  - JamesSwift 1y ago
    It lets you leverage it while physically outside of the network (eg at a hotel)
    - benhurmarcel 1y ago
      But NextDNS isn’t on your network anyway. You can access it from anywhere.
  - lambdaba 1y ago
    You don't strictly need it, it just makes it a tiny bit more convenient since you can set it up to override DNS on any connected device, and Tailscale sets up a private VPN mesh between your devices I've come to get take for granted - a tangential feature that goes well with centrally managed DNS.
itchyouch 1y ago
For the cost and simplicity, NextDNS is way easier IMO. Nice quality of life apps that install on your phone and computer to toggle it on/off while on-the-go, while also being able to be setup on the router. Makes it nice and easy for the non-technical members of the fam.
- n_ary 1y ago
  I personally use it on my devices as well as on TV and SmartPhones of my non-tech-savvy family. However, deep in my mind, I have a feeling that, any day they will turn face and sell off to some data brokers and suddenly all of my traffic history is centralized there. I used to run a personal AdGuard-Home on cheap VPS, but after NextDNS decomissioned it. May be need to go boot it up again.
- glial 1y ago
  I tried a Pi Hole a few years ago. I just discovered NextDNS and configured my home router to use it as a DNS and wow, it's SO much easier.
- AnonC 1y ago
  NextDNS is not the answer if someone is looking for apps to toggle on or off the blocking easily. The NextDNS apps on iOS and iPadOS have not been updated for about five years and the toggle is broken (I know this because I’ve been troubled by it for years). If using the app on iOS/iPadOS (and not a permanent VPN profile), anytime you wish to know if NextDNS is on or not, go to test.nextdns.io on a browser and see if it shows “unconfigured” or some specific NextDNS endpoint. For me this test has proven how it randomly works or doesn’t work.
flaburgan 1y ago
Does it really have to be installed in the local network? I would like to set it once in a server and then be able to configure the box of all my friends, family, etc.
- Larrikin 1y ago
  You can run it on your phone and outside of your net work with something like Tailscale as your vpn
- rement 1y ago
  Be aware that if you run it on the internet other people will find it. I had one open to the web for a bit and was a bit surprised how many systems started making requests to it.
- the_dude_ 1y ago
  it depends on your needs, but for me I set it up as the dhcp server and configure the router to go through the pihole. If you want to share it family and friends there is no better tool than tailscale, you can configure the pihole as an exit node.
- potatocoffee 1y ago
  Pi hole devs recommend running it locally only and discourage exposing your pi-hole to the internet. I used pi hole for years but have been using NextDNS lately and it works well outside of my home network, and even has a free tier.
- freedomben 1y ago
  No, but it won't have auth in front of it so it will eventually be discovered and used by people who aren't you. That could get you wrapped up or even implicated in a cyber attack.
dark-star 1y ago
> 66.6% of all traffic is blocked I hear things like this a lot from PiHole users. But it's incorrect. Correct would be: 66.6% of DNS requests have been blocked. This says nothing about the actual volume of traffic/data that has been blocked
- pnw 1y ago
  66% would indicate that OP may have a device repeatedly trying to resolve a blocked query with no reasonable backoff logic. In my case, a single "smart light" in my house hammers iot-auth-global.aliyuncs.com all day, every day. Three other identical lights running the same firmware don't however.
- kube-system 1y ago
  66.6% of traffic per DNS request is a metric of network traffic. You could measure by bandwidth, by number of packets, by number of sessions, etc. There are many measurements one could use, and DNS requests is one of them. It would probably be irrelevant for other purposes but isn't a crazy measurement given this context. It would be pretty difficult to measure by more typical measures (e.g. bandwidth) because if you block DNS resolution you don't know the size of the resources you are blocking...
parpfish 1y ago
i'd love a pihole, but networking has always been a bit of a blindspot for me. i never really understand what i'm doing, and when things break it's a game of guess'n'check which stackoverflow/gpt answer will fix it. these walkthroughs always make it look easy, but no matter how easy the set up is you can't escape the fact that you're adding a layer of complexity to the network and i just don't want to maintain it. i fully expect that there'd be some weird conflicts that come up with work VPNs and I'd just have to disable it because i don't know what i'm doing.
- 3abiton 1y ago
  I started like you, but slowly with more debugging and customized use-cases I started understanding more and more. That's the way for people with limited free time. That said, now with LLMs, honestly anything is easily learnable.
  - TechDebtDevin 1y ago
    It still shouldnt break all the time. You shouldnt havr to get good at debugging a tool like this. I use but it dors destroy my network once a month and have had to build cleanup/reinstall scripts for this scenerio. I would not recommend to most people.
    - bongodongobob 1y ago
      Did you not give the pihole a static address or something? What is breaking?
      - TechDebtDevin 1y ago
        No idea, it barely works.
        bongodongobob 1y ago
        Then there's something wrong with your network. All it does is serve DNS.
the_dude_ 1y ago
it's a good post, however I agree with the comments there and here that a raspberry pi 5 with 8gb ram is an overkill for just running pihole. a good old Raspberry Pi 3 Model B with 1gb ram it's enough and it will still have capacity to run other things there. And of course pihole can run on an old laptop or desktop box you already have so no need to buy a device just for the sake of it. I would rather not run it as a docker container thou but that's just my preference
- olelele 1y ago
  I run mine on a RPi 1 and it doesn't even break a sweat
- lproven 1y ago
  Yup, I am using a Pi 3B as well. Silent, passive-cooling case, 16GB µSD card which is at least twice as big as it needs to be, and it uses about 10% of RAM and 10% of CPU. I enabled `unattended-upgrades` and set it to do all types of update. I've never caught it in a reboot but it's always current. It swaps to ZRAM for less load on the µSD card.
duckkg5 1y ago
$155 seems like a lot. I do this with a $5 pi zero and a $5 adapter and it works flawlessly.
Dries007 1y ago
After having some persistent issues with my previous pi-hole setup, running as an add-on on my Home Assistant rPi 5, I moved to AdGuard Home on dedicated hardware. I run it on a rPi Zero 2W (15$), with the Waveshare Ethernet / USB HUB BOX (16$). Together with a power brick (5$) and a meh µSD card, it's very affordable. I did add a small heatsink on the CPU and left the lid off the box to improve the temperature situation (it's in a small room that easily gets warm). Software wise I've opted for DietPi, which works great for this kind of "dedicated device" pi setup. Current up-time is 135 days, with the last reboot being likely due to a power/breaker issue. It's truly become a set and forget thing now. It also runs Tailscale (not as exit node due to USB 2.0 limited bandwidth for Ethernet) and a dynamic DNS refresh script on a timer. It still has some headroom, but I prefer to keep it rock solid and do more fancy stuff on my Home Assistant pi, which gets rebooted/updated more frequently. I do have the option to set my DNS settings in my router (ISP provided routers don't have that option here typically), so all of my devices follow. In combination with µBlock Origin and SponsorBlock in my browser, I almost cry every time I see the "raw" internet on other people's devices. The only remaining source of ads is if I watch YT via my TV, so if someone has ideas to make that stop, I'm all ears. (I used to pay for the discontinued Premium Basic, but I refuse to pay double for a bunch of crap "features" I don't want/need.)
- Gucio 1y ago
  Check out smarttubenext if you are on an Android TV.
xracy 1y ago
Disclaimer: The below is not a complaint about the pi-hole itself, but the ways in which companies integrate ads into their online presence. I've found my complaint about having a pi-hole is there are a number of services I use that expect/depend on ads existing in order to function. Things like, some shows on paramount+ (as an example) will fail to play (hang indefinitely) if an ad hasn't run before one of their shows, even though it theoretically shouldn't have ads? Additionally, the other thing I run into, is that the first page of google is basically useless to me, even when the top result is an ad to the thing that I want, because when I click on the ad link, the pi-hole doesn't route me to the link I want. So I find I have to scroll down a half-page to get to the regular link I googled for. If anyone has any workarounds for these issues, I've otherwise really enjoyed having a pi-hole. (Though my friends frequently tell me to stop talking about it, they'll say "shut your pi-hole", really weird). Edit: Seems like they recommend tailoring the list of accepted domains for things in the article. (Will do this for paramount, I guess). For Google, I separately stopped using an ad-blocker because it broke youtube when I did, even though I shouldn't get ads on youtube to begin with... God I hate the internet some days. But I imagine the easiest thing to do is to add that back so I can ignore those links.
- chihuahua 1y ago
  Edge browser + uBlock Origin, and YouTube works perfectly without ads.
  - squigz 1y ago
    Firefox works well too. 10.2M blocked requests on my uBlock, and YouTube - and every other site - works perfectly fine.
    - happyhacks 1y ago
      youtube was likely broken because jnn-pa.googleapis.com was likely in one of the lists - add it to "Exact allow" list Similarly you can allow googleadservices.com but that is too much IMO - I just have a habit now to not click on such results.
  - 1y ago
M95D 1y ago
For those who think DNS-over-HTTPS can't be blocked: just disable routing and use a whitelist filtering proxy server instead.
- wkat4242 1y ago
  That still won't work if they use the same server to serve DoH as the rest of the content. You really have to break open the TLS connection to block it properly.
HelloUsername 1y ago
Posted on 28-aug-2024 https://news.ycombinator.com/item?id=41382231 https://news.ycombinator.com/item?id=41382231
whalesalad 1y ago
My power went out today. Which means at some point my UPS' run out of capacity and my core infra VM host has to shut down. I run Adguard on that device ... so once it is gone, my ad-blocking is gone. I loaded a few websites during the interim period between DNS services going down, and the entire core infra going down (about 30 mins of just rawdog internet usage) and it is truly unusable. I don't know how people use the modern internet without network-wide ad blocking.
rockbruno 1y ago
Setting up a Pi-Hole taught me a ton about how networks work. It's a really cool thing to setup for fun.
iramiller 1y ago
What I want is something that amounts to a stateful firewall/allow list on top of PiHole ... if a device is attempting to connect to an ip address which was not resolved by PiHole then it gets blocked ... Similarly if the RDNS for an address resolves to a domain PiHole would block it gets dropped as well. Far too many apps/IoT/appliances have gotten smart and use DoH (or similar methods of circumventing network control). Despite that they all require routing and can still be forcibly cut off.
dend 1y ago
Author of the article here (thank you mpweiher for the submission). Pi-Hole has been, hands-down, the best infrastructure investment in our household. At this point I have 2MM+ domains blocked and the performance has been great.
everdrive 1y ago
My router just ate itself after the breaker on the house got cycled a few times in rapid succession. The router is almost a decade old, so perhaps it's not surprising. As a consequence, my pihole is temporarily out of commission. When we first set it up, we had IOT, android, chromebook, etc. Currently the whole household is on Linux and we just have a couple of smartphones. (plus a steamdeck) My wife has a few ugly apps (facebook, instagram, etc) but outside of that we're in much better shape network-wise. I used to spend a lot of time on my pihole trying to "fight the internet," but with this recent breakage, it just feels like what I need to be doing is just visiting fewer websites, owning less connected tech, and doing other things such as working outside or reading books. Blocking javascript goes a long way, but just avoiding bad websites, web apps, etc seems to be the only long-term solution.
- mberlove 1y ago
  I know I'm not alone in maintaining a strong feeling that we've "gone the wrong way" with tech in a lot of ways, as the meme goes, and forgotten (societally) that tech is there for us rather than the other way around. I like your approach - take a light touch using technology; use tech where it helps and ignore it where it doesn't. (The challenge of course is when you can't or aren't allowed to ignore it, its own challenge).
firesteelrain 1y ago
Always wanted to do this but if I get a call from home and I am either 1) at work 2) out of town 3) or just not home Then, my family's ability to troubleshoot if PiHole goes down is extremely limited. Even if I had two.
- procarch2019 1y ago
  They could just switch their dns back to auto (or statically use google/cloudflare/etc depending on how you configure it), no? Then fix it when you’re back. You could also set up 2 ssids depending on your WiFi set up. Point one to pi hole and the other to a different DNS provider. Instruction if pi hole breaks is just switch WiFi.
- overfeed 1y ago
  What black-swan event would cause would 2 PiHoles go down simultaneously? You could always use a non-PiHole guest-network if your WiFi hardware supports it, and let your family know to use the guest network if the regular network is down. The manual switching might not be necessary as most computers, phones and tablets automatically disassociate from a WiFi network if it's "offline", such as when DNS resolution fails.
  - firesteelrain 1y ago
    Power outage due to storm or power surge. I live where there are bad storms
    - overfeed 1y ago
      If you really want to try the pihole, and are worried about corruption you could use a read-only root filesystem and mount /tmp and /var/log on tmpfs ramdisk, alternatively, add "@reboot touch /forcefsck" to force a disk check whenever the Pi(s) reboot, including when power returns after an outage.
- ndsipa_pomu 1y ago
  One work-around is to get them to modify their wifi connection to use a specific DNS (e.g. Google at 8.8.8.8 and 8.8.4.4 is easy to remember). I run Pi-hole in docker on a NanoPi that I setup as my router (running OpenWRT). In the rare occurrence that it misbehaves, I could just tell my spouse to power cycle it. I did think of having a failover, but there's always going to be a single point of failure with my ISP router anyhow.
chaoskitty 1y ago
I wonder if anyone has made it easy to run the Pi Hole software on regular Unix-like systems without containers and without machine specific binaries. Perhaps I'll have to give that a try some time.
- gh02t 1y ago
  What do you mean without machine specific binaries? Like, building it from source? The instructions for that are pretty ambiguous and look like they are only for part of the system (https://docs.pi-hole.net/ftldns/compile/ https://docs.pi-hole.net/ftldns/compile/). However, if you just mean running it bare metal then running the installer script mentioned at the top of the Github page will install it using native packages for your system (apt, rpm, etc).
- nobody9999 1y ago
  >I wonder if anyone has made it easy to run the Pi Hole software on regular Unix-like systems without containers and without machine specific binaries. Perhaps I'll have to give that a try some time. I have done so for four or five years. Well, with x86_64 binaries -- but I could compile the code myself if I wanted. No containers, just a Linux (Fedora) VM.
- dabluecaboose 1y ago
  I used to have PiHole running in a docker container, which sounds almost exactly like what you're describing.
wkat4242 1y ago
I wouldn't bother buying a raspberry pi 5 to run this shit though, as the article suggests. It's way overkill. Just run the docker on another server you're running anyway, or run it on a raspberry pi zero 2W for $15. A pihole does so little work, it doesn't benefit from a pi 5. I just run it on a VPS that costs me 3€ per month and runs lots of other stuff too like an IRC bouncer. That way I can access it from everywhere.
- gosub100 1y ago
  Why don't people run their own public DNS and sell you very cheap access to it? $9 a year to Johnny's No-Ad DNS. If it worked I'd pay for it
  - wkat4242 1y ago
    It's not worth the support trouble for the little it would make. Adblockers often break legit things too. Often people still want to use links that go through tradedoubler and the like. One support call and your yearly profit is wasted. And how do you block access to non paying customers? DNS isn't autenticated. It's also not really a great method for adblocking anymore (which would make the support problem worse, "why am I still seeing ads?")
- wkat4242 1y ago
  > I wouldn't bother buying a raspberry pi 5 to run this shit though, PS, I didn't mean the word 'shit' negatively. 'stuff' would have been better. But I meant it more as in 'check this shit out' :) Pihole is actually a really nice project even though it's just a wrapper around dnsmasq.
more_corn 1y ago
One problem I have is that o can’t get my pihole to stop blocking archive links. Can’t find it in the blacklist, whitelisting doesn’t work.
troebr 1y ago
I like the idea, but also it wouldn't feel fair for some services that I use like Twitch, or some cooking websites. I get that they sometimes really abuse all that stuff, but also I feel like they deserve some kind of compensation.
- gosub100 1y ago
  Poor Mr Bezos, I don't know what he would do without your $3 in ad views.
imgabe 1y ago
I had been meaning to do this for the longest time. I even had a couple spare raspberry Pis laying around, but didn't want to set it up. Finally, I realized you don't need a raspberry pi at all. It's running in docker on my plex server. Much less friction. Don't get hung up on needing to run it on a raspberry pi.
h4kunamata 1y ago
I run PiHole for years in my home network, I cannot live without it. With the years, I have made small changes to increase my control over it. I have a recursive DNS setup, PiHole filters everything, and what is left is processed locally via Unbound which in turn, contacts the 13 root nameservers for DNS resolution. I don't use any third party DNS. Add PiHole/Unbound caching capabilities, surfing on the internet is bloody fast. Now, they alone cannot block everything like smartTV with hardcoded DNS, DNS-Over-TLS, DNS-Over-HTTPS, etc. That is where OPNSense comes to play... I have firewall rules in place that nobody but PiHoles can request name resolution. My Samsung smarTV trying to use Google DNS?? Blocked, PiHole takes over. Devices trying to use DoT or DoH??? Blocked, PiHoles take over. You can create dynamic firewall rule with OPNSense so it will only block 443 and 853 if the host match the list which is updated diary. To make everything even better, OPNSense firewall makes sure no IoT can access the local network but I can access them like wireless printer, etc, and if I need to access anything while on road like my cat's cam or my Voron 3D printer camera, WireGuard VPN makes sure of that. No VPN equals no network access. It is just me and my devices, at the time of this writing: * Domains on List: 500k * Total queries: 43k * Queries Blocked: 17k * Percentage Blocked: 39% I run GrapheneOS on my Pixel phone and very limited apps, I prefer web version. The apps themselves are fully controller and 99% of the access blocked. That is why I have a fairly low numbers after purging all the logs a few days ago.
- brewdad 1y ago
  While there is absolutely value in doing what you are doing and I commend you for fighting the good fight, the fact that 61% of your queries are still going through means your data is still getting out there. Maybe to a lesser degree but that doesn't mean the marketing target isn't being painted it just means you are an impressionistic painting rather than a modernist with straight, accurate lines. I want to know how to become a Pollack painting.
  - h4kunamata 1y ago
    I see your point, I have no need to block 99% of everything. For instance, many apps like bank apps use Google to delivery notification (there is a name for it), so if you start blocking everything, you won't use anything. To your credit, I can block more stuff but I haven't bothered. I have spent many nights blocking stuff haha Reddit doesn't work atm home because I blocked static.reddit.com Since the API drama, I never used it again, I used to waste hours of my life everyday there. Couldn't be happier to be honest haha The only fight I gave up is YouTube, I do see value into YouTube Premium. Spotify is dogshit, YouTube Music allows to me listen to music available nowhere else like DJ remix, old music and the the offline music works which Spotify gave me the finger. I watch YT only, TV News are complete useless nowadays. There are solid news channels so anyway, I do pay for it over trying to block its ADs from the free version. I mean, try listening music with ADs, nah thanks haha
wvenable 1y ago
I love having an Eero router for the simplicity but I hate that I cannot do all the Linux routing tricks that I used to do.
roydivision 1y ago
I choose browser plugins instead for a more consistent experience, at home or anywhere.
chilldsgn 1y ago
I used to have one on my network. Then I wanted to use my RPi for some other experimentation and just kind of forgot about it. I run adblockers on my browsers anyway, but been feeling the need to start using pi-hole again recently.
lproven 1y ago
I did this in March: https://www.theregister.com/2025/03/08/pi_hole_6_flyby/ https://www.theregister.com/2025/03/08/pi_hole_6_flyby/ TBH I was surprised how easy it was, how unobtrusive it is, and how a bit of borderline e-waste that was in my spares box now helps every device on the network, including things like phones where I can’t so easily add ad-blocking.
nicoloren 1y ago
Some years ago I used Privoxy on my computer to filter unecessary request. It worked great and is an alternative to consider if you don't want a computer plugin 24/24 on your network.
10729287 1y ago
> (You will need) A monitor, mouse, and keyboard that you can plug into the Raspberry Pi as you set it up. Raspberry pi can be set up to boot with ssh login/password, so you don't even need wired mouse and keyboard.
danielovichdk 1y ago
Listen. Pi-Hole is forever something I resemble with American Pie. Good luck with whatever it is. Can't go there.
- deleted 1y ago
  [deleted]
perdomon 1y ago
I love my pi-hole but am surprised to see him recommending a $155 kit + keyboard, mouse, and monitor. My pi-hole runs on a Pi Zero 2W and connects via USB for power. The entire setup process happens over SSH and it cost me about $25. If someone can figure out how to configure their network for the pi-hole, I’m sure they can also figure out SSH.
- tonymet 1y ago
  Original pi zero with usb Ethernet also runs fine
  - perdomon 1y ago
    1. You’re totally right about that, but I couldn’t find one as easily 2. I was initally hesitant about using WiFi for DNS, but after reading comments it seemed that no one really had any issues. Mine has been kicking for 6 months sitting right next to my router without any noticeable delays, so I think it’s okay.
    - sgbeal 1y ago
      > I was initally hesitant about using WiFi for DNS, but after reading comments it seemed that no one really had any issues FWIW, that was also an initial concern of mine. Almost three years later, i've never once had an issue with running my pi-hole over wifi.
      - tonymet 1y ago
        You're right it's usable, though DNS is the most critical service to have low latency. on good wifi with no interference you can get good 2ms avg and 0.2-0.4 ms SD ping distribution. ethernet will have 0.2 ms avg and 0.01 SD it's the outliers that will cause headaches, when there is radio interference. wifi is a dynamic system with every base station migrating bands for interference.
        sgbeal 1y ago
jerome-jh 1y ago
+1 for using a picture of "the little mole" https://www.ceskatelevize.cz/porady/898287-o-krtkovi/ https://www.ceskatelevize.cz/porady/898287-o-krtkovi/ https://www.youtube.com/channel/UC8ZKvF049Iku9y41WpIUUCA https://www.youtube.com/channel/UC8ZKvF049Iku9y41WpIUUCA
vagab0nd 1y ago
How do folks deal with Pi-hole unintentionally breaking normal websites? I used it for a couple of months until one day I spent 30 minutes trying to log in to a payment website with no success. Then I remembered I had Pi-hole running. I know the solution was probably to whitelist certain URLs, but at the time I just gave up and disabled Pi-hole.

325 points by mpweiher 1y ago

In case you’re like a lot of folks in HN, read the title, and say to yourself “already have one”, read TFA for the iptables config that fixes those apps and devices that bypass local DNS. For example, the New York Times app seems to now use its own hard-coded DNS servers. Without having tried it, it looks like TFA has the fix for that. EDIT: replies indicate that I, a person who is barely competent at many network tasks, might be off-base on this one. Grain of salt, and all.

ignoramous 1y ago
> For example, the New York Times app seems to now use its own hard-coded DNS servers. Without having tried it, it looks like TFA has the fix for that. Those commands in TFA simply reroute traffic on port 53 to Pi-Hole, which isn't enough to prevent apps from doing their own name resolution. For instance, the Telegram app has built-in DNS-over-HTTPS, which those iptables chains could do nothing about.
- shaky-carrousel 1y ago
  You can block known DoH servers.
elashri 1y ago
An increasing number of them also rely on hard coded DoH servers which is harder to block/redirect. You will need to will Pi-Hole/Adguard Home on router to block them based on some curtailed lists (i.e [1]) [1] https://github.com/dibdot/DoH-IP-blocklists https://github.com/dibdot/DoH-IP-blocklists
- rsync 1y ago
  In this arms race you are saying a current "move" is a curated list of IPs that correspond to known DoH servers ... and that's fine .. However, if the adversary decides to just query - and answer - DoH requests on the same hostname that you are trying to talk to ... isn't that a winning move ? For instance: If one had an application - or an appliance - that spoke https to endpoint.samsung.com, how would one block DoH requests addressed to the same endpoint.samsung.com ?
  - baby_souffle 1y ago
    That might work but if your Samsung example is behind cloudflare, you're basically going to have to block any and all access to cloudflare's Network. And if telemetry.example-iot.com belongs to an AWS IP, it could change to another IP in their space at any time so your only recourse would be to limit connectivity to all of AWS which would effectively prevent you from accessing most things on the internet
  - pimeys 1y ago
    I run Zenarmor in addition to Adguard at home, which can detect DoH traffic and intercept it. You have to pay for this enterprise level tool, but if you are worried about DoH, Zenarmor is so far the easiest tool to block it. In our house the only device that tries to use DoH is my partner's iPhone. It tries a few times, fails, then uses the Adguard DNS, which blocks the trackers.
    - illiac786 1y ago
      Do you have documentation of this? My understanding was always that Zenarmor simply maintains a list of known DoH servers.
  - toast0 1y ago
    If you're really serious about DNS interception, you'd setup something where a) you stop accepting A lookups, because it's 2025 and IPv4 only is dead (let's pretend anyway) b) for each AAAA lookup, return a new IPv6 address that you'll NAT to the real address (you can use this for NAT64 if you want to let clients connect to IPv4 hosts). Then only let clients connect to these IPv6 addresses you setup. If someone smuggles address resolution through, outside of DNS, their clients can't connect. (this is going to be a big PITA, but that's how these things go)
    - dullcrisp 1y ago
      I guess at that point they’d have to establish a tunnel and route ads through the same HTTPS connection as legitimate traffic.
- jeroenhd 1y ago
  And before DoH was a thing, several Chinese apps I've used also used to do plain HTTP for DNS resolution (I only caught them by chanbecause they were doing HTTP). PiHoles only work for apps that stick to the standards and don't mind being caught.
- TacticalCoder 1y ago
  Browsers allows corporations to prevent DoH and force DNS through company-owned DNS servers: https://support.mozilla.org/en-US/kb/dns-over-https https://support.mozilla.org/en-US/kb/dns-over-https I use these settings on all my browsers to prevent DoH and make sure traffic goes through my Pi (I run unbound directly on the Pi though, not Pi-Hole: in my experience unbound is a bit harder to set up initially but it's also more powerful than Pi-Hole... For example unbound accepts wildcards in blocklists). It's not incompatible with also blocking, at the firewall level, all known DoH servers of course. Nor is it incompatible with forcing your router to also use your Pi as a DNS.
silverwind 1y ago
Apps that open arbritrary UDP/TCP ports? Isn't that something the app store policies should reject?
- epcoa 1y ago
  What is an arbitrary TCP port? Ports in isolation from an IP address aren't inherently arbitrary, they're nothing, and the IP:port pair is arbitrary. Once you allow connections to any host on the internet the port doesn't really matter - you can do whatever nefarious shit over port 80. And not allowing apps to connect to external internet servers seems pretty limiting.
- 01HNNWZ0MV43FF 1y ago
  They're not opening listening ports on the local system, they're just ignoring the system's DNS and saying "Take me to this IP and this port" and then doing a DNS lookup themselves
wang_li 1y ago
> read TFA for the iptables config that fixes those apps and devices that bypass local DNS. For example, Don't worry. All the browsers and stuff are bypassing this level of control by moving to DNS-over-HTTPS. You'll either have to deploy a TLS terminating proxy on your network, or give up on this arms race.
- notarealllama 1y ago
  Jokes on you, I do have a fortinet which does this.... Oh wait, only up to TLS 1.1 or something and it's slow. I forgot the name of the software but there used to be a few tools to terminate and reencrypt. But yeah dnssec is it's own challenge
  - gbuk2013 1y ago
    You need to get an F5 box instead. :)
- gbuk2013 1y ago
  To be fair, if you are geeky enough to run a PiHole you will have no trouble finding the config option to turn off DoH in your browser.
  - freedomben 1y ago
    True, but I want all the devices on my home network to have DoH disabled too. Most of them I can't change directly.
  - int0x29 1y ago
    Don't turn it off in your browser. If you have control of that setting just install an ad blocker. The point of DNS block lists is to get rid of ads on phones, TVs, and other non configurable things.
    - woleium 1y ago
      And then there is amazon sidewalk, which can only be evaded by unplugging the wifi board on your tv
iugtmkbdfil834 1y ago
I was going to say, as a person who used pihole pretty extensively at one point, it may not be enough anymore. I am by no means a network expert, but I do recognize those shortcomings and try to compensate for them. Blanket pihole recommendation may be disservice at this point.
bongodongobob 1y ago
No, that's not a fix and those iptables settings are on the router. It will only catch DNS requests on port 53. Doesn't catch DoH which you can't do on a router, you need a firewall for that.
- tenacious_tuna 1y ago
  Also, doesn't that break the network if the pihole is offline? Before I'd just override DNS on my workstation, but that iptables config would block any "unsanctioned" DNS traffic
  - bongodongobob 1y ago
    It would, yes
RachelF 1y ago
I've seen Windows 11 ignoring DNS settings too, for Microsoft telemetry, ads and updates.

ryandrake 1y ago

Standard reminder for whenever Pi-Hole gets brought up: You don't actually need a physical Raspberry Pi for this functionality, and you don't even need the Pi-Hole software. It's all just wrappers around dnsmasq[1], which every Linux distribution makes available via their package manager. If you have an old spare Linux system on your LAN already, doing whatever, you can just install and set up dnsmasq and point your clients' DNS settings at it! You can run it on your Internet gateway or rooted WiFi router, too. 1: https://en.wikipedia.org/wiki/Dnsmasq https://en.wikipedia.org/wiki/Dnsmasq

mikestew 1y ago
I was shocked that TFA’s recommended kit was $155! When did Raspberry Pi’s get so pricey?
- ChrisLTD 1y ago
  Same. I thought it'd be ~$50.
- deleted 1y ago
  [deleted]
- jamesgeck0 1y ago
  I don't _think_ you need a whole Raspberry Pi 5 kit. It seems like an older Raspberry Pi 3b+ would get the job done for $35 or so. Maybe even a Raspberry Pi Zero ($5) with an micro usb ethernet adapter.
  - mikestew 1y ago
    Oh, it will definitely work on older ones. The one I have, w/o logging in and explicitly looking, is a 3-$SOMETHING, probably 3b+. Works just fine.
    - shrikant 1y ago
      My Pi-hole runs on a ~13 year old Model B, which has survived several house moves. Definitely don't need top of the line hardware for it!

incomingpain 1y ago

<3 my pihole. Currently im at 28% blocked. Typically im above 50% like OP. They have significantly higher number of domains blocked. time to update my lists: https://firebog.net/ https://firebog.net/

jyap 1y ago
It’s all relative. I’m at 24.4% but I have quite a few devices like Wemo light switches at the top of my DNS queries. Only have one Amazon Alexa device but that’s near the top as well. IoT devices which constantly phone home will skew things.

jstanley 1y ago

I really don't understand why people go to the trouble of using Pi-hole that only blocks at the DNS level, instead of using uBlock Origin which can block at the DOM level. uBlock Origin is easier and cheaper to set up, less maintenance, and more effective.

blurbleblurble 1y ago
Could be nice to have both! Plus, it's not clear that chrome will always support manifest v2. I recently learned that you can still use unlock origin in chromium by going to the extensions page and manually turning it back on, but who knows how long this will last?
kgwxd 1y ago
Not all internet traffic goes through a browser.
crtasm 1y ago
uBlock is only for your web browser - it can't help with other apps, smart devices, game consoles, etc. It's best to run both.
- rsync 1y ago
  "uBlock is only for your web browser - it can't help with other apps, smart devices, game consoles, etc." Yes, but don't we expect all of those devices (and apps) to move to DoH resolution if they haven't already ? In that case the pihole (or nextdns, etc.) are bypassed ... I suppose you could proxy all TLS traffic and block it but if the DoH is being served by the same FQDN as the traffic you want in the first place aren't you out of options ?
  - timeinput 1y ago
    I mean I expect devices and apps to move to DoH, but they haven't yet, or at least not all of them. My experience generally on my phone at home (with DNS blocking) is better enough than my experience away from home that I'm glad I took the half a day or there about to set up a DNS blocking tool a couple years ago. A couple years ago it was like night and day. Now it is still better than nothing, and in a year or two it might not be worth running. It's definitely a moving target, but "we expect ... to move to DoH resolution" means that they haven't all moved yet, and a DNS based ad/telemetry/etc blocker still works today (for some apps / smart devices). If it works for some things today why would I turn it off because it might not work for a subset of those things tomorrow? Agreed the value proposition of setting one up is probably dropping, but I still prefer it to nothing. Now that I think of it I should probably start logging how many DNS look ups "fail" because of the DNS blocking list, and monitor for changes. If it ever gets to less than one a day it's probably not worth the couple of W to power the RaspberryPI

lambdaba 1y ago

Tailscale with NextDNS is a simpler alternative to this and is easy to set up on all your devices.

bix6 1y ago
Is there a tutorial you recommend?
- lambdaba 1y ago
  There's a lot more to Tailscale but for a basic setup you just install the client on all your devices, and set DNS to the NextDNS endpoint. Any device on your network will automatically pick it up.
eamag 1y ago
Why is tailscale needed?
- vaxman 1y ago
  So people with access to the TailScale control plane can easily add and remove devices from your network. https://youtu.be/bJHPfpOnDzg https://youtu.be/bJHPfpOnDzg
- JamesSwift 1y ago
  It lets you leverage it while physically outside of the network (eg at a hotel)
  - benhurmarcel 1y ago
    But NextDNS isn’t on your network anyway. You can access it from anywhere.
- lambdaba 1y ago
  You don't strictly need it, it just makes it a tiny bit more convenient since you can set it up to override DNS on any connected device, and Tailscale sets up a private VPN mesh between your devices I've come to get take for granted - a tangential feature that goes well with centrally managed DNS.

itchyouch 1y ago

For the cost and simplicity, NextDNS is way easier IMO. Nice quality of life apps that install on your phone and computer to toggle it on/off while on-the-go, while also being able to be setup on the router. Makes it nice and easy for the non-technical members of the fam.

n_ary 1y ago
I personally use it on my devices as well as on TV and SmartPhones of my non-tech-savvy family. However, deep in my mind, I have a feeling that, any day they will turn face and sell off to some data brokers and suddenly all of my traffic history is centralized there. I used to run a personal AdGuard-Home on cheap VPS, but after NextDNS decomissioned it. May be need to go boot it up again.
glial 1y ago
I tried a Pi Hole a few years ago. I just discovered NextDNS and configured my home router to use it as a DNS and wow, it's SO much easier.
AnonC 1y ago
NextDNS is not the answer if someone is looking for apps to toggle on or off the blocking easily. The NextDNS apps on iOS and iPadOS have not been updated for about five years and the toggle is broken (I know this because I’ve been troubled by it for years). If using the app on iOS/iPadOS (and not a permanent VPN profile), anytime you wish to know if NextDNS is on or not, go to test.nextdns.io on a browser and see if it shows “unconfigured” or some specific NextDNS endpoint. For me this test has proven how it randomly works or doesn’t work.

flaburgan 1y ago

Does it really have to be installed in the local network? I would like to set it once in a server and then be able to configure the box of all my friends, family, etc.

Larrikin 1y ago
You can run it on your phone and outside of your net work with something like Tailscale as your vpn
rement 1y ago
Be aware that if you run it on the internet other people will find it. I had one open to the web for a bit and was a bit surprised how many systems started making requests to it.
the_dude_ 1y ago
it depends on your needs, but for me I set it up as the dhcp server and configure the router to go through the pihole. If you want to share it family and friends there is no better tool than tailscale, you can configure the pihole as an exit node.
potatocoffee 1y ago
Pi hole devs recommend running it locally only and discourage exposing your pi-hole to the internet. I used pi hole for years but have been using NextDNS lately and it works well outside of my home network, and even has a free tier.
freedomben 1y ago
No, but it won't have auth in front of it so it will eventually be discovered and used by people who aren't you. That could get you wrapped up or even implicated in a cyber attack.

dark-star 1y ago

> 66.6% of all traffic is blocked I hear things like this a lot from PiHole users. But it's incorrect. Correct would be: 66.6% of DNS requests have been blocked. This says nothing about the actual volume of traffic/data that has been blocked

pnw 1y ago
66% would indicate that OP may have a device repeatedly trying to resolve a blocked query with no reasonable backoff logic. In my case, a single "smart light" in my house hammers iot-auth-global.aliyuncs.com all day, every day. Three other identical lights running the same firmware don't however.
kube-system 1y ago
66.6% of traffic per DNS request is a metric of network traffic. You could measure by bandwidth, by number of packets, by number of sessions, etc. There are many measurements one could use, and DNS requests is one of them. It would probably be irrelevant for other purposes but isn't a crazy measurement given this context. It would be pretty difficult to measure by more typical measures (e.g. bandwidth) because if you block DNS resolution you don't know the size of the resources you are blocking...

parpfish 1y ago

i'd love a pihole, but networking has always been a bit of a blindspot for me. i never really understand what i'm doing, and when things break it's a game of guess'n'check which stackoverflow/gpt answer will fix it. these walkthroughs always make it look easy, but no matter how easy the set up is you can't escape the fact that you're adding a layer of complexity to the network and i just don't want to maintain it. i fully expect that there'd be some weird conflicts that come up with work VPNs and I'd just have to disable it because i don't know what i'm doing.

3abiton 1y ago
I started like you, but slowly with more debugging and customized use-cases I started understanding more and more. That's the way for people with limited free time. That said, now with LLMs, honestly anything is easily learnable.
- TechDebtDevin 1y ago
  It still shouldnt break all the time. You shouldnt havr to get good at debugging a tool like this. I use but it dors destroy my network once a month and have had to build cleanup/reinstall scripts for this scenerio. I would not recommend to most people.
  - bongodongobob 1y ago
    Did you not give the pihole a static address or something? What is breaking?
    - TechDebtDevin 1y ago
      No idea, it barely works.
      - bongodongobob 1y ago
        Then there's something wrong with your network. All it does is serve DNS.

the_dude_ 1y ago

it's a good post, however I agree with the comments there and here that a raspberry pi 5 with 8gb ram is an overkill for just running pihole. a good old Raspberry Pi 3 Model B with 1gb ram it's enough and it will still have capacity to run other things there. And of course pihole can run on an old laptop or desktop box you already have so no need to buy a device just for the sake of it. I would rather not run it as a docker container thou but that's just my preference

olelele 1y ago
I run mine on a RPi 1 and it doesn't even break a sweat
lproven 1y ago
Yup, I am using a Pi 3B as well. Silent, passive-cooling case, 16GB µSD card which is at least twice as big as it needs to be, and it uses about 10% of RAM and 10% of CPU. I enabled `unattended-upgrades` and set it to do all types of update. I've never caught it in a reboot but it's always current. It swaps to ZRAM for less load on the µSD card.

duckkg5 1y ago

$155 seems like a lot. I do this with a $5 pi zero and a $5 adapter and it works flawlessly.

Dries007 1y ago

After having some persistent issues with my previous pi-hole setup, running as an add-on on my Home Assistant rPi 5, I moved to AdGuard Home on dedicated hardware. I run it on a rPi Zero 2W (15$), with the Waveshare Ethernet / USB HUB BOX (16$). Together with a power brick (5$) and a meh µSD card, it's very affordable. I did add a small heatsink on the CPU and left the lid off the box to improve the temperature situation (it's in a small room that easily gets warm). Software wise I've opted for DietPi, which works great for this kind of "dedicated device" pi setup. Current up-time is 135 days, with the last reboot being likely due to a power/breaker issue. It's truly become a set and forget thing now. It also runs Tailscale (not as exit node due to USB 2.0 limited bandwidth for Ethernet) and a dynamic DNS refresh script on a timer. It still has some headroom, but I prefer to keep it rock solid and do more fancy stuff on my Home Assistant pi, which gets rebooted/updated more frequently. I do have the option to set my DNS settings in my router (ISP provided routers don't have that option here typically), so all of my devices follow. In combination with µBlock Origin and SponsorBlock in my browser, I almost cry every time I see the "raw" internet on other people's devices. The only remaining source of ads is if I watch YT via my TV, so if someone has ideas to make that stop, I'm all ears. (I used to pay for the discontinued Premium Basic, but I refuse to pay double for a bunch of crap "features" I don't want/need.)

Gucio 1y ago
Check out smarttubenext if you are on an Android TV.

xracy 1y ago

Disclaimer: The below is not a complaint about the pi-hole itself, but the ways in which companies integrate ads into their online presence. I've found my complaint about having a pi-hole is there are a number of services I use that expect/depend on ads existing in order to function. Things like, some shows on paramount+ (as an example) will fail to play (hang indefinitely) if an ad hasn't run before one of their shows, even though it theoretically shouldn't have ads? Additionally, the other thing I run into, is that the first page of google is basically useless to me, even when the top result is an ad to the thing that I want, because when I click on the ad link, the pi-hole doesn't route me to the link I want. So I find I have to scroll down a half-page to get to the regular link I googled for. If anyone has any workarounds for these issues, I've otherwise really enjoyed having a pi-hole. (Though my friends frequently tell me to stop talking about it, they'll say "shut your pi-hole", really weird). Edit: Seems like they recommend tailoring the list of accepted domains for things in the article. (Will do this for paramount, I guess). For Google, I separately stopped using an ad-blocker because it broke youtube when I did, even though I shouldn't get ads on youtube to begin with... God I hate the internet some days. But I imagine the easiest thing to do is to add that back so I can ignore those links.

chihuahua 1y ago
Edge browser + uBlock Origin, and YouTube works perfectly without ads.
- squigz 1y ago
  Firefox works well too. 10.2M blocked requests on my uBlock, and YouTube - and every other site - works perfectly fine.
  - happyhacks 1y ago
    youtube was likely broken because jnn-pa.googleapis.com was likely in one of the lists - add it to "Exact allow" list Similarly you can allow googleadservices.com but that is too much IMO - I just have a habit now to not click on such results.
- 1y ago

M95D 1y ago

For those who think DNS-over-HTTPS can't be blocked: just disable routing and use a whitelist filtering proxy server instead.

wkat4242 1y ago
That still won't work if they use the same server to serve DoH as the rest of the content. You really have to break open the TLS connection to block it properly.

HelloUsername 1y ago

Posted on 28-aug-2024 https://news.ycombinator.com/item?id=41382231 https://news.ycombinator.com/item?id=41382231

whalesalad 1y ago

My power went out today. Which means at some point my UPS' run out of capacity and my core infra VM host has to shut down. I run Adguard on that device ... so once it is gone, my ad-blocking is gone. I loaded a few websites during the interim period between DNS services going down, and the entire core infra going down (about 30 mins of just rawdog internet usage) and it is truly unusable. I don't know how people use the modern internet without network-wide ad blocking.

rockbruno 1y ago

Setting up a Pi-Hole taught me a ton about how networks work. It's a really cool thing to setup for fun.

iramiller 1y ago

What I want is something that amounts to a stateful firewall/allow list on top of PiHole ... if a device is attempting to connect to an ip address which was not resolved by PiHole then it gets blocked ... Similarly if the RDNS for an address resolves to a domain PiHole would block it gets dropped as well. Far too many apps/IoT/appliances have gotten smart and use DoH (or similar methods of circumventing network control). Despite that they all require routing and can still be forcibly cut off.

dend 1y ago

Author of the article here (thank you mpweiher for the submission). Pi-Hole has been, hands-down, the best infrastructure investment in our household. At this point I have 2MM+ domains blocked and the performance has been great.

everdrive 1y ago

My router just ate itself after the breaker on the house got cycled a few times in rapid succession. The router is almost a decade old, so perhaps it's not surprising. As a consequence, my pihole is temporarily out of commission. When we first set it up, we had IOT, android, chromebook, etc. Currently the whole household is on Linux and we just have a couple of smartphones. (plus a steamdeck) My wife has a few ugly apps (facebook, instagram, etc) but outside of that we're in much better shape network-wise. I used to spend a lot of time on my pihole trying to "fight the internet," but with this recent breakage, it just feels like what I need to be doing is just visiting fewer websites, owning less connected tech, and doing other things such as working outside or reading books. Blocking javascript goes a long way, but just avoiding bad websites, web apps, etc seems to be the only long-term solution.

mberlove 1y ago
I know I'm not alone in maintaining a strong feeling that we've "gone the wrong way" with tech in a lot of ways, as the meme goes, and forgotten (societally) that tech is there for us rather than the other way around. I like your approach - take a light touch using technology; use tech where it helps and ignore it where it doesn't. (The challenge of course is when you can't or aren't allowed to ignore it, its own challenge).

firesteelrain 1y ago

Always wanted to do this but if I get a call from home and I am either 1) at work 2) out of town 3) or just not home Then, my family's ability to troubleshoot if PiHole goes down is extremely limited. Even if I had two.

procarch2019 1y ago
They could just switch their dns back to auto (or statically use google/cloudflare/etc depending on how you configure it), no? Then fix it when you’re back. You could also set up 2 ssids depending on your WiFi set up. Point one to pi hole and the other to a different DNS provider. Instruction if pi hole breaks is just switch WiFi.
overfeed 1y ago
What black-swan event would cause would 2 PiHoles go down simultaneously? You could always use a non-PiHole guest-network if your WiFi hardware supports it, and let your family know to use the guest network if the regular network is down. The manual switching might not be necessary as most computers, phones and tablets automatically disassociate from a WiFi network if it's "offline", such as when DNS resolution fails.
- firesteelrain 1y ago
  Power outage due to storm or power surge. I live where there are bad storms
  - overfeed 1y ago
    If you really want to try the pihole, and are worried about corruption you could use a read-only root filesystem and mount /tmp and /var/log on tmpfs ramdisk, alternatively, add "@reboot touch /forcefsck" to force a disk check whenever the Pi(s) reboot, including when power returns after an outage.
ndsipa_pomu 1y ago
One work-around is to get them to modify their wifi connection to use a specific DNS (e.g. Google at 8.8.8.8 and 8.8.4.4 is easy to remember). I run Pi-hole in docker on a NanoPi that I setup as my router (running OpenWRT). In the rare occurrence that it misbehaves, I could just tell my spouse to power cycle it. I did think of having a failover, but there's always going to be a single point of failure with my ISP router anyhow.

chaoskitty 1y ago

I wonder if anyone has made it easy to run the Pi Hole software on regular Unix-like systems without containers and without machine specific binaries. Perhaps I'll have to give that a try some time.

gh02t 1y ago
What do you mean without machine specific binaries? Like, building it from source? The instructions for that are pretty ambiguous and look like they are only for part of the system (https://docs.pi-hole.net/ftldns/compile/ https://docs.pi-hole.net/ftldns/compile/). However, if you just mean running it bare metal then running the installer script mentioned at the top of the Github page will install it using native packages for your system (apt, rpm, etc).
nobody9999 1y ago
>I wonder if anyone has made it easy to run the Pi Hole software on regular Unix-like systems without containers and without machine specific binaries. Perhaps I'll have to give that a try some time. I have done so for four or five years. Well, with x86_64 binaries -- but I could compile the code myself if I wanted. No containers, just a Linux (Fedora) VM.
dabluecaboose 1y ago
I used to have PiHole running in a docker container, which sounds almost exactly like what you're describing.

wkat4242 1y ago

I wouldn't bother buying a raspberry pi 5 to run this shit though, as the article suggests. It's way overkill. Just run the docker on another server you're running anyway, or run it on a raspberry pi zero 2W for $15. A pihole does so little work, it doesn't benefit from a pi 5. I just run it on a VPS that costs me 3€ per month and runs lots of other stuff too like an IRC bouncer. That way I can access it from everywhere.

gosub100 1y ago
Why don't people run their own public DNS and sell you very cheap access to it? $9 a year to Johnny's No-Ad DNS. If it worked I'd pay for it
- wkat4242 1y ago
  It's not worth the support trouble for the little it would make. Adblockers often break legit things too. Often people still want to use links that go through tradedoubler and the like. One support call and your yearly profit is wasted. And how do you block access to non paying customers? DNS isn't autenticated. It's also not really a great method for adblocking anymore (which would make the support problem worse, "why am I still seeing ads?")
wkat4242 1y ago
> I wouldn't bother buying a raspberry pi 5 to run this shit though, PS, I didn't mean the word 'shit' negatively. 'stuff' would have been better. But I meant it more as in 'check this shit out' :) Pihole is actually a really nice project even though it's just a wrapper around dnsmasq.

more_corn 1y ago

One problem I have is that o can’t get my pihole to stop blocking archive links. Can’t find it in the blacklist, whitelisting doesn’t work.

troebr 1y ago

I like the idea, but also it wouldn't feel fair for some services that I use like Twitch, or some cooking websites. I get that they sometimes really abuse all that stuff, but also I feel like they deserve some kind of compensation.

gosub100 1y ago
Poor Mr Bezos, I don't know what he would do without your $3 in ad views.

imgabe 1y ago

I had been meaning to do this for the longest time. I even had a couple spare raspberry Pis laying around, but didn't want to set it up. Finally, I realized you don't need a raspberry pi at all. It's running in docker on my plex server. Much less friction. Don't get hung up on needing to run it on a raspberry pi.

h4kunamata 1y ago

I run PiHole for years in my home network, I cannot live without it. With the years, I have made small changes to increase my control over it. I have a recursive DNS setup, PiHole filters everything, and what is left is processed locally via Unbound which in turn, contacts the 13 root nameservers for DNS resolution. I don't use any third party DNS. Add PiHole/Unbound caching capabilities, surfing on the internet is bloody fast. Now, they alone cannot block everything like smartTV with hardcoded DNS, DNS-Over-TLS, DNS-Over-HTTPS, etc. That is where OPNSense comes to play... I have firewall rules in place that nobody but PiHoles can request name resolution. My Samsung smarTV trying to use Google DNS?? Blocked, PiHole takes over. Devices trying to use DoT or DoH??? Blocked, PiHoles take over. You can create dynamic firewall rule with OPNSense so it will only block 443 and 853 if the host match the list which is updated diary. To make everything even better, OPNSense firewall makes sure no IoT can access the local network but I can access them like wireless printer, etc, and if I need to access anything while on road like my cat's cam or my Voron 3D printer camera, WireGuard VPN makes sure of that. No VPN equals no network access. It is just me and my devices, at the time of this writing: * Domains on List: 500k * Total queries: 43k * Queries Blocked: 17k * Percentage Blocked: 39% I run GrapheneOS on my Pixel phone and very limited apps, I prefer web version. The apps themselves are fully controller and 99% of the access blocked. That is why I have a fairly low numbers after purging all the logs a few days ago.

brewdad 1y ago
While there is absolutely value in doing what you are doing and I commend you for fighting the good fight, the fact that 61% of your queries are still going through means your data is still getting out there. Maybe to a lesser degree but that doesn't mean the marketing target isn't being painted it just means you are an impressionistic painting rather than a modernist with straight, accurate lines. I want to know how to become a Pollack painting.
- h4kunamata 1y ago
  I see your point, I have no need to block 99% of everything. For instance, many apps like bank apps use Google to delivery notification (there is a name for it), so if you start blocking everything, you won't use anything. To your credit, I can block more stuff but I haven't bothered. I have spent many nights blocking stuff haha Reddit doesn't work atm home because I blocked static.reddit.com Since the API drama, I never used it again, I used to waste hours of my life everyday there. Couldn't be happier to be honest haha The only fight I gave up is YouTube, I do see value into YouTube Premium. Spotify is dogshit, YouTube Music allows to me listen to music available nowhere else like DJ remix, old music and the the offline music works which Spotify gave me the finger. I watch YT only, TV News are complete useless nowadays. There are solid news channels so anyway, I do pay for it over trying to block its ADs from the free version. I mean, try listening music with ADs, nah thanks haha

wvenable 1y ago

I love having an Eero router for the simplicity but I hate that I cannot do all the Linux routing tricks that I used to do.

roydivision 1y ago

I choose browser plugins instead for a more consistent experience, at home or anywhere.

chilldsgn 1y ago

I used to have one on my network. Then I wanted to use my RPi for some other experimentation and just kind of forgot about it. I run adblockers on my browsers anyway, but been feeling the need to start using pi-hole again recently.

lproven 1y ago

I did this in March: https://www.theregister.com/2025/03/08/pi_hole_6_flyby/ https://www.theregister.com/2025/03/08/pi_hole_6_flyby/ TBH I was surprised how easy it was, how unobtrusive it is, and how a bit of borderline e-waste that was in my spares box now helps every device on the network, including things like phones where I can’t so easily add ad-blocking.

nicoloren 1y ago

Some years ago I used Privoxy on my computer to filter unecessary request. It worked great and is an alternative to consider if you don't want a computer plugin 24/24 on your network.

10729287 1y ago

> (You will need) A monitor, mouse, and keyboard that you can plug into the Raspberry Pi as you set it up. Raspberry pi can be set up to boot with ssh login/password, so you don't even need wired mouse and keyboard.

danielovichdk 1y ago

Listen. Pi-Hole is forever something I resemble with American Pie. Good luck with whatever it is. Can't go there.

deleted 1y ago
[deleted]

perdomon 1y ago

I love my pi-hole but am surprised to see him recommending a $155 kit + keyboard, mouse, and monitor. My pi-hole runs on a Pi Zero 2W and connects via USB for power. The entire setup process happens over SSH and it cost me about $25. If someone can figure out how to configure their network for the pi-hole, I’m sure they can also figure out SSH.

tonymet 1y ago
Original pi zero with usb Ethernet also runs fine
- perdomon 1y ago
  1. You’re totally right about that, but I couldn’t find one as easily 2. I was initally hesitant about using WiFi for DNS, but after reading comments it seemed that no one really had any issues. Mine has been kicking for 6 months sitting right next to my router without any noticeable delays, so I think it’s okay.
  - sgbeal 1y ago
    > I was initally hesitant about using WiFi for DNS, but after reading comments it seemed that no one really had any issues FWIW, that was also an initial concern of mine. Almost three years later, i've never once had an issue with running my pi-hole over wifi.
    - tonymet 1y ago
      You're right it's usable, though DNS is the most critical service to have low latency. on good wifi with no interference you can get good 2ms avg and 0.2-0.4 ms SD ping distribution. ethernet will have 0.2 ms avg and 0.01 SD it's the outliers that will cause headaches, when there is radio interference. wifi is a dynamic system with every base station migrating bands for interference.
      - sgbeal 1y ago

jerome-jh 1y ago

+1 for using a picture of "the little mole" https://www.ceskatelevize.cz/porady/898287-o-krtkovi/ https://www.ceskatelevize.cz/porady/898287-o-krtkovi/ https://www.youtube.com/channel/UC8ZKvF049Iku9y41WpIUUCA https://www.youtube.com/channel/UC8ZKvF049Iku9y41WpIUUCA

vagab0nd 1y ago

How do folks deal with Pi-hole unintentionally breaking normal websites? I used it for a couple of months until one day I spent 30 minutes trying to log in to a payment website with no success. Then I remembered I had Pi-hole running. I know the solution was probably to whitelist certain URLs, but at the time I just gave up and disabled Pi-hole.