111–120 of 249 posts
I know some folks are anti Ubiquiti Unifi on here, but you can run pihole (along with a bunch of other stuff) right on a UDM/UDM-Pro. IMO it makes the most sense to run this on the router, and you can run it in a docker container. If you're looking for a fun hour or two project, check out: https://github.com/boostchicken-dev/udm-utilities/tree/maste...
Won't be long now until IoT and other crap-ware devices catch on to this trend and start hard-coding DNS servers in code, or worse, using DNS encryption to avoid this sort of routine blocking by end-users. I wonder how people are thinking about solving this problem.
For those not wanting the overhead of running a service on your network, NextDNS sells what is basically managed pihole. I’ve used it for about a year and have been very happy. It also lets you use it on mobile devices for when you aren’t on your home network.
only fixed cost was the pi to run in (pi version 1 ram if by far enough for just pihole +unbound)
Like any other project I run everything in a Docker container, and this project should be no different. What is the advantage of this in this case?
> What is the advantage of this in this case? That you can manage & think of this machine (program/process/container/vm) the same was as every other machine & dont have to ever ever ever ask "what should i do in this case?" or "what's right for this case?" because it's a unified answer that works well & operates the same everywhere. Uniformity & no special cases. Death to pitiful old ways.
Much more recently I realized that this phenomenon of One Rule, One Exception falls under the umbrella of - or perhaps explains the effectiveness of - the Rule of Three. Two exceptions are bad, and work is partially pre-empted to correct that problem.
Earlier quoted context omitted.
My understanding is that PiHole stops the ads from being downloaded in the first place, hence the increased network performance.
uBlock prevents then from being downloaded too
Earlier quoted context omitted.
I recommend opnsense [0] over pfsense. I ran pfsense for 5 years and it is great, but there was some bad blood [1] between the two projects and the community. [0] https://opnsense.org/ [1] https://teklager.se/en/pfsense-vs-opnsense/
I am aware of opensense, and while e.g. the GUI looks cleaner and seems to have more plugins, when I started checking it more in depth I think that pfsense has more thorough documentation and things like traffic shaping which i plan to implement seems to be way easier on pfsense also have you done migration between the two? if so, how hard was it?
I tried the auto-migration in OPNsense (backup from PFsense, restore to OPNsense) a couple times. Both times it got it mostly right, but whatever it got wrong blocked pretty much all traffic and was difficult to figure out why because everything looked right. I gave up and stayed with PFsense, but figured if I ever really did want to switch I would start from scratch.
Earlier quoted context omitted.
Same on DoH. I can’t filter it or redirect it like I can with plain old DNS.
Yes, really the only way would be to set up a MITM proxy on your network and enforce all traffic goes through that. Also means accepting a CA.
Many years ago I anticipated that "developers" would no longer allow end users to choose DNS servers. The developers' work, i.e., software, was dropping in market value and they began to adopt a Trojan Horse "business model". End users could use the software for free with the expectation that few would notice/complain about increased surveillance and data collection, or injected advertising.
The so-called "MITM proxy" is neither a new nor radical idea. Corporations routinely "MITM" TLS traffic from their networks. Enterprise hardware/software companies have provided turnkey solutions.
The issue is not limited to addresses for DNS servers. For example, WhatsApp hardcodes IP addresses in their mobile app. For that problem I use an application firewall.
The PiHole is essentially a slightly modified version of dnsmasq running on a RPi. It is funny that no one has tried using other DNS software. Given a choice of DNS software, I would not choose dnsmasq. It also still seems that no one has presented a "PiHole" that uses a forward proxy instead of a DHCP/DNS server. Similar to corporations, home users need a turnkey solution for monitoring their home networks.
I know some folks are anti Ubiquiti Unifi on here, but you can run pihole (along with a bunch of other stuff) right on a UDM/UDM-Pro. IMO it makes the most sense to run this on the router, and you can run it in a docker container. If you're looking for a fun hour or two project, check out: https://github.com/boostchicken-dev/udm-utilities/tree/maste...
For OpenWRT users, I managed to easily get it working with LXC. Sources are in "SmoothWAN" project at Github. OpenWRT natively supports LXC now. Shortcut: https://github.com/TalalMash/smoothwan-feeds/tree/main/pihol...
https://github.com/openwrt/packages/blob/master/net/adblock/...
For those not wanting the overhead of running a service on your network, NextDNS sells what is basically managed pihole. I’ve used it for about a year and have been very happy. It also lets you use it on mobile devices for when you aren’t on your home network.
Won't be long now until IoT and other crap-ware devices catch on to this trend and start hard-coding DNS servers in code, or worse, using DNS encryption to avoid this sort of routine blocking by end-users. I wonder how people are thinking about solving this problem.
I solve this with a DNS based firewall. Essentially it's just DNS filtering on steriods. You start with an empty (or preseeded) ipset, and a firewall rule that says to reject/drop all outbound traffic if the destination isn't in the ipset. Dnsmasq is setup as the default dns provider in DHCP, and it's setup to add all resolved IPs to the ipset (with an expiration so stale entries get removed). Then it's just DNS filt…