Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Setting up a Pi Hole made my home network faster

brianchristner.io

Post reply on HN
Print view View original

121–130 of 249 posts

Re: Setting up a Pi Hole made my home network faster

#121

Post by sphars »

ctur wrote: post #106

For those not wanting the overhead of running a service on your network, NextDNS sells what is basically managed pihole. I’ve used it for about a year and have been very happy. It also lets you use it on mobile devices for when you aren’t on your home network.

I moved to NextDNS after my SD card died on my Pi. One of the biggest features is that I can enable this on my phone using Android's Private DNS feature, which means it works for mobile data without having to run a VPN. Covers all networks with no extra configuration. Highly recommend.

Re: Setting up a Pi Hole made my home network faster

#122

Post by rsync »

jamiek88 wrote: post #87
rsync wrote: post #77

Earlier quoted context omitted.

How does this help with DoH? If the dns request is over 443 and the DoH server is the same host as the served resource, what can be done ?

Could you MITM and inspect for dns request packets?

Yes - I postulated this elsewhere in this thread.

The next step in the arms race would then be to implement DoHoH.

Sigh.

Re: Setting up a Pi Hole made my home network faster

#123

Post by theshrike79 »

asdkhadsj wrote: post #68
vorpalhex wrote: post #66

Earlier quoted context omitted.

I run two piholes, rackmounted and battery backed (just plugged into a ups). DNS performance is very fast, better than ISP dns usually. General web usage is much, much more pleasant. No issues with gaming.

Any recommendation on hardware piholes? I have a UDM Pro but honestly i don't know how much i trust modifying it at all - i've found Ubiquiti software to be iffy... so i'm a bit hesitant to modify anything.

You can run Pihole on any crappy raspberry pi you have around.

I ran mine on a Raspi Model B. You know, the one with the RCA plug and SD card slots. From 2012. At some point the SD was so messed up I couldn't ssh into it any more, but it still worked.

Now Pihole is running on my Thinkcenter minipc as a Socker image along with a good dozen others. I don't have to worry about SD corruption or sudden shutdowns any more.

Re: Setting up a Pi Hole made my home network faster

#124

Post by 1vuio0pswjnm7 »

rsync wrote: post #79
vladvasiliu wrote: post #24

Earlier quoted context omitted.

In the case of just using a PiHole, a hard-coded server would easily get around it. But if the network outright blocks random DNS requests, that only leaves DoH, which would require fixed IPs, which should be able to be detected and blocked, right? Sure, the setup becomes a bit more involved...

Remember- there is no reason you can’t serve DoH from the www host (the web server). So you won’t necessarily even get to play this cat and mouse game - the dns requests are indistinguishable from your web requests. I guess you could mitm your own ssl traffic and strip out dns answers there? But then … how soon until we see DoHoH?

I believe there was a proposal for something like this a while back, before the DoH we see now. IIRC, the idea was that DNS information could be contained inside the web page, maybe enclosed in a tag. Addresses for ad servers perhaps.

Few of these ideas can be expected to work unless Evil, LLC controls the program the end user chooses to read the web. When an advertsing services company is also the majority share "web browser" vendor, then ideas like this become feasible. Whereas if web users can choose any client to access the web,[FN1] then these ideas would be non-starters. The open source text-only browser I am using is not going to read the IP address of an ad server embedded in a web page and connect to it automatically. Even if it did, I would simply edit the source code to disable that behaviour and re-compile.

1. In theory they can but in practice they generally don't.

Re: Setting up a Pi Hole made my home network faster

#125

Post by jen729w »

ctur wrote: post #106

For those not wanting the overhead of running a service on your network, NextDNS sells what is basically managed pihole. I’ve used it for about a year and have been very happy. It also lets you use it on mobile devices for when you aren’t on your home network.

Very slick try-before-you-buy experience. And excellent, realistic pricing. I’ll be giving this a go.

Re: Setting up a Pi Hole made my home network faster

#127

Post by cgriswald »

ignoramous wrote: post #107
rsync wrote: post #79

Earlier quoted context omitted.

Remember- there is no reason you can’t serve DoH from the www host (the web server). So you won’t necessarily even get to play this cat and mouse game - the dns requests are indistinguishable from your web requests. I guess you could mitm your own ssl traffic and strip out dns answers there? But then … how soon until we see DoHoH?

> how soon until we see DoHoH? DoH over Tor already exists, but more importantly, Oblivious DoH (kind of like DoHoH) is being standardized by the IETF: https://datatracker.ietf.org/doc/draft-pauly-dprive-obliviou...

Unless I understand incorrectly, this doesn't seem to make the problem any worse. You'd just have to block the proxy rather than the DNS server. Like DoH, only a problem if that's also the web server.

Re: Setting up a Pi Hole made my home network faster

#128

Post by simon04 »

Brybry wrote: post #82
milgrim wrote: post #61

Earlier quoted context omitted.

There should be no cost. Which game will constantly use DNS to resolve addresses after being launched?

I caught a bug related to this in Project Zomboid in an early multiplayer version. Often when someone joined a server there would be a tiny bit of lag for all of the users. I figured out the server was using a java method that indirectly was doing a blocking DNS lookup. I think it was reverse DNS but I forget which method it actually was, and if it was blocking the main thread or just the networking thread. (PiHole s…

This issue might relate to Java's URL class equals/hashCode doing DNS lookups which is specified in Javadoc https://docs.oracle.com/javase/8/docs/api/java/net/URL.html#... but reported by various linters such as https://errorprone.info/bugpattern/URLEqualsHashCode

Re: Setting up a Pi Hole made my home network faster

#129

Post by cgriswald »

asix66 wrote: post #89
vladvasiliu wrote: post #24

Earlier quoted context omitted.

In the case of just using a PiHole, a hard-coded server would easily get around it. But if the network outright blocks random DNS requests, that only leaves DoH, which would require fixed IPs, which should be able to be detected and blocked, right? Sure, the setup becomes a bit more involved...

Actually no. By blocking 53 at your router to anything except your pihole, even a hard-coded IP like 8888 is blocked.

You'd have to do packet inspection. Otherwise a hostile hardware manufacturer could just run their DNS on a non-standard port.

Re: Setting up a Pi Hole made my home network faster

#130

Post by cassianoleal »

goodburb wrote: post #101
ferminaut wrote: post #29

I know some folks are anti Ubiquiti Unifi on here, but you can run pihole (along with a bunch of other stuff) right on a UDM/UDM-Pro. IMO it makes the most sense to run this on the router, and you can run it in a docker container. If you're looking for a fun hour or two project, check out: https://github.com/boostchicken-dev/udm-utilities/tree/maste...

For OpenWRT users, I managed to easily get it working with LXC. Sources are in "SmoothWAN" project at Github. OpenWRT natively supports LXC now. Shortcut: https://github.com/TalalMash/smoothwan-feeds/tree/main/pihol...

Never heard of smoothwan but I've been running PiHole on LXC on OpenWRT for years. It was never difficult to set it up, I just created a Debian (or Devuan, can't remember now) container and ran the PiHole install on it.
Post reply on HN