Live data from Hacker News

Setting up a secondary Pi-Hole on my home network

dzombak.com

31–40 of 75 posts

Re: Setting up a secondary Pi-Hole on my home network

#31
> I have never used macvlan (or ipvlan) networking with Docker, I don’t know how to set it up, and I’ve read conflicting and confusing reports about how easy it is to use with Pi-Hole

macvlan is cool in theory. it lets you broadcast a "real" MAC address through your container's veth. this allows it to get a real IP from your router. you can even use VLAN trunking to assign the MAC to a VLAN on your physical NIC.

that said, i only learned about it to discuss it in my course. my dockerized Adguard Home instance uses host-mode networking since that binds the physical ifaces into the container and is just as fast as any other networked process. it's also WAY WAY WAY easier than trying to get pi-hole working in bridge mode, I've found.

(I used to use pi.hole for a long time but AdGuard Home is nicer and updates itself automatically out of the box.)

macvlan can help get you slightly better networking performance by avoiding internal SNAT but it's marginal at best in most cases compared to the work required to maintain macvlan/ipvlan containers. it's also, as you pointed out, not very well documented (because it's not used very often).

This feature along with storage drivers are relics from a time when Docker was poised to own the container orchestration space with Swarm. All of the third-party contributions to Docker Engine basically died once Kubernetes reached critical mass, which was somewhere between 2018 and 2020. Weaveworks was probably the only company with an actively maintained networking driver for Docker Engine, but they are gone now :(

Re: Setting up a secondary Pi-Hole on my home network

#32
post #19

A simpler solution: Deploy one Pi-Hole instance and then set clients to use Pi-Hole as the primary resolver and your ISP/router as the secondary. In the rare circumstance that the Pi-Hole device is down, you fallback and get the "normal" ISP DNS service.

def don't do this unless you want dns leaks all over the place. the pi-hole should be the only dns server in its networks. you can also use it as a dhcp server to work around ISP routers blocking DNS modification.

Re: Setting up a secondary Pi-Hole on my home network

#33
post #7

I recently set up a Pi-Hole for the first time, but I spun it down pretty quickly. On desktop / mobile I already have client-side ad-blocking, and it's not like the Pi-Hole can block embedded ads in adware apps like YouTube on iOS, so I just couldn't really justify keeping it powered. I suppose if you have a house full of Samsung / Huawei / etc. IoTs that you really need to keep connected to the Internet for whatever…

There's a lot of advertising activity that ublock doesn't catch, but Pi-Hole does. Usually it's tracking APIs rather than ads themselves. It's also useful for clients where I can't install client-side adblocking, ie smart TVs (which try to phone home a _ton_ of advertising/analytics information). I also don't use client-side adblock on my work laptop (can't install unapproved extensions) nor my iPhone, so Pi-Hole sti…

Your work laptop allows use of local DNS? Lucky you! My work laptop gets to hit all the trackers.

Re: Setting up a secondary Pi-Hole on my home network

#34
post #23
post #7

I recently set up a Pi-Hole for the first time, but I spun it down pretty quickly. On desktop / mobile I already have client-side ad-blocking, and it's not like the Pi-Hole can block embedded ads in adware apps like YouTube on iOS, so I just couldn't really justify keeping it powered. I suppose if you have a house full of Samsung / Huawei / etc. IoTs that you really need to keep connected to the Internet for whatever…

> it's not like the Pi-Hole can block embedded ads in adware apps like YouTube on the iOS Thanks for the info. I thought this was possible and it was the sole reason why I considered setting one up. Now I procrastinated on that project long enough to learn I can cancel it.

Use YT on the web. If you have an iPhone, get Stop the Madness, which can make the ads very short and easily skippable. It also removes a lot of annoying web behaviors and is highly customizable.

Re: Setting up a secondary Pi-Hole on my home network

#35

If anyone wants a redundant system and is happy not to self-host, then I can recommend NextDNS. Works great, but not free over a certain number of requests. Can’t speak to its privacy levels though - as with anything, assume records will be supplied to authorities when required. But overall it has been great - provides network wide DNS filtering and has clients for mobile and desktop devices! With a good dashboard, r…

I agree. I use Pi for inside my network, and NextDNS as the upstream/failover and the in-the-wild DNS for my phones. For like $10 a year is good stuff.

Re: Setting up a secondary Pi-Hole on my home network

#36
post #7

I recently set up a Pi-Hole for the first time, but I spun it down pretty quickly. On desktop / mobile I already have client-side ad-blocking, and it's not like the Pi-Hole can block embedded ads in adware apps like YouTube on iOS, so I just couldn't really justify keeping it powered. I suppose if you have a house full of Samsung / Huawei / etc. IoTs that you really need to keep connected to the Internet for whatever…

There's a lot of advertising activity that ublock doesn't catch, but Pi-Hole does. Usually it's tracking APIs rather than ads themselves. It's also useful for clients where I can't install client-side adblocking, ie smart TVs (which try to phone home a _ton_ of advertising/analytics information). I also don't use client-side adblock on my work laptop (can't install unapproved extensions) nor my iPhone, so Pi-Hole sti…

Yes. So much chatting from non-browser stuff. SO MUCH.

Re: Setting up a secondary Pi-Hole on my home network

#37

Having two main servers hosting Pi-Home works great - until both of them are offline for any random reason. So I added a third Pi-Hole following Techno Tims easy to follow guide. By using keepalived and VIP I can update, restart and tinker with the two servers as much as I want. https://youtu.be/hPfk0qd4xEY

Alternatively - if someone want to deal with setting up Keepalived and VIP - they can use GravitySync. It's a easy setup.

https://github.com/vmstan/gravity-sync

Re: Setting up a secondary Pi-Hole on my home network

#38
post #19

A simpler solution: Deploy one Pi-Hole instance and then set clients to use Pi-Hole as the primary resolver and your ISP/router as the secondary. In the rare circumstance that the Pi-Hole device is down, you fallback and get the "normal" ISP DNS service.

Quite a few DNS clients don't make any distinction between "primary" and "secondary". You may enter them in order when configuring them but that has no bearing on which ends up being the server queries are sent to.

I found windows to be like this. It has no specific order on primary or secondary. However, occasionally it will latch on to one of them and continue sending several lookups to that one.

Re: Setting up a secondary Pi-Hole on my home network

#39
post #28
post #19

A simpler solution: Deploy one Pi-Hole instance and then set clients to use Pi-Hole as the primary resolver and your ISP/router as the secondary. In the rare circumstance that the Pi-Hole device is down, you fallback and get the "normal" ISP DNS service.

I did that. Then saw that filtering was inconsistent. It turns out that some systems treat the DNS list as alternatives, not as primary and failover. The spec only says the dns IPs should be specified in preference order. Nothing says to treat it as primary and failover.

Yeah, far too many devices and apps seem to use DNS in a more round robin fashion. Too inconsistent for my liking.

Re: Setting up a secondary Pi-Hole on my home network

#40
post #19

A simpler solution: Deploy one Pi-Hole instance and then set clients to use Pi-Hole as the primary resolver and your ISP/router as the secondary. In the rare circumstance that the Pi-Hole device is down, you fallback and get the "normal" ISP DNS service.

The problem is that many devices instantly spill over to the secondary Pi-Hole. And rogue devices bypass the primary altogether once they begin to get blocked for a short period of time. Having a secondary without blocking nearly negates the benefit of having the primary pi-hole, for the devices that it matters for most.

This is why you need a port 53 ban on your network that blocks all traffic except to your piholes ips. Keeps rogue machines from reaching the internet for queries
Post reply on HN