The Beauty of Having a Pi-Hole (2024)

#1

Post by mpweiher » Mon, May 05, 2025, 12:06 PM UTC

The Beauty of Having a Pi-Hole (2024)
den.dev

Re: The Beauty of Having a Pi-Hole (2024)

#2

Post by mikestew » Mon, May 05, 2025, 3:52 PM UTC

In case you’re like a lot of folks in HN, read the title, and say to yourself “already have one”, read TFA for the iptables config that fixes those apps and devices that bypass local DNS. For example, the New York Times app seems to now use its own hard-coded DNS servers. Without having tried it, it looks like TFA has the fix for that.

EDIT: replies indicate that I, a person who is barely competent at many network tasks, might be off-base on this one. Grain of salt, and all.

Re: The Beauty of Having a Pi-Hole (2024)

#3

Post by ignoramous » Mon, May 05, 2025, 4:02 PM UTC

mikestew wrote: post #2

In case you’re like a lot of folks in HN, read the title, and say to yourself “already have one”, read TFA for the iptables config that fixes those apps and devices that bypass local DNS. For example, the New York Times app seems to now use its own hard-coded DNS servers. Without having tried it, it looks like TFA has the fix for that. EDIT: replies indicate that I, a person who is barely competent at many network ta…

> For example, the New York Times app seems to now use its own hard-coded DNS servers. Without having tried it, it looks like TFA has the fix for that.

Those commands in TFA simply reroute traffic on port 53 to Pi-Hole, which isn't enough to prevent apps from doing their own name resolution. For instance, the Telegram app has built-in DNS-over-HTTPS, which those iptables chains could do nothing about.

Re: The Beauty of Having a Pi-Hole (2024)

#4

Post by ryandrake » Mon, May 05, 2025, 4:04 PM UTC

Standard reminder for whenever Pi-Hole gets brought up: You don't actually need a physical Raspberry Pi for this functionality, and you don't even need the Pi-Hole software. It's all just wrappers around dnsmasq[1], which every Linux distribution makes available via their package manager. If you have an old spare Linux system on your LAN already, doing whatever, you can just install and set up dnsmasq and point your clients' DNS settings at it! You can run it on your Internet gateway or rooted WiFi router, too.

1: https://en.wikipedia.org/wiki/Dnsmasq

Re: The Beauty of Having a Pi-Hole (2024)

#5

Post by elashri » Mon, May 05, 2025, 4:04 PM UTC

mikestew wrote: post #2

In case you’re like a lot of folks in HN, read the title, and say to yourself “already have one”, read TFA for the iptables config that fixes those apps and devices that bypass local DNS. For example, the New York Times app seems to now use its own hard-coded DNS servers. Without having tried it, it looks like TFA has the fix for that. EDIT: replies indicate that I, a person who is barely competent at many network ta…

An increasing number of them also rely on hard coded DoH servers which is harder to block/redirect. You will need to will Pi-Hole/Adguard Home on router to block them based on some curtailed lists (i.e [1])

[1] https://github.com/dibdot/DoH-IP-blocklists

Re: The Beauty of Having a Pi-Hole (2024)

#6

Post by silverwind » Mon, May 05, 2025, 4:11 PM UTC

mikestew wrote: post #2

In case you’re like a lot of folks in HN, read the title, and say to yourself “already have one”, read TFA for the iptables config that fixes those apps and devices that bypass local DNS. For example, the New York Times app seems to now use its own hard-coded DNS servers. Without having tried it, it looks like TFA has the fix for that. EDIT: replies indicate that I, a person who is barely competent at many network ta…

Apps that open arbritrary UDP/TCP ports? Isn't that something the app store policies should reject?

Re: The Beauty of Having a Pi-Hole (2024)

#7

Post by mikestew » Mon, May 05, 2025, 4:18 PM UTC

ryandrake wrote: post #4

Standard reminder for whenever Pi-Hole gets brought up: You don't actually need a physical Raspberry Pi for this functionality, and you don't even need the Pi-Hole software. It's all just wrappers around dnsmasq[1], which every Linux distribution makes available via their package manager. If you have an old spare Linux system on your LAN already, doing whatever, you can just install and set up dnsmasq and point your…

I was shocked that TFA’s recommended kit was $155! When did Raspberry Pi’s get so pricey?

Re: The Beauty of Having a Pi-Hole (2024)

#8

Post by crtasm » Mon, May 05, 2025, 4:19 PM UTC

ryandrake wrote: post #4

Standard reminder for whenever Pi-Hole gets brought up: You don't actually need a physical Raspberry Pi for this functionality, and you don't even need the Pi-Hole software. It's all just wrappers around dnsmasq[1], which every Linux distribution makes available via their package manager. If you have an old spare Linux system on your LAN already, doing whatever, you can just install and set up dnsmasq and point your…

Another option is to run Pi-Hole on any device that can use docker: https://docs.pi-hole.net/docker/

Re: The Beauty of Having a Pi-Hole (2024)

#9

Post by ChrisLTD » Mon, May 05, 2025, 4:21 PM UTC

mikestew wrote: post #7

ryandrake wrote: post #4

Standard reminder for whenever Pi-Hole gets brought up: You don't actually need a physical Raspberry Pi for this functionality, and you don't even need the Pi-Hole software. It's all just wrappers around dnsmasq[1], which every Linux distribution makes available via their package manager. If you have an old spare Linux system on your LAN already, doing whatever, you can just install and set up dnsmasq and point your…

I was shocked that TFA’s recommended kit was $155! When did Raspberry Pi’s get so pricey?

Same. I thought it'd be ~$50.

Re: The Beauty of Having a Pi-Hole (2024)

#10

Post by incomingpain » Mon, May 05, 2025, 4:22 PM UTC

Currently im at 28% blocked. Typically im above 50% like OP.

They have significantly higher number of domains blocked. time to update my lists: https://firebog.net/