Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Beauty of Having a Pi-Hole (2024)

den.dev

Post reply on HN
Print view View original

111–120 of 211 posts

Re: The Beauty of Having a Pi-Hole (2024)

#111

Post by ndsipa_pomu »

firesteelrain wrote: post #100

Always wanted to do this but if I get a call from home and I am either 1) at work 2) out of town 3) or just not home Then, my family's ability to troubleshoot if PiHole goes down is extremely limited. Even if I had two.

One work-around is to get them to modify their wifi connection to use a specific DNS (e.g. Google at 8.8.8.8 and 8.8.4.4 is easy to remember).

I run Pi-hole in docker on a NanoPi that I setup as my router (running OpenWRT). In the rare occurrence that it misbehaves, I could just tell my spouse to power cycle it. I did think of having a failover, but there's always going to be a single point of failure with my ISP router anyhow.

Re: The Beauty of Having a Pi-Hole (2024)

#112

Post by wkat4242 »

I wouldn't bother buying a raspberry pi 5 to run this shit though, as the article suggests. It's way overkill.

Just run the docker on another server you're running anyway, or run it on a raspberry pi zero 2W for $15. A pihole does so little work, it doesn't benefit from a pi 5.

I just run it on a VPS that costs me 3€ per month and runs lots of other stuff too like an IRC bouncer. That way I can access it from everywhere.

Re: The Beauty of Having a Pi-Hole (2024)

#113

Post by wkat4242 »

wang_li wrote: post #12
mikestew wrote: post #2

In case you’re like a lot of folks in HN, read the title, and say to yourself “already have one”, read TFA for the iptables config that fixes those apps and devices that bypass local DNS. For example, the New York Times app seems to now use its own hard-coded DNS servers. Without having tried it, it looks like TFA has the fix for that. EDIT: replies indicate that I, a person who is barely competent at many network ta…

> read TFA for the iptables config that fixes those apps and devices that bypass local DNS. For example, Don't worry. All the browsers and stuff are bypassing this level of control by moving to DNS-over-HTTPS. You'll either have to deploy a TLS terminating proxy on your network, or give up on this arms race.

Yeah DoH was a solution to a really niche US-only problem where their laws provided the ability for providers to sell their users' DNS logs. In normal countries with privacy protections this isn't a thing anyway.

In this model, DoH is only a bad thing because it evades local DNS control.

I know that apps can always roll their own or even hardcode servers, but I hate the way that DoH was seen as some kind of saviour even though it adds zero benefit to European users and only adds negatives.

Re: The Beauty of Having a Pi-Hole (2024)

#114

Post by wkat4242 »

mikestew wrote: post #7
ryandrake wrote: post #4

Standard reminder for whenever Pi-Hole gets brought up: You don't actually need a physical Raspberry Pi for this functionality, and you don't even need the Pi-Hole software. It's all just wrappers around dnsmasq[1], which every Linux distribution makes available via their package manager. If you have an old spare Linux system on your LAN already, doing whatever, you can just install and set up dnsmasq and point your…

I was shocked that TFA’s recommended kit was $155! When did Raspberry Pi’s get so pricey?

It's BS anyway. Pihole doesn't need anywhere near pi 5 kinda speeds.

Re: The Beauty of Having a Pi-Hole (2024)

#115

Post by wkat4242 »

M95D wrote: post #66

For those who think DNS-over-HTTPS can't be blocked: just disable routing and use a whitelist filtering proxy server instead.

That still won't work if they use the same server to serve DoH as the rest of the content. You really have to break open the TLS connection to block it properly.

Re: The Beauty of Having a Pi-Hole (2024)

#116

Post by nobody9999 »

chaoskitty wrote: post #102

I wonder if anyone has made it easy to run the Pi Hole software on regular Unix-like systems without containers and without machine specific binaries. Perhaps I'll have to give that a try some time.

>I wonder if anyone has made it easy to run the Pi Hole software on regular Unix-like systems without containers and without machine specific binaries. Perhaps I'll have to give that a try some time.

I have done so for four or five years.

Well, with x86_64 binaries -- but I could compile the code myself if I wanted.

No containers, just a Linux (Fedora) VM.

Re: The Beauty of Having a Pi-Hole (2024)

#117

Post by tanx16 »

firesteelrain wrote: post #100

Always wanted to do this but if I get a call from home and I am either 1) at work 2) out of town 3) or just not home Then, my family's ability to troubleshoot if PiHole goes down is extremely limited. Even if I had two.

I run Wireguard in combination with Pi-Hole so I can VPN into my home network to configure anything I need. DuckDNS if you’re on a dynamic DNS provider. It’s also nice to have this since you can get the adblocking when away from home.

Re: The Beauty of Having a Pi-Hole (2024)

#118

Post by toast0 »

rsync wrote: post #76
elashri wrote: post #5

Earlier quoted context omitted.

An increasing number of them also rely on hard coded DoH servers which is harder to block/redirect. You will need to will Pi-Hole/Adguard Home on router to block them based on some curtailed lists (i.e [1]) [1] https://github.com/dibdot/DoH-IP-blocklists

In this arms race you are saying a current "move" is a curated list of IPs that correspond to known DoH servers ... and that's fine .. However, if the adversary decides to just query - and answer - DoH requests on the same hostname that you are trying to talk to ... isn't that a winning move ? For instance: If one had an application - or an appliance - that spoke https to endpoint.samsung.com, how would one block DoH…

If you're really serious about DNS interception, you'd setup something where

a) you stop accepting A lookups, because it's 2025 and IPv4 only is dead (let's pretend anyway)

b) for each AAAA lookup, return a new IPv6 address that you'll NAT to the real address (you can use this for NAT64 if you want to let clients connect to IPv4 hosts). Then only let clients connect to these IPv6 addresses you setup.

If someone smuggles address resolution through, outside of DNS, their clients can't connect.

(this is going to be a big PITA, but that's how these things go)

Re: The Beauty of Having a Pi-Hole (2024)

#120

Post by dullcrisp »

toast0 wrote: post #118
rsync wrote: post #76

Earlier quoted context omitted.

In this arms race you are saying a current "move" is a curated list of IPs that correspond to known DoH servers ... and that's fine .. However, if the adversary decides to just query - and answer - DoH requests on the same hostname that you are trying to talk to ... isn't that a winning move ? For instance: If one had an application - or an appliance - that spoke https to endpoint.samsung.com, how would one block DoH…

If you're really serious about DNS interception, you'd setup something where a) you stop accepting A lookups, because it's 2025 and IPv4 only is dead (let's pretend anyway) b) for each AAAA lookup, return a new IPv6 address that you'll NAT to the real address (you can use this for NAT64 if you want to let clients connect to IPv4 hosts). Then only let clients connect to these IPv6 addresses you setup. If someone smugg…

I guess at that point they’d have to establish a tunnel and route ads through the same HTTPS connection as legitimate traffic.
Post reply on HN