Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Beauty of Having a Pi-Hole (2024)

den.dev

Post reply on HN
Print view View original

141–150 of 211 posts

Re: The Beauty of Having a Pi-Hole (2024)

#141

Post by h4kunamata »

I run PiHole for years in my home network, I cannot live without it. With the years, I have made small changes to increase my control over it.

I have a recursive DNS setup, PiHole filters everything, and what is left is processed locally via Unbound which in turn, contacts the 13 root nameservers for DNS resolution. I don't use any third party DNS.

Add PiHole/Unbound caching capabilities, surfing on the internet is bloody fast.

Now, they alone cannot block everything like smartTV with hardcoded DNS, DNS-Over-TLS, DNS-Over-HTTPS, etc.

That is where OPNSense comes to play...

I have firewall rules in place that nobody but PiHoles can request name resolution. My Samsung smarTV trying to use Google DNS?? Blocked, PiHole takes over.

Devices trying to use DoT or DoH??? Blocked, PiHoles take over.

You can create dynamic firewall rule with OPNSense so it will only block 443 and 853 if the host match the list which is updated diary.

To make everything even better, OPNSense firewall makes sure no IoT can access the local network but I can access them like wireless printer, etc, and if I need to access anything while on road like my cat's cam or my Voron 3D printer camera, WireGuard VPN makes sure of that. No VPN equals no network access.

It is just me and my devices, at the time of this writing:

* Domains on List: 500k

* Total queries: 43k

* Queries Blocked: 17k

* Percentage Blocked: 39%

I run GrapheneOS on my Pixel phone and very limited apps, I prefer web version. The apps themselves are fully controller and 99% of the access blocked. That is why I have a fairly low numbers after purging all the logs a few days ago.

Re: The Beauty of Having a Pi-Hole (2024)

#142

Post by AnonC »

itchyouch wrote: post #29

For the cost and simplicity, NextDNS is way easier IMO. Nice quality of life apps that install on your phone and computer to toggle it on/off while on-the-go, while also being able to be setup on the router. Makes it nice and easy for the non-technical members of the fam.

NextDNS is not the answer if someone is looking for apps to toggle on or off the blocking easily. The NextDNS apps on iOS and iPadOS have not been updated for about five years and the toggle is broken (I know this because I’ve been troubled by it for years). If using the app on iOS/iPadOS (and not a permanent VPN profile), anytime you wish to know if NextDNS is on or not, go to test.nextdns.io on a browser and see if it shows “unconfigured” or some specific NextDNS endpoint. For me this test has proven how it randomly works or doesn’t work.

Re: The Beauty of Having a Pi-Hole (2024)

#143

Post by wkat4242 »

diogocp wrote: post #137
wkat4242 wrote: post #113

Earlier quoted context omitted.

Yeah DoH was a solution to a really niche US-only problem where their laws provided the ability for providers to sell their users' DNS logs. In normal countries with privacy protections this isn't a thing anyway. In this model, DoH is only a bad thing because it evades local DNS control. I know that apps can always roll their own or even hardcode servers, but I hate the way that DoH was seen as some kind of saviour e…

Your comment makes no sense. The DoH providers can still log requests and sell them. DoH protects against intermediaries spying on your requests and potentially forging responses. Exactly the same as HTTPS. Sending anything in clear text over the internet in 2025 is criminally negligent.

Yes but in the US the ISPs are the intermediary. And the big DoH providers like Cloudflare have better privacy protection.

Here the ISPs are intermediairs too, but we have laws to prevent them from using our data using DPI etc. And even if you use their DNS.

I agree encryption is important but DoT is much better then. DoH mainly took off because of this in the US.

Re: The Beauty of Having a Pi-Hole (2024)

#144

Post by happyhacks »

squigz wrote: post #126
chihuahua wrote: post #69

Earlier quoted context omitted.

Edge browser + uBlock Origin, and YouTube works perfectly without ads.

Firefox works well too. 10.2M blocked requests on my uBlock, and YouTube - and every other site - works perfectly fine.

youtube was likely broken because

jnn-pa.googleapis.com

was likely in one of the lists - add it to "Exact allow" list

Similarly you can allow

googleadservices.com

but that is too much IMO - I just have a habit now to not click on such results.

Re: The Beauty of Having a Pi-Hole (2024)

#145

Post by happyhacks »

TechDebtDevin wrote: post #42
3abiton wrote: post #40

Earlier quoted context omitted.

I started like you, but slowly with more debugging and customized use-cases I started understanding more and more. That's the way for people with limited free time. That said, now with LLMs, honestly anything is easily learnable.

It still shouldnt break all the time. You shouldnt havr to get good at debugging a tool like this. I use but it dors destroy my network once a month and have had to build cleanup/reinstall scripts for this scenerio. I would not recommend to most people.

Don't know about your network - but I have been running it for years without any issue, just a docker pull to update the containers once a while

Re: The Beauty of Having a Pi-Hole (2024)

#146

Post by wkat4242 »

wkat4242 wrote: post #112

I wouldn't bother buying a raspberry pi 5 to run this shit though, as the article suggests. It's way overkill. Just run the docker on another server you're running anyway, or run it on a raspberry pi zero 2W for $15. A pihole does so little work, it doesn't benefit from a pi 5. I just run it on a VPS that costs me 3€ per month and runs lots of other stuff too like an IRC bouncer. That way I can access it from everywh…

> I wouldn't bother buying a raspberry pi 5 to run this shit though,

PS, I didn't mean the word 'shit' negatively. 'stuff' would have been better. But I meant it more as in 'check this shit out' :)

Pihole is actually a really nice project even though it's just a wrapper around dnsmasq.

Re: The Beauty of Having a Pi-Hole (2024)

#147

Post by NoPicklez »

xracy wrote: post #65

Disclaimer: The below is not a complaint about the pi-hole itself, but the ways in which companies integrate ads into their online presence. I've found my complaint about having a pi-hole is there are a number of services I use that expect/depend on ads existing in order to function. Things like, some shows on paramount+ (as an example) will fail to play (hang indefinitely) if an ad hasn't run before one of their sho…

To fix that you just need to look through the logs through the native pi-hole UI and whitelist those domains which cause friction with your browsing habits.

The google sponsored search issue was one I also fixed quite quickly.

As for the others those services depend on, again you just need to find them and whitelist them which isn't too tricky to do. Unfortunately pi-hole won't stop everything.

Re: The Beauty of Having a Pi-Hole (2024)

#148

Post by bongodongobob »

blooalien wrote: post #130
bongodongobob wrote: post #51

Earlier quoted context omitted.

It's very straightforward. You set the IP of the pinhole for DNS in the settings of whatever is doing DHCP on your network. That's it.

Yeah, and set the IP of the PiHole as DNS for any device you've set static network settings on as well, but yes, it is indeed "very straightforward" for anyone that's able to set up their local network (or able to ask a "nerdy" friend or family member to do it for 'em).

If you've set static IPs, I don't see how picking where DNS comes from is out of your wheelhouse.

Re: The Beauty of Having a Pi-Hole (2024)

#149

Post by tenacious_tuna »

bongodongobob wrote: post #50
mikestew wrote: post #2

In case you’re like a lot of folks in HN, read the title, and say to yourself “already have one”, read TFA for the iptables config that fixes those apps and devices that bypass local DNS. For example, the New York Times app seems to now use its own hard-coded DNS servers. Without having tried it, it looks like TFA has the fix for that. EDIT: replies indicate that I, a person who is barely competent at many network ta…

No, that's not a fix and those iptables settings are on the router. It will only catch DNS requests on port 53. Doesn't catch DoH which you can't do on a router, you need a firewall for that.

Also, doesn't that break the network if the pihole is offline? Before I'd just override DNS on my workstation, but that iptables config would block any "unsanctioned" DNS traffic

Re: The Beauty of Having a Pi-Hole (2024)

#150

Post by RachelF »

mikestew wrote: post #2

In case you’re like a lot of folks in HN, read the title, and say to yourself “already have one”, read TFA for the iptables config that fixes those apps and devices that bypass local DNS. For example, the New York Times app seems to now use its own hard-coded DNS servers. Without having tried it, it looks like TFA has the fix for that. EDIT: replies indicate that I, a person who is barely competent at many network ta…

I've seen Windows 11 ignoring DNS settings too, for Microsoft telemetry, ads and updates.
Post reply on HN