Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Beauty of Having a Pi-Hole (2024)

den.dev

Post reply on HN
Print view View original

201–210 of 211 posts

Re: The Beauty of Having a Pi-Hole (2024)

#201

Post by sgbeal »

tonymet wrote: post #194
sgbeal wrote: post #191

Earlier quoted context omitted.

> I was initally hesitant about using WiFi for DNS, but after reading comments it seemed that no one really had any issues FWIW, that was also an initial concern of mine. Almost three years later, i've never once had an issue with running my pi-hole over wifi.

You're right it's usable, though DNS is the most critical service to have low latency. on good wifi with no interference you can get good 2ms avg and 0.2-0.4 ms SD ping distribution. ethernet will have 0.2 ms avg and 0.01 SD it's the outliers that will cause headaches, when there is radio interference. wifi is a dynamic system with every base station migrating bands for interference.

> on good wifi with no interference you can get good 2ms avg and 0.2-0.4 ms SD ping distribution.

i opine that there's no _functional_ difference between those speeds for purposes of a home LAN. Both values are far below humans' ability to perceive the difference.

Re: The Beauty of Having a Pi-Hole (2024)

#202

Post by illiac786 »

h4kunamata wrote: post #162
vladvasiliu wrote: post #158

Earlier quoted context omitted.

> Devices trying to use DoT or DoH??? Blocked, PiHoles take over. How? I can see you only allowing some ports through the firewall, but presumably TCP 443 is one of those. According to Cloudflare [0] DoH uses that. What if Samsung uses that, or figures DoT on port 443 works better? Do you only allow specific destinations for these devices? I actually use a similar setup, only I removed pihole and just use some lists…

I followed this blog to get the firewall dynamic firewall in place: https://labzilla.io/blog/force-dns-pihole Like you said, you cannot just block 443, the dynamic firewall uses a public list, which contains all the public DNS known to man ( the last bit was just to sound a little dramatic haha ) So OPNSense will block anything within that list in both 443 and 853. So my Samsung QLED TV can no longer use Google:443 f…

I have similar setup with adguard and opnsense, and here is another list for public known DoH servers (including IPv6):

https://raw.githubusercontent.com/dibdot/DoH-IP-blocklists/r... https://raw.githubusercontent.com/dibdot/DoH-IP-blocklists/r...

Re: The Beauty of Having a Pi-Hole (2024)

#203

Post by illiac786 »

pimeys wrote: post #110
rsync wrote: post #76

Earlier quoted context omitted.

In this arms race you are saying a current "move" is a curated list of IPs that correspond to known DoH servers ... and that's fine .. However, if the adversary decides to just query - and answer - DoH requests on the same hostname that you are trying to talk to ... isn't that a winning move ? For instance: If one had an application - or an appliance - that spoke https to endpoint.samsung.com, how would one block DoH…

I run Zenarmor in addition to Adguard at home, which can detect DoH traffic and intercept it. You have to pay for this enterprise level tool, but if you are worried about DoH, Zenarmor is so far the easiest tool to block it. In our house the only device that tries to use DoH is my partner's iPhone. It tries a few times, fails, then uses the Adguard DNS, which blocks the trackers.

Do you have documentation of this? My understanding was always that Zenarmor simply maintains a list of known DoH servers.

Re: The Beauty of Having a Pi-Hole (2024)

#204

Post by tonymet »

sgbeal wrote: post #201
tonymet wrote: post #194

Earlier quoted context omitted.

You're right it's usable, though DNS is the most critical service to have low latency. on good wifi with no interference you can get good 2ms avg and 0.2-0.4 ms SD ping distribution. ethernet will have 0.2 ms avg and 0.01 SD it's the outliers that will cause headaches, when there is radio interference. wifi is a dynamic system with every base station migrating bands for interference.

> on good wifi with no interference you can get good 2ms avg and 0.2-0.4 ms SD ping distribution. i opine that there's no _functional_ difference between those speeds for purposes of a home LAN. Both values are far below humans' ability to perceive the difference.

i agree, but you won't know until you test. ethernet results are extremely consistent across applications, assuming there isn't a bad cable. wifi can vary wildly by 10000 factor even in the same location on different days

Re: The Beauty of Having a Pi-Hole (2024)

#205

Post by dayone1 »

h4kunamata wrote: post #141

I run PiHole for years in my home network, I cannot live without it. With the years, I have made small changes to increase my control over it. I have a recursive DNS setup, PiHole filters everything, and what is left is processed locally via Unbound which in turn, contacts the 13 root nameservers for DNS resolution. I don't use any third party DNS. Add PiHole/Unbound caching capabilities, surfing on the internet is b…

Is there an updated set of instructions/great guide on how to set up unbound and pihole together along with forced DNS redirection (so all dns requests are forced through unbound/pihole)? I tried to do this a couple of years ago and gave up because of how complicated it was to setup.

Re: The Beauty of Having a Pi-Hole (2024)

#206

Post by h4kunamata »

dayone1 wrote: post #205
h4kunamata wrote: post #141

I run PiHole for years in my home network, I cannot live without it. With the years, I have made small changes to increase my control over it. I have a recursive DNS setup, PiHole filters everything, and what is left is processed locally via Unbound which in turn, contacts the 13 root nameservers for DNS resolution. I don't use any third party DNS. Add PiHole/Unbound caching capabilities, surfing on the internet is b…

Is there an updated set of instructions/great guide on how to set up unbound and pihole together along with forced DNS redirection (so all dns requests are forced through unbound/pihole)? I tried to do this a couple of years ago and gave up because of how complicated it was to setup.

I shared the link before, we do need to have firewall rules in place to enforce that. I had done it before but was wrong, I could still bypass PiHole.

I had to recreate all my firewall rules because of a system crash, the order and place I had the rules created earlier were wrong.

I shared the blog link yesterday, that is all you need to follow.

Re: The Beauty of Having a Pi-Hole (2024)

#207

Post by h4kunamata »

illiac786 wrote: post #202
h4kunamata wrote: post #162

Earlier quoted context omitted.

I followed this blog to get the firewall dynamic firewall in place: https://labzilla.io/blog/force-dns-pihole Like you said, you cannot just block 443, the dynamic firewall uses a public list, which contains all the public DNS known to man ( the last bit was just to sound a little dramatic haha ) So OPNSense will block anything within that list in both 443 and 853. So my Samsung QLED TV can no longer use Google:443 f…

I have similar setup with adguard and opnsense, and here is another list for public known DoH servers (including IPv6): https://raw.githubusercontent.com/dibdot/DoH-IP-blocklists/r... https://raw.githubusercontent.com/dibdot/DoH-IP-blocklists/r...

That is cool, but the list looks too small, the list https://public-dns.info/nameservers-all.txt is a lot bigger.

Re: The Beauty of Having a Pi-Hole (2024)

#208

Post by NoPicklez »

foobahhhhh wrote: post #155
NoPicklez wrote: post #147

Earlier quoted context omitted.

To fix that you just need to look through the logs through the native pi-hole UI and whitelist those domains which cause friction with your browsing habits. The google sponsored search issue was one I also fixed quite quickly. As for the others those services depend on, again you just need to find them and whitelist them which isn't too tricky to do. Unfortunately pi-hole won't stop everything.

Or don't use hostile services

That is also an option yes, however it is challenging in todays world to find products that aren't hostile. Usually its a question of to which degree are they hostile and what can I live with or control.

Re: The Beauty of Having a Pi-Hole (2024)

#209

Post by firesteelrain »

overfeed wrote: post #107
firesteelrain wrote: post #100

Always wanted to do this but if I get a call from home and I am either 1) at work 2) out of town 3) or just not home Then, my family's ability to troubleshoot if PiHole goes down is extremely limited. Even if I had two.

What black-swan event would cause would 2 PiHoles go down simultaneously? You could always use a non-PiHole guest-network if your WiFi hardware supports it, and let your family know to use the guest network if the regular network is down. The manual switching might not be necessary as most computers, phones and tablets automatically disassociate from a WiFi network if it's "offline", such as when DNS resolution fails…

Power outage due to storm or power surge. I live where there are bad storms

Re: The Beauty of Having a Pi-Hole (2024)

#210

Post by overfeed »

firesteelrain wrote: post #209
overfeed wrote: post #107

Earlier quoted context omitted.

What black-swan event would cause would 2 PiHoles go down simultaneously? You could always use a non-PiHole guest-network if your WiFi hardware supports it, and let your family know to use the guest network if the regular network is down. The manual switching might not be necessary as most computers, phones and tablets automatically disassociate from a WiFi network if it's "offline", such as when DNS resolution fails…

Power outage due to storm or power surge. I live where there are bad storms

If you really want to try the pihole, and are worried about corruption you could use a read-only root filesystem and mount /tmp and /var/log on tmpfs ramdisk, alternatively, add "@reboot touch /forcefsck" to force a disk check whenever the Pi(s) reboot, including when power returns after an outage.
Post reply on HN