Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pi-hole v6

pi-hole.net

Post reply on HN
Print view View original

271–280 of 316 posts

Re: Pi-hole v6

#271

Post by gh02t »

samplatt wrote: post #213
gh02t wrote: post #211

Earlier quoted context omitted.

Opnsense is not like OpenWRT, it targets running on relatively powerful generic x86 hardware. Intel CPUs and networking hardware usually works best because of driver support on BSD, but it will work on others. I say "relatively" because even low power old embedded CPUs are more than enough to route at a gigabit or more with lots of firewall rules and services running. Opnsense's cousin Pfsense also has some support f…

Thanks very much for that. Been thinking about converting an old server to a router + container host for a while.

Look on eBay for old 4 port Intel NICs, you can get em for very cheap and they work forever. Beware Opnsense and Pfsense are based on BSD and you're really not supposed to touch the underlying OS by design anyway, so you will need to virtualize if you also want to host containers alongside.

Re: Pi-hole v6

#273

Post by alabastervlog »

lukevp wrote: post #168
alabastervlog wrote: post #127

Earlier quoted context omitted.

I've had a little insight into this world. To make the BOM costs work at the retail prices they charge for things like common set-top streaming boxes (e.g. Roku) and, now, TVs themselves since they incorporate the same stuff, they have to be selling data. Otherwise they're selling at a loss, once you factor in middleman margins and such. You can try to compete by charging a reasonable amount for your hardware and sof…

Or you buy an Apple TV, that’s priced appropriately with its capabilities and doesn’t thieve everything from your network and your house.

I only didn’t mention that because I’m not sure how much spying they do. I’d bet it’s a lot less, but probably still too much.

But yes, that’s what I have, two of them in fact. Tried a Shield, sucked, should have just gone straight for Apple TV instead of trying to pinch pennies.

Re: Pi-hole v6

#274

Post by ge96 »

alabastervlog wrote: post #273
lukevp wrote: post #168

Earlier quoted context omitted.

Or you buy an Apple TV, that’s priced appropriately with its capabilities and doesn’t thieve everything from your network and your house.

I only didn’t mention that because I’m not sure how much spying they do. I’d bet it’s a lot less, but probably still too much. But yes, that’s what I have, two of them in fact. Tried a Shield, sucked, should have just gone straight for Apple TV instead of trying to pinch pennies.

A follow up question is, what does the transaction look like. Bulk DB dump or JSON files per person, spreadsheet, that would be interesting like race, interests, budget...

Re: Pi-hole v6

#275

Post by bdavbdav »

zaudo wrote: post #237
master_crab wrote: post #162

Earlier quoted context omitted.

And if your gateway device is configurable enough you can ban or redirect port 53 requests (DNS) to whatever machine you would like to use to serve up resolution.

This is exactly what I do with my Unifi router, but still all I see in Pi-hole is the router making the DNS requests.

I think you’ve set the WAN dns to the PiHole. You need to set the DNS in networks.

Re: Pi-hole v6

#276

Post by zzyzxd »

LeoPanthera wrote: post #7

I've been using AdGuard Home, which does pretty much the same thing, but is slightly better polished, with things like support for DoH and OSs other than Linux. https://github.com/AdguardTeam/AdGuardHome

And it's much easier to customize.

- I run it in Kubernetes with multiple replicas behind a load balancer for high availability.

- A companion iOS shortcut for family members to temporarily pause protection on all replicas for online shopping.

- Configuration as code, which gets mounted as a secret.

- Query logs from all replicas forwarded to loki for visualization and performance review.

Re: Pi-hole v6

#277

Post by Fnoord »

tailspin2019 wrote: post #263
Fnoord wrote: post #75

Earlier quoted context omitted.

I also block Twitter ASN (yes, it is called Twitter ASN), and a whole bunch of IP ranges from not so democratic countries with very bad hostile actors. They don't have rule of law there, so I don't need these. With regards to X. Blocking it serves as a good reminder to use a proxy, or try and find the source elsewhere (Blue Sky, Mastodon). More often than not, these exist. Finally, if required I can use Tor Browser.…

Out of interest, those IP ranges that you’re blocking… is that at DNS level or are you doing some firewall-level blocking too? And do you use any kind of reference for determining which ranges/countries are wise to block or has this just been something you’ve evolved over time?

Great questions.

Currently, I have IPv4 only (will change end of year to dual stack), and to block AS13414 (NetName TWITTER-NETWORK) blocking 104.244.40.0/21 to block x.com is suffice. However, if you follow [1] you have a more complete blocklist. In a *BSD you can use cron and curl to update these lists based on if a change occurred, OPNsense allows the same in their webUI. In that vein, I also have Tor exit node block list (this is public data), I have a Censys (& Co) blocklist. You name it.

I don't use DNS-based in this instance (I do for example, for porn, cause I have children). I use a firewall-based one in OPNsense. PF (and therefore OPNsense) have a feature called anchors (alias in OPNsense) which basically allows you to use OOP to develop lists.

I'm pretty sure Linux like OpenWrt can do the same, and you can also use DNS-based blocklists. You can even outsource the hosting to e.g. NextDNS. Because these blocklists, whether firewall or DNS-based filtering, they do use some RAM especially. Back when I started w/this in early '00s this was an issue on my Soekris OpenBSD machine. Nowadays, I assign 8 GB RAM to the VM and call it a day.

[1] https://github.com/platformbuilds/TwitterIPLists

Re: Pi-hole v6

#278

Post by mattrighetti »

LeoPanthera wrote: post #7

I've been using AdGuard Home, which does pretty much the same thing, but is slightly better polished, with things like support for DoH and OSs other than Linux. https://github.com/AdguardTeam/AdGuardHome

Switched to AGH too a few years ago because from time to time pi-hole would get stuck upon unplanned reboots of the Raspberry Pis on which I had it installed

Re: Pi-hole v6

#279

Post by kube-system »

chgs wrote: post #231
kube-system wrote: post #107

Earlier quoted context omitted.

People use DoH/DoT so that their upstream DNS lookups are not transmitted in plaintext across the open internet. You can do this and still run your own DNS server on your network. The parent commenter is asking about Pihole with DoH, which is exactly this.

DoT sure. The whole “tunnel everything over http” is a terrible pattern

Hostile firewalls that block and/or intercept DNS traffic are also a bad pattern, but people don't always control their local network these days. You can't always count on 853 being open. There are valid use cases for both.

Re: Pi-hole v6

#280

Post by 10729287 »

sph wrote: post #255
10729287 wrote: post #228

Earlier quoted context omitted.

Also, having two Raspberry Pi for primary and secondary dns is good practice, in case something goes wrong with the main one.

Why not run pi-hole in one of those kubernetes cluster for Raspberry Pi, and don't forget a set up a UPS for redundant power supply. Or: in the rare eventuality that your raspberry pi dies, it takes 15 seconds to open your router interface and reset to the ISP DNS. Work smart, not hard.

I dare you to tell my wife how easy it is. I still remember OpenDNS being blocked in France the exact day I went for business trip and me not anticipating it (I didn't remember it was set in pi-hole)
Post reply on HN