Pi-Hole – A black hole for Internet advertisements

https://github.com/pi-hole/pi-hole

by tosh • 7 years ago

492 205 7 years ago

github.com

snazz• 7 years ago

Should the URL be https://pi-hole.net instead of one of their GitHub repos?

tosh2• 7 years ago

I find the Github readme easier to parse (often the case with open source projects actually)

schappim• 7 years ago

There are some good discussions on Pi-Hole over on this thread: https://news.ycombinator.com/item?id=18075159

tosh2• 7 years ago

sorry, didn’t realize it was already on 5 months ago

lucb1e3• 7 years ago

No problem, since people upvote it you're apparently not the only one who thought the content is useful to the site. Reposts are fine (heck, posts that are decades old come up from time to time), though it's somewhat customary to link previous discussions.

realPubkey2• 7 years ago

I wonder why there is no public official dns-server with the pi-hole blockings included. This would allow me to just insert the dns-ip into my fritzbox without having to setup and run a raspberry.

clarkmoody• 7 years ago

You're probably going to want to whitelist a domain here and there relative to the default blacklist. And the pi-hole has a few blacklists that aren't enabled by default, since they are much more strict.

So pi-hole-as-a-service doesn't make too much sense.

chewyland• 7 years ago

PiHole as a service will definitely happen and I would be willing to pay a monthly fee for it.

My setup has been running for over a year and it has completely transformed the Internet for me.

realPubkey2• 7 years ago

Ok thats a good argument. But the few pihole-users i know do not have a single whitelisted domain and likely will never have one. Also I could still whitelist most domains by adding the ip to my etc/hosts

trumped• 7 years ago

most people would be happy with the default settings... and if everyone would be using it, websites would make sure that they work with pi-hole users

tbronchain2• 7 years ago

Seems like there is: https://adguard.com/en/adguard-dns/overview.html

However, as it's been said, you might want to easily whitelist some domains.

tbronchain2• 7 years ago

I came across this article last month: https://ifelse.io/2019/01/12/secure-ad-free-internet-anywher...

It was surprisingly very easy and straightforward to setup, and working very well! It's most useful on Android/iOS.

One small change I've done is to set the Pi-hole DNS server only on a specific set of VPN connections (using specific ports) in order to have a full, unfiltered VPN if necessary.

dsissitka4• 7 years ago

If you're interested in Pi-hole you might want to check out AdGuard Home:

https://github.com/AdguardTeam/AdGuardHome

Pi-hole isn't difficult to setup but AdGuard Home is much easier. Just download the binary and run it. If you want it to start on boot run it with the `--install` flag. Works on Linux, Mac, and Windows.

Moru2• 7 years ago

Pi-hole replaces your DNS on the local network so one device is protecting all your other devices without you having to do anthing else. Yes, even that Wii or whatever :-)

dsissitka4• 7 years ago

Same with AdGuard Home. :)

_emacsomancer_2• 7 years ago

Can it be set up on a Pi in a similar way? Or is it designed just to run on each machine?

dsissitka4• 7 years ago

It's a drop-in replacement for Pi-hole. You can install it on a Pi and use it as a DHCP or DNS server.

ignoramous• 7 years ago

I absolutely love the DNS based solution for ad-blocking and preventing tracking. I use AdGuard DNS on my PC (DNSCrypt) [0] and phone (DoTLS) [1], and it has improved performance of apps (not just websites), 'cause I guess there's a lot less going on under the hood now (trackers like new-relic and segment might be consuming a good percentage of resources which they wouldn't now since their domains are NX'ing?).

What am I worried about is DNS based black-holing is trivial to workaround against (as an ad-provider, one could simply force use a custom DNS client and pin to a DNS resolver of choice) [2][3][4]. What's next for pi-hole and solutions like AdGuard DNS short of re-writing packets going through UDP/53? Not sure how one would intercept the DoTLS / DoHTTPS connections, to rewrite those.

I'd like to hear if anyone has some thoughts on this, or if this has been discussed elsewhere.

[0] https://simplednscrypt.org/

[1] https://news.ycombinator.com/item?id=18788410

[2] https://news.ycombinator.com/item?id=19170671

[3] https://news.ycombinator.com/item?id=19106023

[4] Firefox 64 for PC, by default, was configured to ignore OS/Network Interface provided DNS resolver and used CloudFlare's over HTTPS.

wnissen2• 7 years ago

I bought the Pi-Hole kit for ~$US100 but was never able to get it to work properly with SSL/TLS sites despite some (admittedly cursory) Googling. It's a great idea in theory.

https://uk.pi-supply.com/products/pi-hole-kit-network-wide-a...

vultour• 7 years ago

Is that a raspberry pi and some cables sold for $100?

homerhomer• 7 years ago

Somebody is overcharging you on this one. I installed it on my Raspberry Pi B from like 2012. I installed Raspbian, input a small one liner and it was installed.

wnissen2• 7 years ago

WAIT, just updated to the latest version and it's working great now. All I had to do was set my Airport to use the Pi-Hole for DNS and now every device on my home network is 99% ad-free. Very impressive.

zamadatix• 7 years ago

DoTLS and DoHTTPS can be intercepted on your own devices by adding a privately generated certificate to your root store and MITMing the traffic. By design this is the only way to filter this traffic based on content.

Regardless name resolution based ad blocking is relatively futile against even naive workarounds. For instance what is to stop someone from using a custom DoHTTPS format on any webpage to resolve the name directly in browser? What's to prevent them from obfuscating it in a way your MITM couldn't realistically detect?

In the end ad blocking is best done directly on the client through something like uBlock Origin. Not only does this allow you to create a network request block list (now with the added capability of reading/filtering on the whole URI) but it also allows for style based blocks where the ad content could even be blocked if it comes from the same server and resources serving the actual page.

inapis• 7 years ago

You honestly need both.

Of course, a pihole will not be able to block someone who goes to the length of developing and using a custom DNS-over-TLS or DNS-over-HTTPS webpage.

Similarly uBlock origin is not available for anything else except browsers. There is nothing preventing native apps from using or pinning different nameservers. On a scale of hardness, using or pinning a specific DNS server is easy and is known to be used in wild. Custom DoT or DoH is still rare but I am aware that there will be a time when a significant chunk of internet will use it.

Name-resolution based ad-blocking is not futile yet. My pihole has alone blocked 5k+ queries in the past 24h.

1over1374• 7 years ago

Re #4: really?! I missed that news. Sounds horrible. So instead of using my ISP, that I chose and trust, all my DNS queries now go to some foreign megacorp?!

meowface2• 7 years ago

This is also the first time I heard about it, but my immediate reaction was "sounds amazing".

- Removes all DNS leak privacy issues, for all Firefox users, automatically

- Removes all possibility for a MitM to view or corrupt DNS queries or responses, for all Firefox users, automatically

And Cloudflare claims to delete all DNS-related logs of Firefox users within 24 hours: https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...

Even if you distrust Cloudflare or think they're not secure against breaches, it's still a massive security and privacy upgrade over using your ISP's DNS servers, which will pretty much always leak sensitive information about your connection (potentially leading to deanonymization while using an anonymizing service) and send/receive everything in unauthenticated plaintext.

And in addition, your ISP likely is less trustworthy and less secure against breaches (even if you aren't using Comcast, Verizon, or AT&T) than Cloudflare. But again, even if you don't trust them, this would still be the best move for security.

Plus it's a big latency decrease and performance boost for most or all users.

Lord_Nightmare• 7 years ago

AFAIK this is not activated by default in FF65; the about:config key for it is 'network.trr.mode'. The default is currently 0 (off). 5 is also off, but explicitly user-set to be off (opt-out). See https://wiki.mozilla.org/Trusted_Recursive_Resolver

Tsubasachan• 7 years ago

Yeah, a European ISP will always be preferable to ANY US corporation I'm afraid to say.

3xblah4• 7 years ago

Like Vixie said, route and answer 8.8.8.8. He is complaining that he has to do it. He is not saying that there is no solution.

Putting a DNS client in Chrome (I think they removed it but who knows), or Chromecast, or whatever is "evolutionary pressure".

It forces users to evolve the solution to work around it. This is good.

If users are forced to learn to use an RPi for DNS (and we can see they are doing that with Pi-Hole), and eventually another pocket-sized computer with open-source software for routing, that benefits the community of users who want to avoid ads.

If avoiding ads is the goal, then using a pocket-sized computer with a user-installed OS is better than a solution marketed by a commercial third-party, as almost always those third parties rely partially/wholly/directly/indirectly on the ad business.

muppetman10• 7 years ago

I don't understand Vixie. I have a Chromecast Ultra. On my Firewall at all, I reject all requests to 8.8.8.8(and .4.4) with a ICMP unreachable. This forces the CC Ultra to use the DHCP allocated DNS Server (a pihole) which works just fine.

I don't understand why he says you have to route and answer 8.8.8.8. You really don't.

If his point is you can't override the built in DNS without some sort of FW hackery though, then yea his point stands.

_emacsomancer_2• 7 years ago

What is "Firefox 64 for PC"? Does this mean non-mobile Firefox?

sudo-i2• 7 years ago

I have a pfsense box. It's quite arbitrary to block DNS request that are anywhere except to your pfsense box. eg. https://docs.netgate.com/pfsense/en/latest/dns/blocking-dns-...

1over1374• 7 years ago

If I'm not mistaken, that will work only for regular old DNS, not DNS over HTTPS (DoH), which, I presume, uses port 443, not 53.

Seems like blocking Firefox and Chrome from usurping your DNS choices is going to be much harder going forward. :(

toredash• 7 years ago

Could just point to an IP directly as well. That could be blacklisted as well but in today's tech stack it is really easy to change variables so that a block would have a short term effect on the client.

whalesalad• 7 years ago

Can any of the DNS wizards here explain the potential performance implications of using this? I have been meaning to install this and begin using it but the latency of a Cloudflare DNS request is so low (and reliable) that I don't know if I want to risk introducing this into my network stack.

I have an R720 and a few old RPi's... so either major overkill hardware or major weaksauce hardware.

lucb1e3• 7 years ago

DNS wizard checking in. This stuff was designed in the 80s and I ran BIND on the kind of potato that has a quarter of the RAM that a raspberry pi has, together with apache, mysql, php, vnc, utorrent, and some other stuff, and it still performed great. I don't know by heart which dns server pihole uses, but no, the latency added by a server on your LAN is negligible. Case in point, most (all?) routers do dns forwarding by default (is that not common in the USA? Since you mention cloudflare, which got to be slower than the default option unless you have some really cheapo isp).

adzm• 7 years ago

You'd be surprised how slow our ISP's DNS servers can be.

gerdesj• 7 years ago

"and I ran BIND on the kind of potato that has a quarter of the RAM that a raspberry pi has"

256MB RAM? - bloody luxury!

A very quick and a bit rubbish experiment:

  $ ping 9.9.9.9
   5 packets transmitted, 5 received, 0% packet loss, time 10ms
  rtt min/avg/max/mdev = 9.982/10.838/12.531/0.888 ms

  $ dig @9.9.9.9 www.google.com A
   ;; Query time: 13 msec

DNS is pretty quick. Note how I mistakenly use ICMP and a UDP service response time to imply something. If I'd tried to claim that DNS adds about 5ms overhead, I would have been first to put the boot in. The basic result stands though - DNS is quick. The above results are from: my laptop -> wifi -> switch -> switch -> APU2c based pfSense box with quite a lot going on -> modem (FTTC in UK - PPPoE/A) -> ISP .... etc.

xd19362• 7 years ago

They have forked dnsmasq to power their project[1].

1. https://pi-hole.net/2018/02/22/coming-soon-ftldns-pi-holes-o...

mirceal2• 7 years ago

you can configure what dns servers to use for the “upstream”. you can choose between a series of ones included by default (gooogle, etc) or specify your own

skunkworker2• 7 years ago

It's pretty quick. If it's running on your local network it can cache your DNS resolvers of choice and only add a few ms at most. On your network make sure to setup backup DNS resolvers when your pi-hole is updating etc.

Currently I'm running it as a docker image on my local server.

muppetman10• 7 years ago

You should always run a local caching DNS server on your home network if you care about latency etc. That way when your iphone requests apple.com and then your laptop requests it 3 minutes later, the dns query time will be sub millisecond, instead of maybe 5-15ms.

will you notice that? No, you will not. But you seem to be concerned about levels of latecy it's impossible to notice anyway, so you need this to get even more (unnoticeable) decreases in latency :)

Then the pihole just queries 1.1.1.1 for you, so your DNS privacy etc is still kept.

mirceal2• 7 years ago

2 things to consider: 1) any additional latency is on the 1st request and after that the response is cached for the duration if the record’s ttl 2) because it’s blocking all the crap you have more bw

so overall in my experience it actually speeds things up considerably (even in the scenario of an already fast dns resolver)

nikeee• 7 years ago

It's usually pretty quick. Unless the SD card of the Pi breaks randomly. Then, you've suddenly got inexplicable slow/unavailable internet because the Pi may not respond to DNS requests any more.

nonamechicken3• 7 years ago

One question I have is when we block ads and especially analytics/tracking, won't it decrease the battery life of mobile devices? Apps could be written in such a way that if a request gets blocked or dropped, it will keep on retrying which would impact battery life.

LVDOVICVS• 7 years ago

I run it at home and have use the dhcp server, too. All the numerous family PCs, Kindles, phone, etc, use it and it works great. For a family of four with two teen-age kids, it blocks about 20% of the DNS traffic we create.

Love it.

Havoc• 7 years ago

Also comes in docker form for those so inclined. Useful for home servers

forinti2• 7 years ago

As much as I like the Pi, I think a better solution would be to use OpenWRT on a regular router.

tomatocracy• 7 years ago

Although PiHole doesn't need a huge amount of power, it does need seem to need more resources than the average router has, unfortunately - it has components written in PHP, at least if you want the web frontend, and runs some SQlite DBs which might not work well unless your router has some "real" storage attached to it. It's also a pain to get working unless you give it its own local IP address. While it might work, it would be kind of defeating the point of it being "plug and play".

If you have any kind of local server running "proper" Linux (not necessarily a pi) it's pretty easy to run pihole on it though - there's a docker image or you can fire up your favourite other Debian-based VM/container image and install using a shell script.

muppetman10• 7 years ago

Well, I disagree. OpenWRT is great at being a router, let it be that. pihole is great at being an adblocker, let it be that.

I think you're better off to fire up a Docker instance!

https://hub.docker.com/r/pihole/pihole/

But why do you think OpenWRT is better? Because it has a (somewhat clunky and not as feature rich) adblock solution built it?

So does pfSense with pfBlocker-NG which is also another common adblock solution people use.

But for a basic user to just augment their home network with ad-filtering, way better off to just have add a pihole, than to totally replace their router.

forinti2• 7 years ago

Yes, OpenWRT does have an adblock solution. It might not be as shiny as the PiHole but it works. Also, you can buy a decent router for less than you would pay for Pi+Cables+Case+Power Source.

I use a tp-link wr842nd. I even have a Telegram bot on it to interact with it. A Pi would be more powerful, sure, but the router serves my needs.

jedberg4• 7 years ago

Right now I use AdBlock plus. Occasionally, to get a webpage to work, I have to disable it.

How does Pi-hole mitigate this issue for non-expert users? My main concern is that if I set this up at home, my wife will get annoyed when her web pages don't work and won't have the patience to learn how to add to the whitelist.

JauntyHatAngle• 7 years ago

You'd have to show her how to login to the web GUI and temporarily disable it I think, but I wonder if it's the use case.

If you're enabling ad filtering on the DNS level on your router, its more along the lines of forced ad filtering on your entire network, so you're kind of sacrificing user configurability for global ad filtering on your network.

Personally, I've only had the experience of a broken webpage once in two and a half years of using it.

yoklov• 7 years ago

Personally, I've only had the experience of a broken webpage once in two and a half years of using it.

Is there a reason DNS-based filtering is much better than normal ad-blocking in this respect?

bollockitis• 7 years ago

There’s a simple pause button on the web interface. I bookmarked it on my wife's phone and showed her how to disable and she's had no trouble since. At first she was skeptical about the pi-hole but after seeing the difference it made, she's totally on board. We don't need to disable it often though, maybe once every month or two.

jedberg4• 7 years ago

Alright that sounds fairly reasonable. I’ll give it a shot. I’ll probably start by just putting my devices on it and see how it goes.

tw04• 7 years ago

It doesn't. I stopped using it when one of their default lists started blocking Microsoft.com. I get some people don't like Ms, but that kind of default is just plain negligent. Blocking updates silently is never ok in my book.

obituary_latte4• 7 years ago

I have default (and custom) lists and have never had a problem with Microsoft domains. You sure it wasn’t a temporary issue with MS itself?

secondstring• 7 years ago

On a mac, you can set up Network Locations. I have one set up with the pihole dns server, and have the Automatic one set to normal defaults. There's a simple script[0] that will change your Network Location based on the wifi network you connect to, so I don't have to worry about switching it manually when I leave home and I don't have access to the pi as a DNS server.

Granted, none of this answers your question directly, but a manual Network Location switch from System Preferences is a somewhat simple change that's a little less friction than a whitelist. The auto changer should switch it back next time your wife's computer reconnects to the network in case she forgets.

[0] https://github.com/eprev/locationchanger

jukic• 7 years ago

Right now, I've set up my Pi-Hole at home with this curated whitelist: https://github.com/anudeepND/whitelist

I haven't had any issues come from me or anyone in my family using it thus far. Although, there's an active discussion which that whitelist pulls mostly from here: https://discourse.pi-hole.net/t/commonly-whitelisted-domains...

dtparr• 7 years ago

So I did experience this. I eventually just moved my wife's phone over to a static IP/external dns so she didn't have to deal with it. But at least the rest of the network (IoT in particular) had less tracking.

I've unexpectedly nice thing was the Roku screensaver went back to a simple bouncing logo instead of the ad-filled scrolling billboard thing.

nonamechicken3• 7 years ago

I am using pfsense with pfblockerng for ad/tracking protection. My wife spents a good amount of time on a mobile fashion game. In addition to the forced in app purchases once a month, it makes her watch plenty of video ads every day. She has to watch those ads to get virtual currency that can be used to purchase things that is a must for playing the game. With the protection enabled, the ads won't show and she can't play. So I had to whiteliste her mobile in pfblockerng. She still complains that it doesn't work. So she uses mobile data to play the game. I am not sure what else in pfsense is breaking it for her, I haven't looked further into it. One good thing is it helps me save bandwidth. My home internet has 500gb limit after which it drops to 1/10th of the speed. She seems to be using up close to her 1.5gb daily limit almost always, just from this game and facebook. So I get more bandwidth to download stuff!

blablablerg• 7 years ago

Jesus that game sounds like a big trap

giancarlostoro2• 7 years ago

If she has Android she can download DNSfilter or similar and disable it for her game. It's a local DNS / VPN to block ads with it's own local white / blacklist. I rarely see ads on my phone, except from some game apps that I guess use networks not yet on the blacklist, but I'm not bothered by those, I usually play games I can fully own / pay to remove ads.

jeffmk• 7 years ago

Not directly related, but uBlock Origin is a better ad blocker than AdBlock Plus. From what I understand the uBlock Origin uses fewer resources; but more importantly, doesn't take money from advertisers to allow certain ads: https://adblockplus.org/en/about#monetization

It's more trusted nowadays and very easy to switch to.

jedberg4• 7 years ago

I’m actually using ublock origin. I don’t know why I said Adblock plus. :/

zimpenfish• 7 years ago

I had to divert a bunch of devices (Samsung TV, Switch, etc.) around the pi-hole because it was easier than trying to figure out what they needed whitelisting.

obituary_latte4• 7 years ago

A trick for mobile is to just turn off WiFi for a minute to load the page over cellular.

giancarlostoro2• 7 years ago

You know I have to do this all the time, and I don't understand why I have to. It's kind of obnoxious.

xd19362• 7 years ago

I've been running an instance of this on a DigitalOcean VM for a couple of years now. Keeping my instance external is nice so I can use it from home, work, and for friends and family, with all of my devices. Fantastic project, highly recommended.

muppetman10• 7 years ago

How do you stop the general public from finding it and using it? Strict firewall rules?

I have a pihole at home (not a Rasperry Pi, gosh I wish they'd ditch the marrying of the two) but to access it I establish a VPN.

obituary_latte4• 7 years ago

I set up a simple python server that listens on a specific (highly unlikely to be guessed) url and when visited runs a shell script to add the visiting ip to iptables dns whitelist. So I can visit a relatives house, go to that page then add my dns ip to their router (if they want me to). Also helps for when traveling or when isp renews dhcp lease.

thatjeffrin• 7 years ago

Will you share high level steps of how to accomplish this, please? I'm a novice and haven't played with Raspberry Pi, but recently set up a Droplet running Ubuntu on DigitalOcean. Sharing with family intrigues me.

tdurden• 7 years ago

The steps should be the same regardless if running on a Pi or VPS: https://github.com/pi-hole/pi-hole/#one-step-automated-insta...

xythian5• 7 years ago

You might consider adding a VPN tunnel on top of that setup so that your DNS isn't just hanging out in the wild for anyone to find.

hartator• 7 years ago

Does it make sense to make it run on a small virtual server box?

OJFord• 7 years ago

If you're already running one, absolutely.

RPis are popular and the namesake because they're relatively cheap, low power consumption, but powerful enough - so a good choice for people that don't already have some always-on hardware to run it.

gyrgtyn• 7 years ago

Does anyone know any alternative projects (that are still dns based)? I don't need all the web interface parts. I think I just want a good, recent dnsmasq config. If it does new crypto dns stuff, that'd be cool too. I'm not up to date.

BFLpL0QNek• 7 years ago

I use Unbound[1] for DNS caching and local DNS. I have Unbound configured to forward queries to a local Stubby[2] instance that does DNS over TLS to CloudFlare.

Stubby does keep-alives and not restricted to a single thread and opening a new connection per query like Unbound which is why I used it as a forwarder as a few more features than Unbound.

In my Unbound config I have an include to a blocklist generated from https://github.com/StevenBlack/hosts, essentially I pipe the data from that repo through awk [3]

I have an Android TV box so also have a firewall rule to redirect all queries to 8.8.8.8 and 8.8.4.4 port 53 to my local DNS server.

No GUI's, solid and stable. Only thing missing is I need to write a cron job to fetch the latest block list, validate, convert to Unbound format and reload the daemon. It's only a 10 minutes job just something I haven't got round to yet.

OpenBSD is really good for running this stuff.

[1] https://www.nlnetlabs.nl/projects/unbound/about/ [2] https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Daemon+-+... [3] https://deadc0de.re/articles/unbound-blocking-ads.html

hyperdunc• 7 years ago

I run dnscrypt-proxy on a Pi on my LAN. It's set to pick a random resolver from a preset list and then it encrypts and forwards incoming requests to this resolver. Naturally, my DHCP server dishes out the IP address of the Pi to my devices.

I also use the DNS66 app on Android devices to set my DNS and block ads when I'm using a mobile network.

ryandrake• 7 years ago

I simply use plain old dnsmasq running on my router device. Configure DHCP to hand out my gateway IP as the LAN's DNS server. Then configure dnsmasq to point it to the block list:

  address=/0.0.0.0/0.0.0.0
  addn-hosts=/path/to/dns_blocklist

Then, once a week, cron updates the block lists, invoking something like:

  wget -qO- "http://winhelp2002.mvps.org/hosts.txt" "http://someonewhocares.org/hosts/zero/hosts" "http://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&showintro=0&startdate[day]=&startdate[month]=&startdate[year]=&mimetype=plaintext&useip=0.0.0.0" | grep -w ^0.0.0.0 | sed $'s/\r$//' | sort -u >> /path/to/dns_blocklist

You can pick your favorite blocklists to be more or less aggressive, and you also don't have to update directly from the Internet if you don't inherently trust those blocklist sources. No web UI or Pi-Hole branding. Been working great for years and years.

undersuit2• 7 years ago

Before PI-hole I would download Privoxy to my router. One of the features I really like was that you set it up to default to blocking everything network-wide and have a local proxy you could set up to remove blocking.

https://openwrt.org/docs/guide-user/services/proxy/privoxy http://www.privoxy.org

chewz• 7 years ago

dnscrypt-proxy on VPS with some blocklists updated twice a day. Nginx+letsencrypt for providing dns-over-http and dns-over-tls (so I can use my own DNS on mobile). And few iptables rules.

Setting this up takes half an hour.

Additionally I am also running strongswan for VPN on the same server.

I am paying 10$ per year for VPS.

vlg2• 7 years ago

How is it any better or more efficient than host blocking à la [1], if at all? I'm a brainlet, use baby language if you're going to explain.

[1] http://winhelp2002.mvps.org/hosts.htm

zrobotics• 7 years ago

One (big) reason: it works over the entire network. Sure, I used a hosts file on my desktop, but setting it up and keeping it synced across multiple laptops & phones is a PITA. Plus, this is effectively the only method for something like a smart TV.

elcomet• 7 years ago

Blocking with host files requires you to create the file on every device. You don't even have access on some device (smartphone, TVs..)

DNS blocking is configured once for your whole network.

muppetman10• 7 years ago

It's network wide. Anyone joining your network and being given the PiHole as its DNS server means it gets the ad blocking benefits.

It also updates the hosts files itself on a regular basis, you don't have to remember to do it as a manual task.

It gives you a nice webgui to show you what devices are accessing what hosts, how often they try to access them (at least, how often they request their DNS name) and has different modes of blocking (vs a hosts file has to return 127.0.0.1)

vlg2• 7 years ago

So, it's 1) automatic; 2) for an entire network. No more ads getting burned on your toast in your network-enabled toaster, I guess.

m0zg2• 7 years ago

If any contributors are reading this: please consider adding separate blocklists per IP range. The use case is very simple: adults in the house get to see things kids don't get to see (and get their Youtube and games shut off if homework is not done), yet ads and tracking are still blocked for everybody.

xythian5• 7 years ago

This will almost certainly never get implemented because the community has a more or less accepted workaround. Run more than 1 pi-hole.

It's a common-ish practice in the community to have a restrictive pi-hole running in your guest/kids network and a more permissive pi-hole running in the trusted/adults network. Pi-holes require so few resources and maintenance that it's not much burden to run more than one.

It would be a pretty large feature to support separate blocklists per IP range.

m0zg2• 7 years ago

That's what I do, but it's a maintenance burden to run several instances. I run three PiHole VMs: one for parents (banning ads only), one for little kids (banning ads and mature content), and one for teenagers (banning ads and temporarily banning "time drain" sites until homework is done). I'd like to further customize the one for teenagers based on whether or not they have missing homework in school, but not quite to the level of spinning up (and maintaining) yet another instance.

muppetman10• 7 years ago

If you want to test pihole you can just run it in a docker container to see what it's like. You don't need to buy a Raspberry Pi!

https://hub.docker.com/r/pihole/pihole/

kissgyorgy• 7 years ago

I'm running the Docker image for my home network, it is really convenient.

mawaldne• 7 years ago

I love this project. I also donated to it. I've been using it now for about 6 months and it blocks about 15% of my traffic.

luckylittle• 7 years ago

Me too, i've been using it in combination with CloudFlareD (DNS over HTTPS daemon) and it works like a charm. Except when my ISP changes my public IP and CloudFlareD hangs so i have to restart the service. There is a bug for it, but the Pi-Hole itself works really well.

nfRfqX5n• 7 years ago

does it work on a gigabit network yet?

xythian5• 7 years ago

Yes. I haven't run it personally, but I've seen lots of positive stories over on /r/pihole with people running pi-hole on reasonably sized SMB and EDU networks.

tombrossman• 7 years ago

Yes, easily. What problem did you have using it on a gigabit network?

I'm using it for two years now on my gigabit FTTH connection, running in a LXC container on my router. No problems to report.

RyanShook• 7 years ago

What makes this better than Adguard DNS?

zelon88• 7 years ago

I setup a Pi hole about 6 months ago and I love it. It has never caused me grief and it has never gone down.

One of my favorite parts is being able to show people who come over to visit all the queries their cell phones make to ad networks while we're just carrying on a typical conversation.

veb• 7 years ago

A friend and I just launched an MVP a couple of weeks ago so people in New Zealand (and kiwis abroad) could have a VPN with PiHole hosted here in NZ: https://expatvpn.co.nz - however from the early users it seems everyone's just been using it for their phone mainly. I'm thinking I might rebrand it to be more for secure mobile browsing or something...

Down_n_Out3• 7 years ago

I use it also on my iPhone with WireGuard VPN, it's super easy with the app from WireGuard and it's blazingly fast, so I can definitely recommend this. Would be interested to know how you'd approach this and provide some insights if needed.

kgwxd2• 7 years ago

I bought a Raspberry Pi specifically for this, then I realized the obvious, it's useless outside of the house :) It was good for the old Wi-Fi-only iPad the little one was using, but pointless for my needs. I like having the Pi to play with though.

xythian5• 7 years ago

Setup a VPN tunnel for your DNS traffic and benefit from your Pi-hole wherever you go. I use Tasker on Android to automatically detect when I'm not on home wifi and then trigger OpenVPN to connect to my home VPN for Pihole and local network access.

kgwxd2• 7 years ago

On my phone I use Firefox and uBlock Origin and I don't install ad funded apps, or any closed source apps I'm not forced to have, so I haven't really felt the need to go that route. The only ad supported app my kids use on their devices is YouTube but, last I checked, Pi-Hole isn't able to block those ads.

kang• 7 years ago

How pi-hole works and what is FTLDNS, if anyone is interested: https://pi-hole.net/2018/06/09/ftldns-and-unbound-combined-f...

otter-in-a-suit• 7 years ago

pi-hole is amazing. It blocks ~20% of my network traffic, based on ~1M domains.

I'm still amazed that they recommend piping curl to bash though...

waltwalther2• 7 years ago

I have been running a pi-hole server in my home for almost a year now, and I love it. We usually have around 30 devices (including IoT devices), and have never had any issues. Adding/removing sites, disabling (when necessary), updating...its all there and very easy to operate. The logs are just ok, and the blacklist/whitelist is handy.

It was quick and easy to setup on an existing Ubuntu server install.

nvr219• 7 years ago

All the issues I've had were related to the DHCP server that ships with pihole. Once I replaced that with a different DHCP server - smooth sailing.

waltwalther2• 7 years ago

ahhhhhh...ok. I have never used pi-hole for DHCP. I already had some static routes and firewall rules setup when I added the pi-hole. So I left the builtin DHCP server disabled.

undersuit2• 7 years ago

I have a Pi-hole running on a Raspberry Pi Zero. The Pi is connected to my home router using the USB Ethernet gadget features. The home router handles local DNS requests from those forwarded by Pi-hole, but the rest of my DNS just flows through the Pi.

It's pretty nice. Never had an issue with the router's DNS, but OpenWRT also doesn't have the ease of Pi-hole.

tjpnz• 7 years ago

I tried this out over a weekend but decided to abandon it due to some of the sites I frequent being blocked. Whitelisting isn't a viable solution here as I would then need to teach my girlfriend how to do it and any family members who decide to visit.

tehlike5• 7 years ago

keeping your own devices on pi-hole and using google dns by default could work.

bdorn• 7 years ago

this. it's a cool concept, but not good for roommates.

KeepFlying• 7 years ago

PiHole has the option to have blackholed domains show a "This was blocked by PiHole, click here to whitelist this domain". It doesnt work perfectly (ex. Hulu just craps out for me with PiHole because of some domain under the hood being blocked), but it is something.

And for guests you can disable PiHole for any time period with a click of the button on its web page.

Or kick your guests/roomates/gf onto a different subnet.

That said though, it is clearly not perfect and could use some work and TLC to take care of. But in case you (or the nest person reading this) wanted some ideas, I thought I'd offer.

cweiss• 7 years ago

There are other blocklists you can use besides the default. Some quick googling turned up half a dozen that folks like. Some more restrictive, some less.

Down_n_Out3• 7 years ago

I recently talked about Pi-Hole in another thread[0]: I'm using Wireguard in combination with Pi-Hole on a cheap VPS as a VPN on my iPhone, it's blazingly fast and super stable. Will be trying this on my Mac as well now. I only allow access to the console from a fixed IP-address to add whitelists when needed. Everything loads much faster, websites, even apps I feel, though it might just be wishful thinking that last one.

[0] https://news.ycombinator.com/item?id=19186795

Jemm2• 7 years ago

What VPS and how much is it costing you?

Down_n_Out3• 7 years ago

About 3 Euro per month using a CX11 over at Hetzner[0]

[0]https://www.hetzner.com/cloud

bluegreyred• 7 years ago

I tried this with OpenVPN a while back and it was a spectacular failure because keeping the tunnel open also kept the cellular connection active and that sent battery consumption through the roof. I'm talking about 8-10 hours "standby" time on a modern iPhone. Is that not a problem with your setup?

I looked into on-demand but is required a mdm profile and that seemed more trouble than it's worth.

fastbmk3• 7 years ago

What if it is a scam to get the free content of the site without watching its ads?

fastbmk3• 7 years ago

Are there any technologies that can reinforce ads on a site?

I know a site owner can track visitors with ad-blockers and show them warnings, but that is not it.

fastbmk3• 7 years ago

Here is a Unicorn idea for a successful startup!

Develop a technology that protects ad-supported web sites from ad-blocking scammers ;)

tomcatfish• 7 years ago

There are a lot of people, myself included, who just want to be able to use websites. I am trying to avoid two major things when I block advertisements online:

1. Dangerous ads - Cryptominers, viruses/whatever, and the like.

2. Wasteful resource usage - I also block most scripts and unneeded fonts because the value to me of downloading all these add-ons is very low compared to the cost to me through network congestion and possible vulnerabilities.

I pay to support content creators I get value from, and if more creators followed a reasonable, proportional, fee I would support more.

a_imho• 7 years ago

Also consider obfuscation like AdNauseam.

dbg31415• 7 years ago

https://raw.githubusercontent.com/StevenBlack/hosts/master/h... works well too.

tehlike5• 7 years ago

How many of you would pay for a paid adblocker? Where the funds go to content owners?

gdfasfklshg46• 7 years ago

How do you do this without tracking us?

tehlike5• 7 years ago

A client/extension that you can build yourself, that can report the time you use an app. Sadly, you need to reveal some data. But most can stay on device.

All that is needed is really total hour each app is jsed and calculate the ratio.

This assumes equal weights for apps, but can be changed.

You can create bundles for different content types like news vs games as price tiers.

laputan_machine• 7 years ago

Like Brave? https://brave.com/

tehlike5• 7 years ago

Ish. Not exactly.

dandare• 7 years ago

Is there an option to buy a raspberry pi with this pre-installed? Asking for a non-technical friend.

sabas_ge• 7 years ago

A user linked in this thread the shop https://pi-hole.net/shop/

IanSanders• 7 years ago

My concern is that this kind of solutions, while neat, may push advertisers to start requiring content owners to host the advertisement content and/or directly communicate with advertiser api. In other words, Pi-Hole will only work while not terribly popular.

darkarmani• 7 years ago

may push advertisers to start requiring content owners to host the advertisement content

Good luck with that. There is a reason they want you to load directly from their ad-network. It's the surest way they have to accurately track valid clicks.

scoutt2• 7 years ago

Forgive my ignorance on the matter, but:

1) Are the DNS request sent to oblivion or a fake address is returned instead? If the former, wouldn't a failed DNS request generate some sort of timeout?

2) Would a failed DNS request generate multiple retries to load a resource that is not available? (I can imagine this for application other than browsers).

3) How long until pages with ads will start solving addresses through some sort of script? Like in the section of the page responsible for showing an ad, manually crafting and sending a DNS request to 8.8.8.8 or whatever.

edit: for clarity

ownagefool2• 7 years ago

It runs a local DNS server and a local http host.

You make a DNS query to badsite.com, your local DNS responds with your local http host and you load a pixel image instead of whatever it should have been.

vSanjo2• 7 years ago

So in that regard, what does a page look like with Pi-Hole running? As 'aesthetic' as uBlock? Or does it still show the ad's dimensions - just not the ad?

runeb• 7 years ago

I set this up on an RPi last weekend and this is not how it works for me. Trying to resolve blacklisted domains from any network device resolves to 0.0.0.0

HugoDaniel• 7 years ago

The pages you use the most serve some ads from their own domain. E.g. Youtube et. al.

Also beware as most ads in your phone apps come from ad intermediaries that are either dynamic or constantly change.

Pi-Hole is a cool project but please take in consideration those two when using it. We are far from the 90's in ad-tech.

vSanjo2• 7 years ago

This isn't my area so I'm going off cobbled together knowledge.

Surely Youtube being the size it is has a few Github issues against it saying 'I can't load images because I block the ads'?

I guess what I'm saying is, what is the negative impact of your first point? That some content you want won't come through because the content you don't comes from the same domain?

close04• 7 years ago

As far as I can tell the default blocking method in current builds is NXDOMAIN. You can read the details directly from the PiHole official page [0]. Short version, it just returns a no such domain.

More info on blocking modes [1]. This says the default (and recommended) blocking mode is NULL but it wasn't the case when I recently did my last install. Not sure if it was something with my build or maybe the docs need to be updated.

You will find that failing to access the resource on the other side will make many clients try and try again. On my PiHole I see Philips Hue, Microsoft, or Sonos with tens of thousands of retries triggered by previous failures to contact their destinations.

[0] https://pi-hole.net/2018/05/18/nxdomain-and-null-blocking-wi...

[1] https://docs.pi-hole.net/ftldns/blockingmode/

scoutt2• 7 years ago

Clear and concise. Thank you very much.

moltar• 7 years ago

Great project, but unfortunately doesn’t block YouTube ads.

buro9• 7 years ago

I am starting to be concerned that the ability to use DNS to block tracking, malware, and advertisements is only going to prove temporary.

There appears to be more effort generally to secure and encrypt the entire DNS system. This is really good and should be applauded and supported. But it will come with a downside... once we reach a future in which DNS records are encrypted end to end, and DNS records are only valid when signed by certain keys, and authenticated NXDOMAIN records... then things like Pi-Hole start to become more difficult as for security of DNS we'll have lost the convenience of changing the answers.

TheLilHipster• 7 years ago

There would be a market for a DNS provider to provide a PKEY setup for the user to blacklist ad domains or whatnot similar to what the pi-hole does.

There is always a technical solution, that's the beauty of it :)

systemtest• 7 years ago

I use Windscribe VPN. In the online settings menu you can alter the DNS to block Malware & Phishing, Ads & Trackers and even Social Networks.

vasili111• 7 years ago

What is the advantages of using pi-hole vs uBlock origin?

Jemm2• 7 years ago

You can’t use unblock origin on iOS

LocalPCGuy• 7 years ago

pi-hole covers all of the machines on your network, not just the browser. That said, I didn't uninstall uBlock Origin. They can be complimentary.

Pi-Hole – A black hole for Internet advertisements

Related Stories