I’ve been aware of pi-hole for a while now, but never bothered with it because I do most web browsing on a laptop where browser extensions like uBlock origin are good enough. However, with multiple streaming services starting to insert adds into my paid subscriptions, I’m looking to upgrade to a network blocker that will also cover the apps on my smart TV.
I run most of my self hosted services on a proxmox server, so I’d like something that’ll run as an LXC container or a VM. I’m also vaguely aware that various competing applications have come out since pi-hole first gained popularity. Is pi-hole still the best thing going, or are there better options?
I felt the same way about youtube, streaming, shopping and general browsing: too many ads. Ruins the content. I set up a pi-hole as an experiment to see if it would do what it said and what others said about it. Manage your expectations here. Pi-hole works well for blocking a lot of static information and ads in your browser and a lot of apps on iOS and Android. It does not block video ads on Youtube or Hulu, it does not block ads for Roku or Firestick or Smart TV apps for example, it just does not work because of the technical limitations of how the PiHole software is designed. Using a regular PC with adblock browser extension installed as well gets rid of 99% of ads including video ads from adcdns.
PiHole is incredibly easy to setup and install, the pay off in quality of life is enormous. I cannot recommend it more to someone that has a little networking knowledge base. If you can figure out how to port forward and run a handful of command lines you can complete a pihole setup in an hour.
Sorry, you wouldnt and didnt mean to imply that. I was suggesting that port forwarding is a fairly easy task and if one is confident in their ability to do that, than they should be able to complete a PiHole install.
I actually had a lot of fun a couple years ago deploying PiHole on one of my RaspberryPi’s and routing all my household machines through it. It worked great UNTIL… my kid was turning in empty homework on Google Classroom and his teachers were getting up him about it. We chastised him thinking it was his fault until I finally discovered that Pihole was messing up his uploads to GC and literally causing this problem. I got super angry with it and walked away without even trying to troubleshoot. Had to profusely apologise not only to his teachers but to him.
If someone really wants this service but do not want to (or cannot) host it themself, https://ovpn.com offer this in their client. I used to have a pi-hole selfhosted but not anymore. Using their client on my phone as well solved the problem with blocking ads while not at home.
Pi-Hole’s great. Got my primary instance on a Pi 4 and three secondaries (one per vlan) on LXCs. Works so well it feels weird seeing ads when I’m not at home, I’m actually considering using Tailscale to route all my queries through my home connection.
Hint: you don’t need to route all your traffic through your VPN to make use of the pihole adblocking: Just DNS. If your at home internet is even moderately stable/good then this should barely affect your roaming internet experience, since DNS traffic is such a small part of all traffic.
Also, since I’m already mirroring the configuration of my PiHole instance to a secondary one, I’m considering putting a tertiary one on some forever-free cloud server instance and just using that when not at home (put it into the same wireguard vpn to prevent security nightmares). That way my roaming private DNS wouldn’t even depend on my home internet.
I do this and it works great. Ad block on all my devices regardless of proprietary sandboxes. I also use Syncthing over my tailnet IP addresses so that traffic never leaves my “grounds”. I’m slowly building out a whole suite of services I host only within my tailnet, jellyfin, calibre, invidious, it been a great learning experience. I’m about to set up a proper home lab, finally moving everything off an old laptop.
I run pihole on proxomox, and also opnsense in the same box. Then you can forward all port 53 traffic to your pihole. Some devices have hard-coded DNS that will bypass the DHCP DNS.
Lol - not my first rodeo. I’m blocking dns.google as well, and I’m 99.999% certain Google won’t have coded Chromecasts to use anyone else’s DNS servers.
Ha! This is my new way of looking at my smart devices. I’ll sell you off if you don’t do what I want, and buy something that does. Very much a threat.
I recently factory reset all my Roku TVs, and didn’t connect them to the internet… and they work much better now.
Roku broke big time when I insisted on privacy. blocked the entire Roku domain, it broke the apps on a 1-month schedule like clockwork to get the network release for reinstall which allowed for phone home. lol no. I trashed it. They are dumb TVs now.
I ran Pi-hole for years. Switched to adguardhome running on 2 servers (primary and secondary) with AGH sync keeping the two instances identical. I like the UI better, dns rewrites, and the ability to simply block services entirely with a single click.
I did this as well, I still have 2 pihole instances running with gravitysync for now, but AGH sync is much easier to setup and maintain. My 2 pihole instances are running for my guest network only and AGH is running everything else.
I set up pihole a few months ago. I added a few dozen of the highest recommended block lists, but I wasn’t impressed at all. It didn’t seem very effective at blocking ads in both real world tests and tests that I found online specifically for testing your adblocker.
The best test I have is my wife complaining, that ads in Google results cannot be opened. It seems to work flawlessly for me 😂
On a more serious note, what tests are these? The thing is, the ad domain is either in the blocklist or not. Ads inside apps are hard to block (I even have adaway on my android, and some slip through as eg Instagram reuses the backend domains/endpoints for ad delivery).
I got the wife complaining about the google results being blocked, but very little else. Most sites are still Frankenstein’s monsters full of atrocious ads.
I went with a pi running pi-hole. I got it as a project where the tool is the project. But, it’s essential infrastructure now and I don’t want to mess with it incase I break it. I’m an idiot with a poor history with pi guides so far, so I will break it. It’s running the adblock fine, I assume it’s doing the tracking and malware blocking fine too.
Sadly, that’s where I leave the project for now, I had intended to give it a HDD and some… other… software but I really don’t want to break it. I tried convincing the better half that I obviously need to N+1 but she wisely did not see reason.
If you want to try setting it up in high availability with failover, give me a poke. And until then - go to Teleporter in the settings, and download the backup. You can restore from there.
One thing worth saying is this - you can grab a cheap refurbished ssd (the smaller - the better), check it’s SMART data for any red flags, and attach it to the pi as OS disk. It will be much more reliable than SD, but overkill if you only run pi on the box.
Alternatively look into log2ram, it keeps your SD card alive for longer :D but backup first!
Thanks. I already have Log2Ram running to prolong the life of the SD. My planned disaster relief is a spare SD, already set up and taped to the box ready to swap and reboot in case of emergency. SD cards are cheap so chucking <£10 at the setup once in a while is no big thing. A fresh install on the new SD allows me to improve on what I’ve already done, for example the new SD I’ll run DietOS instead of Raspbian, and reinforce skills. Less time efficient but that’s no matter when the box is working and it’s a hobby. I can then keep the old SD card taped inside the case as a physical back up. Perhaps more expensive in the long run, but an SD card taped to the inside of the case with simple instructions is an easy sell to the fiancée.
My experience with guides has shaken my confidence quite a bit. Which is fine, I’ll get over myself and the point is to learn, so me hitting snags is a good thing. But, until I have a functioning back up I’m not going to be fucking with it. Facebook cannot go down on account of my education.
But if I may, I have one question, a bunch of recommendations have the setup “segregated” (I dunno the word) in Docker and Portainers but I don’t understand the rationale. I wasn’t intending on doing this, instead opting to install Pi-hole, Log2Ram, UFW, and the… other… softwares directly to the OS for simplicity. Why would one set up a Pi-hole et al in a containers instead of directly?
My current set up is Raspbian OS running Pi-hole as ad, tracker, malware block and DHCP (the ISP router is a Sky2 box so no IP or DNS customisation), Log2Ram and UncomplicatedFireWall.
I wasn’t intending on doing this, instead opting to install Pi-hole, Log2Ram, UFW, and the… other… softwares directly to the OS for simplicity. Why would one set up a Pi-hole et al in a containers instead of directly?
So there are many reasons, and this is something I nowadays almost always do. But keep in mind that some of us have used Docker for our applications at work for over half a decade now. Some of these points might be relevant to you, others might seem or be unimportant.
The first and most important thing you gain is a declarative way to describe the environment (OS, dependencies, environment variables, configuration).
Then there is the packaging format. Containers are a way to package an application with its dependencies, and distribute it easily through the docker hub (or other registries). Redeploying is a matter of running a script and specifying the image and the tag (never use latest) of the image. You will never ask yourself again “What did I need to do to install this again? Run some random install.sh script off a github URL?”.
Networking with docker is a bit hit and miss, but the big thing about it is that you can have whatever software running on any port inside the container, and expose it on another port on the host. Eg two apps run on port :8080 natively, and one of them will fail to start due to the port being taken. You can keep them running on their preferred ports, but expose one on 18080 and another on 19080 instead.
You keep your host simple and empty of installed software and packages. Less of a problem with apps that come packaged as native executables, but there are languages out there which will require you to install a runtime to be able to start the app. Think .NET, Java but there is also Python out there which requires you to install it on the host and have the versions be compatible (there are virtual environments for that but im going into too much detail already).
Basically I have a very simple host setup with only a few packages installed. Then I would remotely configure and start up my containers, expose ports etc. And I can cleanly define where my configuration is, back up only that particular folder for example and keep the rest of the setup easy to redeploy.
I have nothing to add, and an upvote isn’t enough. Truly, thank you for your time, there’s a lot to think about.
I think for this initial iteration I’m going to direct install in the name of keeping it simple. Next go around I’ll try containerising, just to learn if nothing else. If I out-grow the Pi4 they’ll be good skills to have.
It works well! I have one AdGuardHome instance running on my home server and one running on a Raspberry Pi, both using Docker. Having two prevents the internet from breaking in case I have to shut down one of them for some reason.
Just wanted to chime in and say that with a pihole you can also have encryption if you point to a local resolver like cloudflared or unbound.
My pihole forwards everything to a cloudflared service running on 127.0.0.1:5353 to encrypt all my outgoing DNS queries, it was really easy to setup: https://docs.pi-hole.net/guides/dns/cloudflared/
That’s a bunch of extra manual work though - both the initial setup, plus keeping the extra software packages up-to-date. With AdGuard Home, it’s already configured to use DoH by default.
Not within the network, but translating regular dns to DoH before heading out to WAN keeps your browsing a little bit more private from your isp. Marginal, but it is a difference.
It’s not just a little bit more private… It’s a lot more private. Some ISPs have been known to build advertising profiles using DNS data. It’s trivial for them to see all DNS lookups and even modify the responses, since it’s both unencrypted and unauthenticated by default.
As an AdGuard home user for more than a few years, I switched back to Pihole because it wasn’t really any better. It was also easier to pair pihole with Unbound.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
selfh.st Newsletter and index of selfhosted software and apps
I felt the same way about youtube, streaming, shopping and general browsing: too many ads. Ruins the content. I set up a pi-hole as an experiment to see if it would do what it said and what others said about it. Manage your expectations here. Pi-hole works well for blocking a lot of static information and ads in your browser and a lot of apps on iOS and Android. It does not block video ads on Youtube or Hulu, it does not block ads for Roku or Firestick or Smart TV apps for example, it just does not work because of the technical limitations of how the PiHole software is designed. Using a regular PC with adblock browser extension installed as well gets rid of 99% of ads including video ads from adcdns. PiHole is incredibly easy to setup and install, the pay off in quality of life is enormous. I cannot recommend it more to someone that has a little networking knowledge base. If you can figure out how to port forward and run a handful of command lines you can complete a pihole setup in an hour.
Why would you want to port forward your dns?
Sorry, you wouldnt and didnt mean to imply that. I was suggesting that port forwarding is a fairly easy task and if one is confident in their ability to do that, than they should be able to complete a PiHole install.
deleted by creator
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
7 acronyms in this thread; the most compressed thread commented on today has 5 acronyms.
[Thread #431 for this sub, first seen 15th Jan 2024, 23:55] [FAQ] [Full list] [Contact] [Source code]
I actually had a lot of fun a couple years ago deploying PiHole on one of my RaspberryPi’s and routing all my household machines through it. It worked great UNTIL… my kid was turning in empty homework on Google Classroom and his teachers were getting up him about it. We chastised him thinking it was his fault until I finally discovered that Pihole was messing up his uploads to GC and literally causing this problem. I got super angry with it and walked away without even trying to troubleshoot. Had to profusely apologise not only to his teachers but to him.
I love pihole, for my family it is better as it helps on all the devices. Being able to block malware and tracking is nice too
If someone really wants this service but do not want to (or cannot) host it themself, https://ovpn.com offer this in their client. I used to have a pi-hole selfhosted but not anymore. Using their client on my phone as well solved the problem with blocking ads while not at home.
Pi-Hole’s great. Got my primary instance on a Pi 4 and three secondaries (one per vlan) on LXCs. Works so well it feels weird seeing ads when I’m not at home, I’m actually considering using Tailscale to route all my queries through my home connection.
Hint: you don’t need to route all your traffic through your VPN to make use of the pihole adblocking: Just DNS. If your at home internet is even moderately stable/good then this should barely affect your roaming internet experience, since DNS traffic is such a small part of all traffic.
Also, since I’m already mirroring the configuration of my PiHole instance to a secondary one, I’m considering putting a tertiary one on some forever-free cloud server instance and just using that when not at home (put it into the same wireguard vpn to prevent security nightmares). That way my roaming private DNS wouldn’t even depend on my home internet.
I second that, turns out 90% of the queries on my network come from my Libratone speakers and they seem to desperately try and reach China (.com.cn)
I do this and it works great. Ad block on all my devices regardless of proprietary sandboxes. I also use Syncthing over my tailnet IP addresses so that traffic never leaves my “grounds”. I’m slowly building out a whole suite of services I host only within my tailnet, jellyfin, calibre, invidious, it been a great learning experience. I’m about to set up a proper home lab, finally moving everything off an old laptop.
I use knot-resolver with the big block list from https://oisd.nl/ and it works great.
I run pihole on proxomox, and also opnsense in the same box. Then you can forward all port 53 traffic to your pihole. Some devices have hard-coded DNS that will bypass the DHCP DNS.
Some chromecasts stop working when you do that.
Really? I run several Chromecasts, and I block their access to all DNS services except my internal Pi-holes. They work just fine.
Yeah, I don’t know if it’s all models, but the ultras do at least.
https://www.reddit.com/r/Chromecast/comments/pmt4cw/chromecast_ultra_just_updated_and_now_wont_work/
Ah - I only have the Chromecast GTVs. Good to know I don’t need to pay for an upgrade then!
It’s probably not blocking DNS-over-HTTPS
Lol - not my first rodeo. I’m blocking dns.google as well, and I’m 99.999% certain Google won’t have coded Chromecasts to use anyone else’s DNS servers.
Chuck 'em in the garbage and get something that doesn’t break when you insist on privacy.
Ha! This is my new way of looking at my smart devices. I’ll sell you off if you don’t do what I want, and buy something that does. Very much a threat.
I recently factory reset all my Roku TVs, and didn’t connect them to the internet… and they work much better now.
Roku broke big time when I insisted on privacy. blocked the entire Roku domain, it broke the apps on a 1-month schedule like clockwork to get the network release for reinstall which allowed for phone home. lol no. I trashed it. They are dumb TVs now.
I’ve done the same! It’s impossible to buy dumb TVs nowadays, but you can always prevent them from connecting to the network.
I ran Pi-hole for years. Switched to adguardhome running on 2 servers (primary and secondary) with AGH sync keeping the two instances identical. I like the UI better, dns rewrites, and the ability to simply block services entirely with a single click.
I did this as well, I still have 2 pihole instances running with gravitysync for now, but AGH sync is much easier to setup and maintain. My 2 pihole instances are running for my guest network only and AGH is running everything else.
I set up pihole a few months ago. I added a few dozen of the highest recommended block lists, but I wasn’t impressed at all. It didn’t seem very effective at blocking ads in both real world tests and tests that I found online specifically for testing your adblocker.
The best test I have is my wife complaining, that ads in Google results cannot be opened. It seems to work flawlessly for me 😂
On a more serious note, what tests are these? The thing is, the ad domain is either in the blocklist or not. Ads inside apps are hard to block (I even have adaway on my android, and some slip through as eg Instagram reuses the backend domains/endpoints for ad delivery).
I got the wife complaining about the google results being blocked, but very little else. Most sites are still Frankenstein’s monsters full of atrocious ads.
This is one of the ones I used
I have a pihole setup and did not get any ads when testing there. I think you might want to add more lists to your pihole.
What lists do you have? They pretty much all came up for me. I tried it again with ublock origin to compare, but none showed up with ublock origin.
https://firebog.net/
Thank you! I’ll give this another try this weekend!
One thing I’ve found is it’s good at blocking ads via mobile gaming. The downside is if those ads return rewards in-game.
It takes a little experimentation to get it right, but you can find out which urls are involved with your game’s ads and whitelist them
I went with a pi running pi-hole. I got it as a project where the tool is the project. But, it’s essential infrastructure now and I don’t want to mess with it incase I break it. I’m an idiot with a poor history with pi guides so far, so I will break it. It’s running the adblock fine, I assume it’s doing the tracking and malware blocking fine too.
Sadly, that’s where I leave the project for now, I had intended to give it a HDD and some… other… software but I really don’t want to break it. I tried convincing the better half that I obviously need to N+1 but she wisely did not see reason.
If you want to try setting it up in high availability with failover, give me a poke. And until then - go to Teleporter in the settings, and download the backup. You can restore from there.
One thing worth saying is this - you can grab a cheap refurbished ssd (the smaller - the better), check it’s SMART data for any red flags, and attach it to the pi as OS disk. It will be much more reliable than SD, but overkill if you only run pi on the box. Alternatively look into log2ram, it keeps your SD card alive for longer :D but backup first!
Thanks. I already have Log2Ram running to prolong the life of the SD. My planned disaster relief is a spare SD, already set up and taped to the box ready to swap and reboot in case of emergency. SD cards are cheap so chucking <£10 at the setup once in a while is no big thing. A fresh install on the new SD allows me to improve on what I’ve already done, for example the new SD I’ll run DietOS instead of Raspbian, and reinforce skills. Less time efficient but that’s no matter when the box is working and it’s a hobby. I can then keep the old SD card taped inside the case as a physical back up. Perhaps more expensive in the long run, but an SD card taped to the inside of the case with simple instructions is an easy sell to the fiancée.
My experience with guides has shaken my confidence quite a bit. Which is fine, I’ll get over myself and the point is to learn, so me hitting snags is a good thing. But, until I have a functioning back up I’m not going to be fucking with it. Facebook cannot go down on account of my education.
But if I may, I have one question, a bunch of recommendations have the setup “segregated” (I dunno the word) in Docker and Portainers but I don’t understand the rationale. I wasn’t intending on doing this, instead opting to install Pi-hole, Log2Ram, UFW, and the… other… softwares directly to the OS for simplicity. Why would one set up a Pi-hole et al in a containers instead of directly?
My current set up is Raspbian OS running Pi-hole as ad, tracker, malware block and DHCP (the ISP router is a Sky2 box so no IP or DNS customisation), Log2Ram and UncomplicatedFireWall.
So there are many reasons, and this is something I nowadays almost always do. But keep in mind that some of us have used Docker for our applications at work for over half a decade now. Some of these points might be relevant to you, others might seem or be unimportant.
Basically I have a very simple host setup with only a few packages installed. Then I would remotely configure and start up my containers, expose ports etc. And I can cleanly define where my configuration is, back up only that particular folder for example and keep the rest of the setup easy to redeploy.
I have nothing to add, and an upvote isn’t enough. Truly, thank you for your time, there’s a lot to think about.
I think for this initial iteration I’m going to direct install in the name of keeping it simple. Next go around I’ll try containerising, just to learn if nothing else. If I out-grow the Pi4 they’ll be good skills to have.
deleted by creator
Adguard-home is way better than pi-hole imo
Plus it’s easy to run multiple AdGuard Home servers and keep them in sync using https://github.com/bakito/adguardhome-sync
Oh, oh, oh, gimme that!!
First time i hear about something like that, i’m going to install it asap
It works well! I have one AdGuardHome instance running on my home server and one running on a Raspberry Pi, both using Docker. Having two prevents the internet from breaking in case I have to shut down one of them for some reason.
Pihole user for more than 5 years,.can confirm that it is indeed better, made the switch few months ago
What makes adguard home better than pihole? Genuinely curious, I’m running pihole now and have been for a couple of years without issues.
Replied here https://sh.itjust.works/comment/7637726
What makes it better other than the UI? I’m weary of using it because it is developed by Russian developers.
Encryption, UI, probably a little bit more serious development
But encryption is a big thing, DoT, DoH, Quic. And soon they will have ECH
Just wanted to chime in and say that with a pihole you can also have encryption if you point to a local resolver like
cloudflaredorunbound.My pihole forwards everything to a
cloudflaredservice running on 127.0.0.1:5353 to encrypt all my outgoing DNS queries, it was really easy to setup: https://docs.pi-hole.net/guides/dns/cloudflared/That’s a bunch of extra manual work though - both the initial setup, plus keeping the extra software packages up-to-date. With AdGuard Home, it’s already configured to use DoH by default.
Hold on, this is not the same encryption
The encryption i was talking about is the encryption of your dns server
The article you sent is talking about upstream dns server encryption
You mean encryption between the client and your DNS server, on your local network?
You can do it on your local network, but this won’t make much sense
I mean encryption between your phone or laptop outside of your house, and your dns server at your house
That’s cool for certain applications but on my home network should I really be super concerned about DNS encryption?
Not within the network, but translating regular dns to DoH before heading out to WAN keeps your browsing a little bit more private from your isp. Marginal, but it is a difference.
It’s not just a little bit more private… It’s a lot more private. Some ISPs have been known to build advertising profiles using DNS data. It’s trivial for them to see all DNS lookups and even modify the responses, since it’s both unencrypted and unauthenticated by default.
Probably not, but anyway it’s pretty cool to have an option to do this kind of stuff
You can set up this dns on your phone, laptop, without a need of vpn (although vpns are cool, especially tailscale)
But, are you always connected to the vpn? Or even to connect to the vpn itself you probably need dns, why would not use your own
As an AdGuard home user for more than a few years, I switched back to Pihole because it wasn’t really any better. It was also easier to pair pihole with Unbound.