Pihole

overview

The Pi-hole® is a DNS sinkhole that protects your devices from unwanted content, without installing any additional client-side software.

It contains:

• (its own) dnsmasq - a lightweight DNS and DHCP server
• curl - A command-line tool for transferring data with URL syntax
• lighttpd - web server designed and optimized for high performance
• php - a popular general-purpose web scripting language
• AdminLTE Dashboard - premium admin control panel based on Bootstrap 3.x
• sqlite3 - SQL Database engine

The database is used to contain white and blacklisted domains.

It implements a DNS via dnsmasq, and optionally a DHCP server.

See also some comparisons and overiew

goal

The intention is to wire this in as the DNS server for my Mikrotik router, and maybe optionally look at using it for DHCP at some date in the future.

blacklists

Items provided by the blacklist, or via the group lists are used to match and block names that you want to resolve to 0.0.0.0 (null ip address) so they are inaccessible.

pihole comes with a default list (appearing as the first group) which manages to block a lot of unwanted sites.

See the following for a large list of additional filter groups:

• https://firebog.net/

whitelists

You can unblock names by including them in the whitelist.

installation

• prerequisites

apt install git

• ensure that nginx is not listening on port :80 sicne default installation is of lighttpd listening on port 80

vi /etc/sites-available/security.arising.com.au etc

• clone repo

cd /usr/src
git clone --depth 1 https://github.com/pi-hole/pi-hole.git

• install

cd pi-hole/automated\ install
./basic-install

• change the admin password with

pihole -a -p

configuration

The pihole server DNS forwarded is to be configured to use CloudFare DNS 1.1.1.3 which is a family safe DNS that filters out malicious name and pornographic domain resolutions.

A few files get overwritten on your pihole server during installation.

• make sure your router is being used for default resolution (in cases where your router DNS has static entries)

$ vi /etc/resolv.conf

nameserver 192.168.88.1

• make sure that the dhcpcd.conf is using your router DNS and not the ones supplied during configuration

$ vi /etc/dhcpcd.conf

 static routers=192.168.88.1
 static domain_name_servers=192.168.88.1

port

Pihole uses the lighttpd web server to provide the /admin path.

If the port 80 is in conflict with your other needs it can be moved:

• vi /etc/lighttpd/lighttpd.conf and change like follows:

# RBH moved to port 8100 (from 80)
server.port = 8100

router

🚩 If your router is capable ...

After installing and configuring pihole you then configure your Router DNS server/client to point to your (static) pihole DNS server, that way all your network devices will have domain and host resolution performed by the static DNS within the router, or the cache, or if not present via the pihole server. If both pihole servers time-out, then the router will forward the name resolution to the dynamically configured external DNS server(s).

disable

You may disable pihole via

systemctl stop pihole-FTL
systemctl disable pihole-FTL

uninstall

pihole uninstall

remove

rm -rf /etc/.pihole /etc/pihole /opt/pihole /usr/bin/pihole-FTL

PXE

This is a future research project towards providing network boot.

• https://leo.leung.xyz/wiki/Pi-hole
• https://discourse.pi-hole.net/t/pihole-not-directing-clients-to-pxe-server/12918
• TFTP/DHCP https://discourse.pi-hole.net/t/dhcp-option-66-tftp/8437
• see also raspberry pi#network boot

bibliography

• https://pi-hole.net/
• files used by pihole https://discourse.pi-hole.net/t/what-files-does-pi-hole-use/1684
• setting it up with nginx and different external DNS https://dev.to/jldohmann/the-ultimate-ad-blocker-configuring-pi-hole-with-unbound-dns-20eo
  • whitelists
    • https://raw.githubusercontent.com/raghavdua1995/DNSlock-PiHole-whitelist/master/whitelist.list
    • https://v.firebog.net/hosts/lists.php
    • https://github.com/thomasbnt/raspihostblock
    • https://github.com/anudeepND/whitelist
• see this https://www.comparitech.com/blog/vpn-privacy/block-mobile-ads-raspberry-pi-pihole/
• using pihiole as Mikrotik DNS https://forum.mikrotik.com/viewtopic.php?t=150195 (note add an alternate DNS to the gateway too!)
• geofencing access to pihole dns server httpd etc https://munkjensen.net/wiki/index.php/Access_control_using_Fail2Ban_and_geoip
• blacklist for smart TVs https://gist.github.com/hkamran80/779019103fcd306979411d44c8d38459
• federated pihole ??? https://www.youtube.com/watch?v=IFVYe3riDRA
  • https://www.youtube.com/watch?v=IFVYe3riDRA
  • https://github.com/vmstan/gravity-sync
  • https://discourse.pi-hole.net/t/gravity-sync-an-easy-way-to-keep-multiple-pi-hole-in-sync/33545
  • https://www.google.com/search?q=gravity+sink+pihole&client=firefox-b-e&ei=seoQYYe0IoS_3LUP6tOOgAI&oq=gravity+sink+pihole&gs_lcp=Cgdnd3Mtd2l6EAMyBAgAEA0yBggAEA0QHjoHCAAQRxCwAzoHCAAQsAMQQzoHCAAQgAQQCjoFCAAQgAQ6BAgAEEM6BggAEBYQHjoFCCEQoAFKBAhBGABQ4DtYjEpg8kxoAXACeACAAbYCiAHCDpIBBzAuMi41LjGYAQCgAQHIAQnAAQE&sclient=gws-wiz&ved=0ahUKEwjH0I-JxqPyAhWEH7cAHeqpAyAQ4dUDCA0&uact=5

categories

[[category:Network]