{"id":3373,"date":"2018-10-09T10:05:58","date_gmt":"2018-10-09T14:05:58","guid":{"rendered":"https:\/\/antipaucity.com\/?p=3373"},"modified":"2018-10-09T10:05:58","modified_gmt":"2018-10-09T14:05:58","slug":"rethinking-pi-hole-again","status":"publish","type":"post","link":"https:\/\/merikebi.warrenmyers.com\/?p=3373","title":{"rendered":"rethinking pi-hole (again)"},"content":{"rendered":"

About 2 years ago<\/a>, I started running Pi-hole as a DNS resolver and ad-blocker. Then last year, I ditched it<\/a>.<\/p>\n

After seeing a recent post by Troy Hunt<\/a>, though, I thought it might<\/em> be worth revisiting..but I needed a better way to control how it worked.<\/p>\n

Enter {{OpenVPN}} – a service I already run on three endpoints. Here’s what I did:<\/p>\n

Install Pi-hole per the usual (curl -sSL https:\/\/install.pi-hole.net | bash<\/code> if you’re feeling brave, curl -sSL https:\/\/install.pi-hole.net<\/code>, inspect, then<\/em> run, if you’re feeling a little more wary).<\/p>\n

This time, though, I set my upstream DNS providers to Cloudflare (1.1.1.1) and Quad9<\/a> (9.9.9.9) instead of Freenom<\/a> and Google.<\/p>\n

I also did a two-step install – once with Pi-hole listening on the primary network interface on my OpenVPN endpoint (ie the public IP), and then, once I made sure all was happy, I flipped it to listen on tun0<\/code> – the OpenVPN-provided interface. This means Pi-hole can only hear DNS queries if you’re connected to the {{VPN}}.<\/p>\n

Why the change from how I’d done it before? Two reasons (at least):<\/p>\n

First, if you leave Pi-hole open to the world, you can get involved in DNS amplification attacks. That is muy no bueno<\/em>.<\/p>\n

Second, sometimes I don’t care about ads – sometimes I do. I don’t care, for example, most<\/em> of the time when I’m home. But when I’m traveling or on my {{iPhone}}? I care a lot more then.<\/p>\n

Bonus – since it’s only “working” when connected to my VPN, it’s super easy to check if a site isn’t working because of Pi-hole, or because it just doesn’t like my browser (hop off the VPN, refresh, and see if all is well that wasn’t when on the VPN).<\/p>\n

Changes you need to make to your OpenVPN’s server.conf<\/code>:<\/h3>\n


\npush \"dhcp-option DNS 10.8.0.1\"
\n<\/code><\/p>\n

This ensures clients use the OpenVPN server as their DNS resolver. (Note: 10.8.0.1 might not be your OpenVPN parent IP address; adjust as necessary.) Restart OpenVPN after making this change.<\/p>\n

My setupVars.conf for Pi-hole:<\/code><\/h3>\n


\nPIHOLE_INTERFACE=tun0
\nIPV4_ADDRESS=10.8.0.1\/24
\nIPV6_ADDRESS=
\nQUERY_LOGGING=true
\nINSTALL_WEB_SERVER=true
\nINSTALL_WEB_INTERFACE=true
\nLIGHTTPD_ENABLED=false
\nWEBPASSWORD=01f3217c12bcdf8aa0ca08cdf737f99cd68a46dbdc92ce35fd75f39ce2faaf81
\nDNSMASQ_LISTENING=single
\nPIHOLE_DNS_1=1.1.1.1
\nPIHOLE_DNS_2=1.0.0.1
\nPIHOLE_DNS_3=9.9.9.9
\nDNS_FQDN_REQUIRED=true
\nDNS_BOGUS_PRIV=true
\nDNSSEC=false
\nCONDITIONAL_FORWARDING=false
\n<\/code><\/p>\n

I tried getting {{lighttpd}} to only listen on on port 443 so I could use Let’s Encrypt’s SSL certs<\/a> following a handful of tutorials and walk-throughs, but was unsuccessful. So I disabled lighttpd, and only start it by hand if I want to check on my Pi-hole’s status.<\/p>\n

Speaking of which, as I write this, here is what the admin console looks like:<\/p>\n

\"admin<\/a><\/p>\n

Hope this helps you.<\/p>\n","protected":false},"excerpt":{"rendered":"

About 2 years ago, I started running Pi-hole as a DNS resolver and ad-blocker. Then last year, I ditched it. After seeing a recent post by Troy Hunt, though, I thought it might be worth revisiting..but I needed a better way to control how it worked. Enter {{OpenVPN}} – a service I already run on …
Continue reading rethinking pi-hole (again)<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[41,46],"tags":[70,73,532,565,828],"keyring_services":[],"class_list":["post-3373","post","type-post","status-publish","format-standard","hentry","category-technical","category-update","tag-ads","tag-advertising","tag-openvpn","tag-pihole","tag-vpn"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/3373","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3373"}],"version-history":[{"count":0,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/3373\/revisions"}],"wp:attachment":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3373"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3373"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3373"},{"taxonomy":"keyring_services","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fkeyring_services&post=3373"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}