Good Morning from my Robotics Lab! This is Shadow_8472, and today I am installing PiHole. With luck, I\u2019ll have be configuring some of its other functions to augment my home\u2019s network as well. Let\u2019s get started!<\/p>\n\n\n\n
I can rant about the evils of Google \u2018til boredom do its part. However, this search engine is between inconvenient and impossible to ignore, given its impressive list of \u201chobbies\u201d from STEM projects to smartphones. It\u2019s an open secret few care to think about that their empire is built off user exploitation. I installed ad blocker browser plugins over their aggression last presidential election cycle.<\/p>\n\n\n\n
Earlier this month, I read about Manifest v3, the new browser-plugin interface library created by Google. Their precautions against spyware just so happen to cripple ad blockers, among other legitimate plugins. This walking conflict of interest is set to roll out January, 2023, and Firefox is going along with it.<\/p>\n\n\n\n
When a browser loads a web page, it asks a DNS service to translate the page\u2019s URL into an IP address. It then finds, loads, and renders the page at that IP. This may involve loading other pages \u2013such as ads\u2013 as elements of the original page. Network ad blockers protect you by fudging bad URL\u2019s addresses.<\/p>\n\n\n\n
My main goal this week is to kill ads across my home network. Follow-up objectives include advanced PiHole features and a private DNS for even better protection.<\/p>\n\n\n\n
My first attempt at PiHole was messy. I set up PiHole OCI\/\u201cDocker\u201d containers across my two servers \u2013 ButtonMash and my old laptop. Like before, the main router skipped IP\u2019s on me. I had it repaired within an hour thanks to my same laptop functioning as a workstation with a static IP. With the router upgrade to my upstairs workstation, I easily archived its settings and outfitted it with its own wider network static IP \u2013 complete with a netmask wide enough to chase down its rogue counterpart should it shift again (Did I have laptop\u2019s static IP netmask configured incorrectly this whole time?!).<\/p>\n\n\n\n
Surprise! The expanded subnet didn\u2019t work because the rogue router had its own subnet mask I was outside of. The dance was too involved for a play by play, but I only really felt helpless while trying to avoid hiking around to different workstations to clean up after this failed networking spell. As I reassembled the router for normal operation, I reasoned out that my router\u2019s firmware is hardwired not to consider a DNS coming from a LAN connection, like I\u2019m trying to do.<\/p>\n\n\n\n
Flashing open source firmware is out of the question. For one, I wouldn\u2019t know how to fix it and don\u2019t have a replacement. Two: apparently its chipset manufacturer isn\u2019t a fan of open source \u2013 the help thread I spotted recommended contacting OP\u2019s government representative if he wanted to do anything about it.<\/p>\n\n\n\n
I did a bit of research before dismantling the network again. DHCP settings include optional fields for DNS requests. This should let me direct computers straight to PiHole instead of relaying the request in a convoluted workaround involving a NAT table and possibly causing a network loop.<\/p>\n\n\n\n
This means each router is now a separate task. The responsible thing to do now is ensure my subnet router can behave before working on the main one. It\u2019s not long before I fry my DNS settings. Navigation around my local network remains unaffected, but I eventually resort to restoring my backup from yesterday, re-applying the static IP, and updating the backup.<\/p>\n\n\n\n
My best bet from here is to finalize my PiHole install. My initial container creation was the absolute minimum: port 80 web interface, port 53\/TCP+UDP. There\u2019s a lengthy list of environment variables to browse.<\/p>\n\n\n\n
Jackpot! My mind cleared enough before bed to skim PiHole Docker\u2019s documentation on GitHub. It has a list of example deployments \u2013 including a shell script. I converted it for Podman, entered my environment variables, and \u2013during debugging\u2013 axed the logic for relaying logs as it was causing problems and I can view them directly with Cockpit-Podman.<\/p>\n\n\n\n
But where to land it? I\u2019ll eventually integrate as I master Caddy. Leaving the container running as root lets it use the proper ports, but I know better. Thanks to discoveries I spun off into last week\u2019s project, I can now make more underprivileged, Cockpit-enabled users than I will ever need by using loopback the address (127.0.0.1\/8).<\/p>\n\n\n\n
The run script was easy to copy over to my new PiHole user. I gave it the directories it wanted as mountable volumes and shifted ports around until I was happy. I took the time to tidy up my firewall, combining a couple related entries and reclosing the normal DNS port.<\/p>\n\n\n\n
I remember having issues with Vaultwarden\u2019s stability over the course of days to weeks. The problem was occasionally annoying as Bitwarden only requires its home server when modifying the password vault, but PiHole will be sorely missed the moment it goes down. The one place I found the solution was in the official Podman troubleshooting guide on their GitHub [1]:<\/p>\n\n\n\n
loginctl allow-linger userName<\/pre>\n\n\n\nI sadly could not verify this was my previous, solution to my Vaultwarden long-term issues, but it\u2019s not entirely unfamiliar, and it\u2019s my best-informed guess.<\/p>\n\n\n\n
DNS Port Forwarding<\/h2>\n\n\n\n
With PiHole secured in its own, easily accessible account, I soon experienced how picky DNS requests are about using the privileged port 53. All my attempts at manually telling OpenWRT to use port 5300 failed. I expect the the story will be the same if I try with on my main router.<\/p>\n\n\n\n
I found the solution where Woody from b-woody.com blogged about almost the exact same project last May [2]: port forward port 53 to port 5300. Paranoid about goofing my firewall over command line I ran my version of Woody\u2019s commands past r\/TechSupport\u2019s Discord channel. Moderator Donjuanal confirmed my omission of a trailing \u201c:toaddr=\u201d, but questioned my blind use of tcp, explaining how DNS clients default to udp for speed.<\/p>\n\n\n\n
sudo firewall-cmd --zone=public --add-forward-port=port=53:proto=udp:toport=5300 --permanent<\/pre>\n\n\n\nEven with this measure in place, I had to access the web console and tick Settings>DNS>Interface settings><\/strong>Potentially dangerous options>Permit all origins<\/strong> before my local requests made it through. This may need to be addressed later.<\/p>\n\n\n\n
Takeaway<\/h2>\n\n\n\n
I am so glad to have PiHole installed, even if it doesn\u2019t appear to be doing much more than the uBlock Origin Firefox plugin. I\u2019m researching the next segment though, and I estimate another week or more worth of work before it is configured alongside a private DNS server. Worth noting is that Firefox is leaving in the features ad block requires, despite potential security concerns. This is as good enough stopping point.<\/p>\n\n\n\n
Final Question<\/h2>\n\n\n\n
Do you use PiHole? I\u2019d be happy to hear about your experience.<\/p>\n\n\n\n
I look forward hearing your answers on in the comments below or on my Socials<\/a>.<\/p>\n\n\n\n
Works Cited<\/h2>\n\n\n\n
[1] eriksjolund, \u201cPodman\\ Troubleshooting\\ A list of common issues and solutions for Podman,\u201d github.com<\/em>, Nov. 19, 2022. [Online]. Available: https:\/\/github.com\/containers\/podman\/blob\/main\/troubleshooting.md<\/a> [Accessed Jan. 30, 2023].<\/p>\n\n\n\n
[2] Woody, \u201cRun PiHole in a rootless Podman container,\u201d b-woody.com<\/em>, May 12, 2022.[Online]. Available: https:\/\/b-woody.com\/posts\/2022-05-12-pihole-on-a-rootless-podman-container\/<\/a> [Accessed Jan. 30, 2023].<\/p>\n\n\n\n
[3] Can You Block It, \u201cCAN YOU BLOCK IT?\\ AN SIMPLE AD BLOCK TESTER\u201d canyoublokit.com<\/em>, 2021. [Online]. Available: https:\/\/canyoublockit.com\/<\/a> [Accessed Jan. 30, 2023].<\/p>\n","protected":false},"excerpt":{"rendered":"
Good Morning from my Robotics Lab! This is Shadow_8472, and today I am installing PiHole. With luck, I\u2019ll have be configuring some of its other functions to augment my home\u2019s network as well. Let\u2019s get started! PiHole, Take II I can rant about the evils of Google \u2018til boredom do its part. However, this search … <\/p>\n