Firewalls

Filter out ads and malware sites on your home network using PiHole.

Overview

Why Pi-Hole?

https://www.wikiwand.com/en/Pi-hole

https://en.wikipedia.org/wiki/DNS_Sinkhole protects devices on a subnet from unwanted content, without installing any client-side software.

The Pi-hole® impliments a DNS sinkhole https://pi-hole.net/

PiHot optionally functions as a DHCP server, ensuring all your devices are protected automatically

over both IPv4 and IPv6

https://crosstalksolutions.com/raspberry-pi-4-boot-with-usb
https://www.youtube.com/watch?v=xtMFcVx3cHU by TechHut
https://www.youtube.com/watch?v=roYduABVjo8 by CoreElectronics

Get a Raspberry Pi hardware

VIDEO: https://www.crosstalksolutions.com/the-worlds-greatest-pi-hole-and-unbound-tutorial-2023/ has a RPilocator.com which notifies you when one comes into stock.

Alternately, you can run Pi-hole within a Docker container.

VIDEO: Raspberry Pi 4 Getting Started</a> by Crosstalk Solutions

Install PiHole from macOS

See my article about setting up the Raspberry Pi.
Navigate to a folder where you want the new repo downloaded.

Deploy the software directly to a supported operating system via our automated installer:

git clone --depth 1 https://github.com/pi-hole/pi-hole.git Pi-hole
cd "Pi-hole/automated install/"
sudo bash basic-install.sh

Type your laptop’s OS password requested by the sudo command. The Pi logo should appear.

  [✓] Root user check

    .;;,.
    .ccccc:,.
     :cccclll:.      ..,,
      :ccccclll.   ;ooodc
       'ccll:;ll .oooodc
         .;cll.;;looo:.
             .. ','.
            .',,,,,,'.
          .',,,,,,,,,,.
        .',,,,,,,,,,,,....
      ....''',,,,,,,'.......
    .........  ....  .........
    ..........      ..........
    ..........      ..........
    .........  ....  .........
      ........,,,,,,,'......
        ....',,,,,,,,,,,,.
           .',,,,,,,,,'.
            .',,,,,,'.
              ..'''.

If you see this, verify you have a working connection to the Pi.

[i] SELinux not detected
[✗] No supported package manager found

Block ads everywhere, even on the go. By pairing your Pi-hole with a VPN, you can have ad blocking on your cellular devices, helping with limited bandwidth data plans.

https://docs.pi-hole.net/guides/vpn/overview

Set Pi-hole Admin Password

Log into the Pi-hole

Pi-hole Dashboard and Menus

Add Pi-hole Block Lists
Configure your router’s DHCP options to force clients to use Pi-hole as their DNS server, or manually configure each device to use the Pi-hole as their DNS server.

https://docs.pi-hole.net/main/post-install

More Pi-hole Menu Settings

Pi-hole Settings

Set a static IP address within your subnet for the PiHole. 8:58

sudo nano -w /etc/dhcpcd.conf

Un-comment under # Example static IP configuration and specify your subnet:

interface eth0
static ip_address=192.168.200.52/24
static routers=192.168.200.1
static domain_name_servers=192.168.200.1 1.1.1.1

sudo reboot

On the new IP address:

Configure DNS server

Some internet service providers (ISPs) return ads instead of 404.

Don’t have to use Unbound.

1.1.1.3 & 1.0.0.3 blocks phising/malware/adult content filtering.

8.8.8.8 from Google was rated as the quickest, probably because it doesn’t block as comprehensively.

Add blocklist from Firebog
Into Pi-Hole’s Adlist Group Management, add URLs of sites that Firebog knows to be suspicious, advertising, tracking & telemetry, malicious, etc.
Click “Update Gravity”.

Temporarily Disable Pi-hole 23:45
Create a shell file to call to obtain password cache:
```
cat /etc/pihole/setupVars.conf | grep WEBPASSWORD
```
Bookmark this URL on your browser or Stream Deck to temporarily disable Pi-Hole by authenticating with the hashed value of WEBPASSWORD.

http://192.168.200.52/admin/api.php?disable=300&auth=PWHASH

for 300 seconds

Configure other devices to use Pi-hole as DNS
In Settings, Interface settings, uncheck default “Allow only local requests”.
Check “Respond only on interface eth0”.
Instead of changing each device (laptop), set the DNS to the Pi-Hole DNS, set the DHCP: DNS 1 and DNS 2.

Audit log
Click the “Audit Log” menu item.

Backup
In Tools, click “Backup”.
Copy the backed up file to a USB drive and/or cloud.
If you’re running 2 Pi-Holes, install the backup onto the 2nd Pi-Hole. Sync using:

https://github.com/vmstan/gravity-sync

Install Unbound DNS route proxy
Install Unbound service to make DNS queries anonymously:
```
sudo apt install unbound -y
```
Download the text
```
??? pi-hole.conf
```

Edit wall of text:

sudo nano -w /etc/unbound/unbound.conf.d/pi-hole.conf

Start Unbound service:
```
sudo service unbound start
```
View Unbound service status (active?):
```
sudo service unbound status
```

Test DNS lookup:

dig crosstalksolutions.com @127.0.0.1 -p 5335

30:36 Setup firewall rules to ignore DNS queries to the DNS set on individual devices.

Test Pi-hole Ad Blocking
Test Ad-Blocking

Docker

curl -sSL https://get.docker.com | sh

Add user pi to docker group:
```
sudo usermod -aG docker pi
```

Setup portainer.io to manage Docker containers on default port 9000:

sudo docker run --restart always -d -p 9000:9000 \
-v /var/run/docker.sock:/var/run/docker.sock \
-v portainer_data:/data portainer/portainer-ce:linux-arm

NAS drive on Raspberry Pi

https://www.youtube.com/watch?v=gyMpI8csWis

Chron jobs

Update the Pi-hole

Run a chron (crontab) job to Once a week or month to apply updates (if one becomes available):

Edit in /etc/cron.d/pihole

30 2 * * 1   root    /usr/bin/curl -sSl https://raw.githubusercontent.com/mmotti/pihole-regex/master/install.py | /usr/bin/python3  >> /var/log/piholeupdate 2>&1
 
30 2 * * 1   root    cd /usr/local/src/whitelist/scripts && git pull&& ./whitelist.sh >> /var/log/piholeupdate 2>&1

Do regular speedtests

Every hour run:

VIDEO: openspeedtest.com server run within a Docker image downloaded.
```
sudo docker run --restart=unless-stopped \
 --name=openspeedtest -d -p 80:8080 openspeedtest/latest
 
```
Change the port to something other than 8080 if your prefer.
Display

https://github.com/Brandawg93/Pi-Hole-Monitoring
Run on browser at URL http://192.168.200.122

Record to a file.

Instead of a chip, get an SSD drive.
View analysis: Are evenings more overloaded?

UniFi Dream Machine

VIDEO: UniFi Dream Machine Pro (UDM-Pro)</a> by Crosstalk Solutions

References

https://docs.pi-hole.net/

https://www.reddit.com/r/pihole/

https://www.youtube.com/watch?v=jlHWnKVpygw

More on DevOps

This is one of a series on DevOps:

More on Security

This is one of a series on Security:

Wilson Mar

Firewalls

Why Pi-Hole?

Get a Raspberry Pi hardware

Install PiHole from macOS

Set Pi-hole Admin Password

Log into the Pi-hole

Pi-hole Dashboard and Menus

Add Pi-hole Block Lists

More Pi-hole Menu Settings

Pi-hole Settings

Configure DNS server

Add blocklist from Firebog

Temporarily Disable Pi-hole 23:45

Configure other devices to use Pi-hole as DNS

Audit log

Backup

Install Unbound DNS route proxy

Test Pi-hole Ad Blocking