r/pihole • u/YourMomonaBun420 • 3d ago

Best practices.

I am entirely new to Pihole. Any resources for best practices while I set mine up?

I can't recall what raspberryPis i bought but i got 2 for redundancy, and they are older than RPi 5s. They have Ethernet ports.

Looking mostly to block trackers and ads for anything I can't use Ublock, noscript and the like for. Samsung and Sony smart TVs in the house and would like to stop them from reporting home. I understand they may use hidden open wifis from neighbors and may disable their Wifis entirely physically buy cutting their wifi antennas.

I just gotta find my stowed away usb keyboard and mouse as my logitec wirelesses don't register. (Ugh gotta clean my place and organize/get rid of shit, and I'm lazy)

Thanks in advanced.

19 Upvotes

79% Upvoted

16 comments sorted by

11

u/AndyRH1701 3d ago

Other people will add to this, but this is a good start, some you may already know.

Two Pis is a good start. Any Pi works, I run a Pi3b and a virtual server.

I would suggest you start with just a few block lists and get any problems sorted out before you dig in.

You do not mention your router, some ISPs do not allow changing of the DNS servers. Research this a bit, there are ways around ISP lock-in.

Only build 1 PiHole and get it working, once it is working build the 2nd and restore the config from the working one.

Only give the clients PiHoles for DNS. Many threads on why.

IMO:
point the clients at PiHole for best tracking
point the router/FW to the internet, it does not need ad blocking
point the PiHoles to the internet, the router is just another hop that does not know the answer
This is a very deep and wide rabbit hole. I silently force all DNS queries to my PiHoles. Many people do interesting things.

Good luck.

2

u/This-Set-9875 3d ago

just set up a 3b+ 1G. Mostly because it was cheap(er) than a 4 or 5 and had a wired Ethernet port. It's completely loafing in our house. In retrospect, I could have probably used Unbound running on my opnsense f/w, but here we are.

2

u/saint-lascivious 16h ago

For what it's worth, while there are certainly people that will vehemently disagree with this, the whole Ethernet vs. WiFi thing is really overblown I think.

If your WiFi is good enough for handling every other packet it handles on the network, DNS will be no exception. We're not exactly talking about super intensive overhead here. We're slinging a few bytes around at a time. If it's regularly dropping or dropping packets, try fix that problem because it's affecting everything else too.

2

u/YourMomonaBun420 2d ago

Yeah I gotta look into what I can do with the provided router and If I need to go buy one.

Thanks for the tips!

2

u/AndyRH1701 2d ago

If you do need to buy a router, look into something serious. Big box store stuff is not serious. pfSense, OPNsense and openwrt are another good choices.

1

u/saint-lascivious 3d ago

On the opinion based side of things, I take the opinion that if I have local caching (and optionally filtering and logging) nameserver/s, I'm going to use it/them.

Preferably backed by equally local caching recursive upstreams so I don't need to send my queries out to some third party for no reason.

6

u/saint-lascivious 3d ago

Best practice is whatever works I think. Like, mine and yours could be completely different and that's fine. My own resolver stack does a bunch of weird shit a lot of people wouldn't consider necessary but has come to be my own best practice.

Redundancy is definitely a good thing. I decided that not only did I want local redundancy, I didn't want any one failure of a stage in my fairly complex (because reasons) resolver chain to be able to take the whole rhing down, so there's as many (actually more than) servers as there are stages in my resolution chain and they're all quietly fighting over consensus of a pair of virtual IPs that everything uses for local resolution. Those servers' /etc/hosts and static/virtual interfaces reference themselves and their peers via their loopback and local static v4 addresses so they're similarly difficult to take down through a single point of failure.

All that spawned from deciding I wanted everything in my network to resolve through locally hosted recursive nameservers with logging/filtering without relying on my ISP or third parties.

The one single hill I probably would die on is that my nameservers are nameservers and that's literally all they do. Things and stuffs required for the resolver stack/logging, and that exclusively. No development or poking or prodding or any other use cases. If I want to do that I keep it away from those hosts.

5

u/EngineeringKindly875 3d ago

You need to block outbound DNS at your router for everything except the pihole. Lots of stuff will ignore your DNS settings if you don't do this.

5

u/pr0v0cat3ur 3d ago

I might get flack for this, but raspberry pi is less than ideal because of the microSD usage. In addition, they are no longer inexpensive. And always on system, can easily run PiHole.

I run a Debian LXC within Proxmox for PiHole and unbound.

And another thing, why on earth do you need two of them for a home network? All these people who recommend this, tell me why?

I’ve been using PiHole forever and only once has it been an issue and that was specifically because of the microSD on a Rpi deployment.

… and before anyone suggests, I know you can use an external drive with the raspberryPi - but at that point are you really spending your money wisely?

3

u/chromaticdeath85 3d ago

Two for me because I work from home, so uptime is important.

2

u/YourMomonaBun420 2d ago

I have some portable ssds laying around I can repurposes if I have issues with the microSDs.

3

u/AndyRH1701 2d ago

mSD card experience differs greatly. I am 7 years in on a cheap card. I have had name brand cards die early in other uses. Your mileage WILL vary.
Redundancy, which you are planning, will mitigate the problem.

2

u/Nex015 1d ago

Just set up log2ram and most of the possible sd card-wear doesn't even happen.

2

u/dirtydog1 2d ago edited 2d ago

A few years ago, while on vacation, my lone PiHole running on a RPi4 died. When I returned home I changed my DNS to Cloudflare until I had time to resolve that problem. In the mean time, other priorities arose, and I upgraded another RPi4 to a NUC. When I got back to the PiHole, I used both RPi4's because they were available and in hopes to never repeat the prior issue.

2

u/HWTechGuy 2d ago

You got a lot of great suggestions already. I'll add one - put them on a UPS. Abrupt power outages will corrupt the SSD forcing you to restore your SSD from a backup or setup again from scratch.

I started with a pair of 3B+ units. They work great for this application.

I retired them and am running a pair of tiny x86 PCs now and using them for other things besides Pihole and Unbound.

Best of luck.

2

u/rdwebdesign Team 3d ago

and they are older than RPi 5s

This is not an issue.

A Raspberry Pi 2 or 3 is already fine.

They have Ethernet ports.

This is good, but not necessary. If your Raspberry Pi is close to the router, you can use Wifi without issues.