My Pi hole has been up and solid for about a decade now, so not sure “isn’t really stable long term” is landing

Thank you for the in-depth explanation, Technitium sounds really involved. I just plunked down a pi hole, turned it on, and it’s been working for years and years. I’ll keep this in mind though if I ever want to drive myself nuts with networking

No backup with PiHole?

PiHole can run redundant if you want. Does Technitium do this differently? Or more easily?

I never understood pihole in the first place. It's just a fancy web interface you do never look at if the thing does its job quietly in the background. And unbound alone is perfectly able to use blocklists with one line of configuration (and an onliner script to convert the common lists into the right format).

If you just want simple ad blocking you don't actually need pi hole for it's web interface you don't ever look at once it runs. Unbound alone can do the job with minimal configuration.

Nowadays I even changed my setup to dnsproxy, which doesn't even need any config. It's just a handful parameters when you start it. And it does all the filtering for my home network as well as providing DoH access for when I'm not at home and connected from somewhere else.

Tells me that too. Then I copy the url into my readeck instance and it pulls the article for me and gives me a better reading experience.

This sounds like AdGuard Home is an example?

Technitium does this incredibly easily. I fiddled with pihole and unbound for so long to get them to coexist properly, and pihole alone before that. The pihole part was easy although unreliable on a raspberry pi due to the sd card. It was better once I added an ssd to the pi, but it didn't have recursive DNS. Adding unbound and getting them configured properly and coexisting properly wasn't an easy task. Technitium has all of this in one package and was trivial to set up one or more clustered nodes. You don't need anything to ensure they both work together, the clustering feature does this incredibly easily. One goes down? No prob, I see a discord alert from uptime kuma letting me know. When it comes back up cluster mgmt syncs everything and they load balance again.

My current setup has an uptime of 210 days, and likely would be longer if it weren't for a power outage.

It really is so simple, I'd suggest everyone try it out. You can always change it back if you don't like it. And, like the pihole, you can load curated block lists.

Good for you, many don't have the same experience. Technitium is easier to set up in my experience, but you do you if it works for you. That's the benefit of having free choices.

Just to be clear, I'm not trying to sell you or anyone on technitium over pihole or pihole+unbound, they're all free and I don't work for them or anything. However, as someone that has gone through this journey with all of them, I'll never go back to pihole, especially with the features technitium has and the importance of DNS to my home lab plus the incredible ease of setup.

I did this, and you're right - no ads. 👍 Thanks a bunch, I've saved your comment so if I run into one of these again I may hit you up!

Because you have to mess with it all the time. It’s easier to get in and get out to make changes with the nice interface. It’d be different if it was set it and forget it but realistically it’s not.

Thanks for taking the time to let me know it worked for you! I like helping people so this made my day!

It literally is a cron job or systemd timer to load an updated blocklist from time to time and I haven't looked at it for years (well... other an changing a path when I switched from unbound to dnsproxy, because that one is even simpler, doesn't even need a config other than a few parameters at startup and can provide DoH, DoT and/or DoQ access for when I'm not at home)

Edit: Do not click on tracker links below.

Looks like cdn-statically.io has not yet been added to any of the big block lists I use, but I found it in my DNS logs from today. Good catch! I didn't find githack.com or revcontent but added them to block, and it looks like pub.network and html-load.cc are on the big blocklists and getting blocked. Thank for the tips.

I only know the basics of networking, so I've been wondering why this "DNS-sinkhole" functionality can't simply be implemented directly in private routers (as some kind of blocklist) instead of adding a new device to your network. Do routers not support this for technical or security reasons?

I love Unbound bro. Gives a neat list of the noisest domains which I can quickly add to my list if I don't need that site 😌

Do note: this might break a lot of websites people go to. I used NextDNS for my router and a family member couldn't get to shopping websites like Hot Topic or Uniqlo. They straight up block you.

I gave up and put ISP dns bavk and just use Unbound on the router + enable NextDNS on Individual devices.

Why?

You were taught about zero-click mercenary spyware attacks in middle school? Neat.

The situation is so concerning, he notes, because there isn’t much that people can do to protect themselves from zero-click ad attacks other than blocking ads as thoroughly as possible on all websites and platforms—a fact that intelligence agencies like the NSA and CIA seem to know all too well.

Or disable JavaScript

I guessed that an Israeli company would be behind this, and I was right. Am I antisemite?

Routers are usually hardware level optimized for throughput, filtering is inherently computationally expensive compared to routing (not crazy expensive just more than usually fits an FPGA), especially if you have to keep up multi-gigabit throughput

You could totally do it at the router, it would just become a more expensive piece of hardware and most people choose to cheap out

A Raspberry Pi 3b is adequate to run PiHole to do the job, or implementing AdGuard DNS.

However, these require a little skill and knowledge to implement.

Consumer routers aren’t built to do the job.

This is a difficult question to answer. Antisemitism might be the one issue, the only one, regarding marginalisation, that people don't necessarily need more awareness of. I think we're all pretty aware to the extent to which we can help, and the extent to which it's gonna happen whether or not we do anything.

Those ads I see (in Kentucky) entangle Zionism with Judaism too tightly, the 'increased awareness' smells like a radio show my family used to listen to called "focus on the family". every Sunday there was story time, and the lesson of the story was usually "damn, if only these soft-hearted parents would learn that is okay to hit your kids, and is actually evidence that you love them with the REAL love." These ads have the same vibe, because evangelicals are making them, too.

If you want people to stop thinking conspiratorially then for gods sake call out obvious propaganda, you need an amount of nuance most apolitical people aren't willing to engage with in order to understand that it isn't necessarily 'the Jews" making all this pro-Zionist propaganda and shaming you for disagreeing with it.

this is a shit take I'm sure, what do i know, but if there are enough Jewish anti-Zionists in the world to do this, you are going to need to end your toxic relationship with evangelicals, they are stalking you. get the cultural equivalent of a restraining order (me asking you to employ a tool that probably doesn't exist)

sorry for the rant

No, we were taught about HTTP, the fundamentals of hypertext and how it gets rendered, how embedded code (Flash at the time; yes, I'm old) runs in the browser, and the concept of the digital footprint. The cybersecurity implications were obvious.

Actually, I have to correct myself. Some of this was taught in the 7th or 8th year of primary school, around ages 12-14. I was fortunate to be born in a country, at the right time, where the public education system was still worth something. My heart bleeds when I hear of what goes on across the ocean.

Just moved to an OPNsense network. Setting up unbound was so nice and simple. Much preferred over pihole.

Agreed. I used pihole initially when I was first learning networking, but when I got a dedicated machine and installed OPNsense, I learned how much easier so many things can be.

Nah it’s more like all the sites and services that used blocked links that you have to add to the whitelist or in some cases be able to turn the protection off and on. It’s a regular occurrence for me

Most consumer routers don't offer this functionality out of the box, likely because manufacturers don't consider it essential for most users. There's no major technical reason it couldn't be built in though. You can already set up DNS sinkholing with OPNsense or pfSense if you don't mind running and managing your own router.

I love my Pihole. It blocks ads on my PCs, my iPads, our streaming devices, etc. It also blocks telemetry gathering by other device manufacturers.

The downside is OPNsense is it's information light, and a bit inscrutable lol I'm having an issue with my WAN dhcp going offline, seems to be happening on a cadence. My modem is fine, connection is valid. Rebooting the OPNsense box fixes it. Losing my mind a bit but I'll figure it out 🙃

Absolutely. Remember to enable a cron job in the OpnSense - System > Settings > cron to update the Blocklists. Otherwise you are likely out of date.

Try setting a tunable of:

net.link.ether.inet.max_age = 540

By default FreeBSD sets a 20 minute ARP maximum age while many ONT’s set a 9 minute maximum age. This will show up as performance issues initially then cause other issues.

Also Realtek NIC's are notorious for issues with FreeBSD, so if you are using one replacing it with an Intel one is highly recommended.

This should be the top comment tbh

I doubt a DNS filter would noticeably increase CPU usage. We’re not talking about deep packet inspection here.

I believe it was the realtek NIC and some settings offloading to the hardware I set during troubleshooting. Installed the Realtek driver in the plugins and changed those settings and so far no instability! Thank you for the tunable suggestion though I will also be checking that out!

Well yes but no with html5 a lot of JavaScript functions are now possible with html alone so a number of stuff like click or core jacking or even SQL injections into local databases are now possible with html5 even with JavaScript disabled

Whats with that title? It doesn't say the word DNS, Sink, self or host in the article...

Whys it important to self host? I use ControlD and NextDNS and both have been great.

No problem.

Be sure to set a cron job for updating the DNS Blocklists, running scrubs, smart tests, and trim if you are using a ssd.

I am working on a way to do snapshots for the system as well for super simple restores that are automatically created. Before an update you WILL want to have a snapshot available. Once snapshots are automated I will probably start doing automatic updates. It basically creates a system similar to how an immutable OS works, if something goofs you can simply roll back to a previous working state and pause updates. I previously had a script I setup via a cron job but the system removed the job during an update.

It was founded by the Manhattan district attorney and the city of London police force (https://globalcyberalliance.org/history/) and IBM. I know that they say they are now reincorporated as a nonprofit in Switzerland but I find it suspicious that they don't mention their history on their webpage, the Wikipedia entry doesn't have a history section and the Global Cyber Alliance doesn't have a Wikipedia entry either.

I might be paranoid but all this seems weird to me and I don't trust them.

Calling it ad blocking undersells it. The ad network is the delivery path in that report, so blocking at DNS is a security layer, not tidiness. The thing I'm building goes a step further: it holds tracker connections open instead of refusing them, so they waste their own time instead of retrying instantly. Has anyone tried tarpitting at home? I'm curious whether it broke smart TVs or apps that phone home hard.

Nowadays the internet is pretty much unusable without ad blockers/dns sinkholes

DNS blockers work so why would I need your solution? I dont care if the sites try to reconnect cause the connection wont work nonetheless

The problem with tarpitting is that apps will try to download the ads before showing you the content, and you will be more annoyed than before

The german router "FritzBox" recently did implement this.
A very rudimentary version of it but still.

Thank you sir, the posted article is paywalled

Link?

These are huge! Thank you for the suggestions I will get to implementing all of these. The only thing I've done so far similar to what's in this list is backing up to my git repo, which is very nice. Every setting change gets committed. Is that different than snapshotting?

A snapshot is an image of the complete system at the time of creation that tracks changes and can be restored if needed.

https://www.howtoforge.com/tutorial/how-to-use-snapshots-clones-and-replication-in-zfs-on-linux

I switched to pihole. Just found it.. easier.

I started on pihole, then the devs messed it all up and made it complicated, so I started using unbound on OPNsense and holy poop was it so much easier for me. But I mean as long as everyone is using something, that's what really matters. Don't let these corporations take even an inch