In addition to adblocker module that it is possible to install in your browser, we can add another layer of security by blocking access to any website that is mentionned in a blacklist, but instead of doing it per device, it is possible to configure it for the whole network with Pi-Hole.
Pi-Hole is an advertisement and Internet tracker blocking appplication which works in a network-level. To be able to block any blacklisted domain, the Internet trafic needs to go through it to be able to apply the filters defined. In this case, it acts as a DNS sinkhole and DHCP server.
Local Network Configuration
To oversee how it works, we need to understand the concept behind the keywords that are “DNS” and “DHCP”. DNS stands for Domain Name Server, it allows to associate a domain, like frenchsavvy.com to an IP address. Humanwise, it is more convienent to type the name of the website rather than it’s IP address.
Regarding DHCP, Dynamic Host Configuration Protocol, it allows to automatically assign an IP address for a device connected to a network. From outside world, you just have a unique IP address that is given by your Internet Service Provider (ISP). But between the TV and the laptop connected to your router, it is also needed to redirect the information to the requester, that is why we need to give a unique address for each and every one of them. Also know as “local network”, usually these local addresses start with 192.168.x.y. These addresses are given following the DHCP protocol.
Pi-Hole Installation
NOTE 1: The installation is made on an Odroid-C4 in my case but it also works the same for any machine under Linux, either virtual machine or other hardware.
NOTE 2: The description of the following steps that involve any action on the router will not reflect the options available on your router’s model. Indeed, the version, interface, brand, reference of each router can be totally different. I will advise you to look at your router configuration manual for further details.
Remote Connection to the Odroid
- Open a Terminal or PowerShell window.
- Type
ssh user@machine_ipwhere you replace the user and machine_ip with yours. - Type your password and confirm with Enter.
You should see the established connection:
Installation through SSH
In the Terminal window, we type: curl -sSL https://install.pi-hole.net | bash
NOTE: If you would prefer to review the code before installation, refer to Pi-Hole’s website for alternatives.
We have now a warning message saying that it is needed to have a static IP address.
This is important because devices on the network will point to the Pi-Hole’s server to access DNS resolution. If the address is changing all the time, it will imply to reconfigure each device connected to the local network. Not practical. Usually, it is possible to do so, in your router, by associating the physical address (also called MAC address) to your local IP address.
In router’s DHCP options, it is possible to assign a static address. I invite you to check against your router’s documentation. Once done, we can continue.
Here, it is asking which DNS provider you would like to use. You can select the one you want, it can be modified anytime after the installation.
Now regarding the blacklist, it is proposing you to install a minimal blocking list. You can accept since it will be updatable anytime after the installation.
If you don’t accept to install the Admin Web Interface and web server, you will have to configure Pi-Hole’s server with command line interface. I recommend to confirm their installation.
This query logging option can be changed anytime after installation. For testing purpose, you can activate it.
The last screen will give you the password of Pi-Hole’s server interface. Save it!
If you go to the IP address given by the installation, you should see the authentication page.
Pi-Hole Configuration
When logged in the web interface, you will arrive to the dashboard showing information about the usage.
There are different ways to configure this to use Pi-Hole as DNS provider on your local network devices:
- You update the DNS address in your router to the local address of your Pi-Hole. The whole network will be covered.
- You manually configure each device. Practical if you want certain devices to use or to not use Pi-Hole.
- You use Pi-Hole’s DHCP server. Recommended when it is not possible to update the DNS server directly on your router. The whole network will be covered.
In my case, I will use the last solution.
On the left bar, you can click directly on Settings to finish the configuration. First, I would like to keep the same range of IP addresses as my router (from 192.168.1.20 to 100) when using Pi-Hole’s DHCP server. In DHCP tab, it is possible to configure it. I will also copy/paste the same static IP addresses configuration as in my router. Before activating Pi-Hole DHCP server by saving the settings, you have to deactivate the DHCP server of your router.
Then, to apply the new settings on the devices, you can disconnect from the network and reconnect. Afterwards, by doing ipconfig /all if you are using Windows, you can see that the DHCP and DNS server have as addresses, the Pi-Hole server.
Add lists
To add a blocking list, you need to go to the Adlist tab and copy/paste the link to the actual one you want to use. The listing under shows the one enabled.
On the second line I just added, we can see that the status is “unset” with the question mark (?). It is because we need to update the database with the new list that we added. Then, on the left menu, go to Tools -> Update Gravity and click on Update. The new websites will be added to the blacklist.
Now, the status is active.
Get a static IP in Ubuntu
In my case, each time I was rebooting the router or the Odroid, an IP was not allocated despite the fact at I specified a static IP with the MAC address in the router. I had to force Ubuntu to set one.
In the latest Ubuntu version (22.04 in this example), Netplan is the default network management tool. Then, we need to write a YAML config file to specify the parameters. Here below, one example where you replace in addresses: the IP address that you want to allocate to your device, gateway4: the IP address of your router.
network:
version: 2
renderer: NetworkManager # or systemd-networkd
ethernets:
eth0:
dhcp4: no
addresses:
- 192.168.x.y/24
gateway4: 192.168.a.b
This file needs to be saved in /etc/netplan/. You can name it as you wish but by convention, it should start with a number like 01- to set priority if you have more than one.
To be sure that the YAML syntax is correct (no trailing spaces, tabs, etc.), we can test the settings file with: sudo netplan try. If no error is detected, it will propose you to confirm the changes.
Remove all logs
For some privacy, you would like that Pi-Hole is not recording everything you visited or what has been blocked. You can disable logging in Settings -> System -> Disable query logging. You can also increase the privacy settings in Privacy tab, with the anonymous mode.
If you want to flush logs, with the button in the System tab menu, it will remove the last 24 hours.
NOTE: Be careful with the rm command, since there is no confirmation when deleting files or folders. Always keep backup if you are not sure.
To remove the complete records, proceed as follow:
sudo service pihole-FTL stop
sudo rm /etc/pihole/pihole-FTL.db
sudo service pihole-FTL start
This will delete the logs in the first place. The second place is in /var/log/pihole.
sudo rm /var/log/pihole/*
Hope this helps!
FrenchSavvy 