PI Hole on large network.

[ICT_GUY]

I have been using DNS filtering at home for years. SWGFL have never offered advert filtering as a service. We have a 1Gbs FTTP on the network

 

Also PSHE classes didn't like penis enlargement adverts last year showing up in their browsers. :-) This spurned me to invest some time and effort into the filtering.

 

Anyhow I decided to install pihole on a 1GB Pi4b as the first forwarder for both of our DNS servers.

 

The second and third forwarders remained unchanged. So if the PiHole dies internet connectivity isn't lost.

We have up to 500 devices, 30 classrooms on the network.

 

Did it work? Hell yes.

 

There has been a significant drop in adverts on all websites for all devices.

 

It is only a quality of life improvement so if it fails, it is not the end of the world.

 

In testing, I added a second pi3b Pihole, the pi 4 is answering all of the requests like a champ, and the second one is not being called upon. Again an "expert" said that the pi4 would not cope with the traffic.

 

I was told wrongly (by internet "experts")that DNS forwards in Windows server are not done in order of preference. This is not the case, and I confirmed it under testing, and via MS documentation.

 

The pi 4 is answering around 5k queries per hour without ever being over 1% load and using just 15% of available memory.

 

Future improvements are to immediately to swap over the micro sd card for a high endurance one. Possibly add an SSD but I am torn between using a Micro sd card that might die or a USB SSD adapter that might not like being on 24hrs a day.

 

Further in the future, I may swap it over to a VM or a pi 5 with NVME.

 

To be fair though, I'm interested to see how it holds up over the next few months.

 

Only downsides so far have been I could only install the pihole software from a normal internet connection. This is probably some port being blocked or the SSL filtering playing up. Even using the -k switch didn't work. I am using the swgfl nossl unfiltered proxy.

 

Updates are fine as long as I set curl to use a proxy.

 

The gravity updates seem to like to be run from the command line, not the web interface. Still, I will work that one out.

 

Anyhow, I thought I would share, it might help someone out.

[3s-gtech]

My only concern would be constant small writes killing the cards, as you've mentioned. I use RPis for door control, and even then the cards will die eventually. Quality cards make a big difference, but in the chain where you've placed yours I'd definitely use an NVMe SSD.

 

Next step - document the hell out of it, for your piece of mind and sanity if it dies and you need to rebuild it!

[ICT_GUY]

I have documented it.

It has a good quality card in there at the moment (extreme pro), a high-endurance one is going in tomorrow.

I am 95% sure I am going to go with a USB SSD when the card dies. Failing that I may try a BRIX pc with denbian on it.

[jthompson]

This may become more and more relevant given Google's intent to cripple ad-blocker extensions.

 

https://arstechnica.com/gadgets/2023/11/google-chrome-will-limit-ad-blockers-starting-june-2024/

 

Google originally went with a completely crippling limit of 5,000 "dynamic" rules, and after the widespread outrage during its first attempt to push Manifest V3, the company upgraded filtering to a "more generous" limit of 30,000 rules. uBlock Origin comes with about 300,000-plus filtering rules you can enable, and you can also import additional blocking lists and have that number skyrocket.

[andy_b]

I would probably just spin you a Ubuntu VM on Hyper-V and add pihole to that if you are worried longevity.

 

The DNS forwards order thing might be some confusion between forwards and "Primary/Secondary" DNS servers. Certainly Primary and Secondary DNS doesn't repect "order/fail over" quite like you'd imagine.

[Davit2005]

There is a way I have seen on YouTube to get some sort of sync I think it was Jeff Geerling. I run 2 at home but I have not setup any update syncing yet everything goes through them at home and they are configured for DNS over HTTPS.

[ICT_GUY]

I would probably just spin you a Ubuntu VM on Hyper-V and add pihole to that if you are worried longevity.

 

The DNS forwards order thing might be some confusion between forwards and "Primary/Secondary" DNS servers. Certainly Primary and Secondary DNS doesn't repect "order/fail over" quite like you'd imagine.

 

I checked the documentation. They go through the forwarders in order on the Domain DNS servers.

This has been confirmed on the PIs as the second one has not had any queries apart from dns checking it is alive.

 

VM is probably the way to go. But then again, you should see the DC budget :-)

[jthompson]

What sort of overall bandwidth savings have you noticed?

[DrCheese]

Yeah.. if I was running these in "enterprise" I wouldn't be running them on pi's - Slap up a Linux VM and run it on proper hardware.

[Chuckster]

Did this at my last place of work.

 

Installed both Pi-hole and Adguard in 2 separate VMs, which drastically reduced the amount of ads end users were seeing.

 

Additionally, uBlock Origin and Ghostery extensions were deployed to both Chrome and Edge to mitigate further ads from being loaded and seen.

 

All in all we had 3 DNS forwarders: Pi-hole, Adguard and Sophos UTM. The latter just about upgraded to XG prior to my leaving.

[ICT_GUY]

Yeah.. if I was running these in "enterprise" I wouldn't be running them on pi's - Slap up a Linux VM and run it on proper hardware.

It's a Primary school.

We work with the budget we have.

:-)

[ICT_GUY]

What sort of overall bandwidth savings have you noticed?

 

It's blocking around 19% of all queries, bandwidth wise couldn't give you exact numbers. However, websites are faster to load and no penis enlargement adverts. Though to be fair we didn't get to much of that, swgfl filtering is not terrible. It's more about stopping distracting adverts, giving a little bit of protection from dodgy websites and improving user experience.

[3s-gtech]

If it's a disposable device, with fallback, I don't see the harm of using something like a Pi. Anything you can do to make it a bit more reliable is good, and obviously it needs to fit into patch and update management (which it should with this software!)

[DrCheese]

It's a Primary school.

We work with the budget we have.

:-)

 

ah Fair enough. I would just have an SD card ready to go, or run it via an SSD/NvMe to avoid the write limits.

[ICT_GUY]

Im swapping over to a 128gb USB SSD.

Its going to be a long time before writes make that unusable.

[ICT_GUY]

If it's a disposable device, with fallback, I don't see the harm of using something like a Pi. Anything you can do to make it a bit more reliable is good, and obviously it needs to fit into patch and update management (which it should with this software!)

 

Its also sitting in an air conditioned server room with in a fanless case. To be fair PIs can run for 5 - 10 years without a hardware failure. It's a £35 device so you are right it is disposable.

 

The weakest link will be the micro SD card and I am swapping that out today.

 

And if it fails the network keeps going and its only two settings to change and it was never there. I agree with you, if it works and is reliable its good enough for primary work.

[3s-gtech]

I have 25 or so Pis in active, permanent service. They are more reliable than the bloody PCs! The SD cards, not so much [emoji28]

[ICT_GUY]

Do you use the endurance cards or standard ones?

[3s-gtech]

Mixed brands of standard. Poor results with Kingston, decent with Sandisk (but not dodgy Amazon copies of either!)

 

Eventually they fail to boot with bad sectors and won’t reformat.

 

Biggest PITA is rebuilding, so reliability is desirable!

[dmj]

There's a container build for this if you're worried about reliability/failover; https://github.com/pi-hole/docker-pi-hole

[Davit2005]

I have a few docker hosts at home running on Lenovo ThinkStation Tiny PCs with PiHole containers on each host amongst other things. Using Docker compose then backing up the config files should mean easy restore in the event of host failure.

[mjs_mjs]

So i've just come off a job (I now work in events) where I was running PiHole as our internal DNS, (main and backup in VM's on different hosts) - it wasn't my original plan but we were where we were.

 

We weren't doing Ad filtering - but some local redirects and then forward to upstream.

 

FTL was quite happy with the load (which was in the millions of requests a day) but over 6 weeks, the SQLite db became large, and the PiHole interface (or rather PHP) would run out of RAM processing long term data. I was able to query the db from command line directly, and yeah I did increase the mem lim to 2048 without fix.

 

Host's was an EPYC 32c/64t, 256GB DDR4 RAM, NVME storage with the VM's getting 4 cores, 8 GB RAM and a 50 GB disk.

 

We also saw that the windows DNS was an ordered list, so no client side load ballance.

[ICT_GUY]

Well its been working for two weeks.

With the lists below 36% of all forwarded dns queries are being blocked. Installing a fresh copy of PIHOLE from scratch is now down to around 15 minutes. Keeping in mind that if it fails everything keeps working, just without the ad blocking.

Loading on the 1GB pi4 is virtually non-existent. 16% memory and hovering around 1%cpu.

 

The lists I am using, have a mixture of privacy, anti-malware, and safeguarding. It's not perfect, just an added layer of protection and quality of life improvement.

https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/pro.txt

https://raw.githubusercontent.com/RPiList/specials/master/Blocklisten/child-protection

https://adguardteam.github.io/AdGuardSDNSFilter/Filters/filter.txt

https://v.firebog.net/hosts/Prigent-Ads.txt

https://raw.githubusercontent.com/FadeMind/hosts.extras/master/add.Spam/hosts

https://adaway.org/hosts.txt

https://v.firebog.net/hosts/Easylist.txt

https://raw.githubusercontent.com/PolishFiltersTeam/KADhosts/master/KADhosts.txt

https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts

[3s-gtech]

Got a step by step? I will have a ton of RPi 3 spare soon, despite the capability drop I fancy playing at it.

[ICT_GUY]

https://docs.pi-hole.net/main/basic-install/

I used the lite version of pi os.

I am assuming you are aquainted with linux command line.

You can SSH straight into the pi from windows command line ussing ssh username@ipaddress

Set the options when you use the pi imager, enable SSH, set username and password.

sudo raspi-config to set proxy settings if at work, not needed at home.

export http_proxy=http://insert schools proxy preferably a system unfiltered one again if at work.

Follow the guide I linked to which will get you 99% there.

sudo pihole -a -p to reset the web interface password.

Thats all you really need to get started.