Pi-hole v6

[andy_xor_andrew]

I set up pi-hole recently after hearing about it for years. I was kind of surprised at a lack of really basic features (imo):

There isn't any kind of "dry run" or "phantom" mode, where requests are not actually blocked, but appear marked in the log UI as "would be blocked". This is super important because I want to see all the things my home network is doing that would be blocked before I actually hit the big red button. I want to fix up the allow/denylist before going live.

It's also not possible (or not clear) how to have different behavior for different clients. For my "smart tv" which I begrudgingly have to allow on my network occasionally for software updates, I want to treat it with the strictest possible list. But for my phone, I don't want that same list. There's a concept of "groups" so perhaps this is user error on my part, but the UI does not make this clear.

[MyOutfitIsVague]

> It's also not possible (or not clear) how to have different behavior for different clients

There's a menu item for that: Clients. You create a group, add a client to that group, and configure blocking for that group. To have what you want, you create a group that has just one client in it.

[windexh8er]

One of the most values I get out of a SaaS service is NextDNS [0]. There are competitors like ControlD [1] that are also very good. At the end of the day they both check all the boxes for me.

But, the piece that really got me with NextDNS when I started using it was the unlimited number of profiles. This allows me to target any device, no matter where it is (this is fantastic for mobile devices) and keep my filtering lists in place. I selfhost a lot but still find the annual cost of NextDNS more than fair.

[0] https://nextdns.io/ [1] https://controld.com/

[ge96]

I think I'll never buy a smart TV what an ultimate ahole move to put ads in there. It's like the Kindles where you have to read these ads before you can open your book (of course you can pay a 1-time fee). Like buying a movie on YouTube and having to watch ads in it or can't see full res unless you're on an allowed device. If UBO actually stops working on Chrome I'll either leave or use pihole.

My cheap android phone installs games by itself eg. candy crush ugh. My own fault I get it buy a $2K phone instead of $160

[josephg]

> For my "smart tv" which I begrudgingly have to allow on my network occasionally for software updates

Why install software updates if you don’t use the “smart” features? Our smart tv has been banned from the internet for years.

[BHSPitMonkey]

Is a DNS blackhole the right way to restrict your TV from doing bad things? The software running on the device might not even use DNS lookups to connect to hosts as it pleases. Your router is probably the better place to add guardrails.

[btreecat]

There's also adguard home

https://adguard.com/en/adguard-home/overview.html

[guhcampos]

I think [1] is quite irrelevant to be honest. Blocking DNS isn't a destructive operation. I've been using pi-hole for years and I simply block everything and cherry-pick a few exceptions here and there when something breaks. I only had to really troubleshoot maybe 3-4 times in years, and half of that were related to the fact I worked for companies that had domains blocked.

[jkingsman]

I think log-don't-enforce and per-client block profiles are probably basic to people who work with networking regularly, but are probably pretty far out of reach for the average home user who are probably needing to expand their networking knowledge just to distribute custom DNS via DHCP.

So, I agree that those would be lovely features but are, I think, a ways beyond what I would assume the p90 of pihole users would need or be able to use.

[bdcp]

For the seconds question, it is indeed Groups. I have my SO's phone bypass everything. It's the way she wants it.

Yea i agree it's not super UX friendly.

[everdrive]

You can definitely set client groups, either based on CIDR, MAC (if on the same network segment) or individual IP. From there, you can assign different domains and list to the specific groups.

[nkrisc]

The way I handled this issue for my family and devices is just by having two SSIDs - one with pihole blocking and one without. If it’s interfering with something me or my wife can just switch to the unblocked network temporarily.

[NoPicklez]

You'd be hard pressed to find that an auditing mode would be helpful. Even once you hit that big red button, depending on the blocklists you use you will come across false positives that cause issues.

[Mekoloto]

You need to put your SmartTV on a different VLan.

The biggest risk is not samsung knowing what someone watched but what devices you have on your lan

[simooooo]

Adguard home seems to be better in every way. Not sure if this is a feature though.

[LeoPanthera]

I've been using AdGuard Home, which does pretty much the same thing, but is slightly better polished, with things like support for DoH and OSs other than Linux.

https://github.com/AdguardTeam/AdGuardHome

[laweijfmvo]

I went from PiHole -> AdGuard -> NextDNS. My patience for tinkering and maintaining wasn't high enough to not just pay someone else to do it :)

[brynx97]

DoH is possible on pihole using cloudflared-- https://docs.pi-hole.net/guides/dns/cloudflared/.

> The cloudflared binary will also work with other DoH providers.

[2OEH8eoCRo0]

I love AdGuard Home but the single binary container from a Russian company makes me nervous. I may move to building it myself. Is this criticism unfair?

[roger_]

I moved to AGH a while ago too.

Is there anything in Pi-Hole v6 that would make someone switch back?

[zzyzxd]

And it's much easier to customize.

- I run it in Kubernetes with multiple replicas behind a load balancer for high availability.

- A companion iOS shortcut for family members to temporarily pause protection on all replicas for online shopping.

- Configuration as code, which gets mounted as a secret.

- Query logs from all replicas forwarded to loki for visualization and performance review.

[nocchedure]

Pet peeve: I wish there was an (easy) way of installing Adguard directly on my Dream Machine.

[febrianrendak]

I don't know why but adguard often just freeze and need to be restarted. Maybe due my device is old enough (Pi 1). But Pihole + cloudflared run flawlessly.

[mattrighetti]

Switched to AGH too a few years ago because from time to time pi-hole would get stuck upon unplanned reboots of the Raspberry Pis on which I had it installed

[lawn]

I even run Adguard Home on my router that runs opnsense.

[Mossy9]

Pi-hole is such a great tool. I've been running it for a few years on a raspberry pi zero, and am constantly astonished by the sheer amount of cruft it blocks for me.

Congratulations to the team for the release - happy to support you via Patreon!

[hk1337]

I have had many times click an article link on reddit where everyone in the post comments complains about how the site is riddled with ads that it makes it unreadable and all I see is the article with a lot of whitespace.

[_fat_santa]

Pi-hole is a killer application and I've loved it since I got it setup. One other app I highly recommend to run on your Pi in addition to Pi-hole is Nginx Proxy Manager[1].

[1]: https://nginxproxymanager.com/

[robk]

Do yourself a favor and move from nginx to caddy

[yard2010]

Nginx Proxy Manager is a great piece of software!

[seanp2k2]

I’ve been happy with AdGuard Home on two Pi4s and a little home server for years now: https://adguard.com/en/adguard-home/overview.html

I have some scripts to sync config between them and a Jenkins job if I want to pause blocking on them for a bit.

It looks like https://github.com/mattwebbio/orbital-sync and https://github.com/lovelaze/nebula-sync can sync configs with Pi-hole 6 now, but it’s quite a bit of code for what looks like just a few HTTP requests to get the config from one using the teleporter feature, then restore it on the others using the same.

[seemaze]

A Raspberry Pi with Alpine Linux makes a sweet little DNS server. AdGuard Home is even packaged in the testing branch[0] these days

[0] https://pkgs.alpinelinux.org/packages?name=adguardhome&arch=

[jccalhoun]

I've been using Technitium for a couple years and been pretty happy with it https://technitium.com/dns/

[JamesBrooks]

I moved from pihole to Technitium a few months back because I wanted more DNS features than just adding A and CNAME records.

For example the split horizon features to return different responses to DNS queries depending if I'm connected to my Tailscale network or not has been pretty slick.

I documented that process here in case anyone is interested: https://blog.jamesbrooks.net/posts/technitium-dns-server-wit...

[malmeloo]

Technitium is great. Rock solid, plenty performant and it has more features than you'll ever need. Pretty wild when you consider it's being maintained by a single dev.

[bjoli]

So have I. I found it more approachable once I started having more advanced configurations.

[2bluesc]

Switched to Technitium (from piHole via Docker on amd64 and manual dnsmasq before that) primarily for DNS over HTTPS and never looked back. Used it for DHCP and DNS.

[eamag]

Want to highlight https://nextdns.io/ as a similar service, very happy with it

[poisonborz]

Pihole being a self-hosted service and this being a third party one, I would say the target group is somewhat different.

[zymhan]

Pi-hole isn't a "service" though. It's just FOSS.

[hk1337]

This actually seems rather nice. Not the same as PiHole but I can see its upsides.

One upside I like about PiHole is that I can set it up to distribute the DNS to all my devices. This seems like I have to manually configure each device?

ATT doesn't let you set the IPv6 DNS, so I either have to disable IPv6 on the network or setup PiHole to pass IPv6 and the DNS I want to the device.

[system7rocks]

Same for me.

I had Adguard running on a Pi 2 I think and it died. Couldn’t access my network remotely. Learned my lesson and switched to NextDNS on a bit more solid device.

[shmoogy]

If only they had a stop blocking function.

[zymhan]

> The web interface has been completely overhauled with settings split into Basic and Expert modes. This allows users to customize their experience based on their comfort level and needs.

This sounds helpful for setting up a Pi-Hole for family or friends that aren't DNS admins by day.

[Sohcahtoa82]

I love PiHole.

I run my PiHole on a small cloud VM that I use for several projects, but put it behind a VPN that's configured to only forward DNS lookups, then VPN into it from my phone. So many advantages behind this setup.

- Since only DNS lookups are tunneled, I don't have to worry about tunneling ALL my traffic and paying egress fees

- Blocks ads in ALL apps, not just my browser

- If it's acting up, I can just disconnect from the VPN to disable PiHoling

- Don't have to expose my home IP address and open a port for the world to start banging on

[TheArcane]

> Don't have to expose my home IP address and open a port for the world to start banging on

Is that really an issue if all you're exposing is the VPN port? Wireguard for instance has industrial-grade encryption. Even open port 51820 should be fine

[TriangleEdge]

I have a script update my hosts file to route domains to 0.0.0.0 and ::0 . I get the domains from https://github.com/StevenBlack/hosts.

[precommunicator]

The point of pihole is setup blocking on multiple devices though, some of them which you don't control like your PC e.g. smart tvs

[unsnap_biceps]

Does anyone know if pihole is ever going to add DoH or similar support natively? I've had such troubles with cloudflared awhile back that I gave up on DoH, but would love to encrypt those queries.

[newman314]

You can insert dnscrypt-proxy inline between PiHole and an upstream server. So it'll work something like the following:

Client --DNS--> pinhole --DNS--> dnscrypt-proxy (localhost) --DoH--> upstream

Not the prettiest but it works.

[chgs]

I’m not sure why I’d ever want DoH, I block as much as I can at my firewall and have a canary domain.

I want my devices to use my defined dns sever on my network, not some ad company (and all tech companies eventually become ad companies)

[zamubafoo]

I've been using https://github.com/DNSCrypt/doh-server for serving my DNS server via DOH for at least 2 years. Only had two issues with it and both were due to lack of maintenance on my part (ie. not updating the binary for one and then not re-configuring it after I changed configurations for the upstream DNS).

[hotpocket777]

Assuming doh = dns over http

[plg]

love pi-hole

we block all meta and X properties from our home network, also ads

and it's self hosted on our own metal

it's a wonderful life

[andrewinardeer]

> we block all meta and X properties from our home network, also ads

There's a difference between meta, X and ads?

[google234123]

Good way to teach other members of your house to use VPNs to bypass your censorship regime

[wkyleg]

In my experience Pi hole is a very worthwhile investment. People who used my internet when I had one would remark how much faster it was. Everything in general seems faster, even things that you wouldn't think of. I typically use Brave for browsing which has good ad blocking capabilities, but this adds a whole additional layer.

The only reason I don't use one now is that I travel a lot more so it's irrelevant, and I have to work enough on tools with Google/Vercel/other analytics that it is just very inconvenient.

Regarding smart TVs, I have found that it's better to just use an Apple TV or Kodi box and never connect to them internet though. Having said, I gave my TV away because I never used it, so this might not be as up to date. A Pi hole will block ads on smart TVs though.

[Salgat]

I used to love pihole, but it seems like it's more trouble than it's worth now. Advertisers have wised up and will use the same subdomain for both content and ads. I've also had issues with normal website functionality being broken due to pihole which isn't fun for my wife. It seems mostly useful for blocking background traffic on smart devices, not so much for ads.

[_chris_]

Wouldn’t a smart tv do something ... smarter than just using the default dns given to it by the network?

I’m not up to speed on this stuff but I thought pihole only blocked the simplest stuff from devices that play nice?

[Shadowmist]

I had an Apple TV connected to a TCL Roku TV and the TV was analyzing video frames from the AppleTV to popup ads suggesting to watch the same content on other streaming services.

[ProllyInfamous]

I make these suggestion during all conversations about PiHoles:

Use Class A2 SDmicro cards (they'll last significantly longer... particularly if you keep logs). There are additional 3rd-party installations which can write into RAM, but IMHO it's easier for most new users to just buy better NANDs.

Set up more than one physical Raspberry Pi, running multiple versions of PiHole software on multiple IP addresses.

Have your main DHCP router auto-issue DNS information for your "most permissive" PiHole, with a minimal list of choice URL-blocks (e.g. pagead2.* , doubleclick). Individual clients can then manually change DNS server to 2nd (3rd... 4th...) PiHole(s) which are each more-restrictive.

This allows non-technical users to still browse somewhat ad-free, but also won't block banking/govt/etc for novices. As a failsafe, teach users to enter your router's IP as DNS x.x.x.1 [should they ever need to bypass local filtering, entirely].

I use sequential IP addresses [192.168.0.6, x.x.x.7, x.x.x.8, x.x.x.9] so it's easier to explain/teach my networks ad-blocking capabilities. YES, I understand that Pi-Hole allows different clients to follow different rulesets, but if you can afford to buy redundant hardware it's just so much easier to change the client DNS server information when a specific website isn't working correctly [due to erroneously blocked host].

[kmfrk]

Lots of great memories using Pi-hole and messing with RPi. I eventually ended up putting my devices on Tailscale and managing DNS through it, eventually using Mullvad VPN as the exit node.

Pretty good interface, and most people just have to connect using the app. Having a virtual network between devices with dedicated IPs is pretty nice too.

[lanthade]

The big feature miss for me in this announcement is baked in support for configuration sync between servers. Redundant DNS is common and it would be nice if pi-hole supported this oob. Making it even better would be an ability to see stats across all synced servers from one location.

[reboot81]

I’m using https://github.com/ShiromMakkad/docker-pihole-sync To sync my two piholes. But I haven’t figured out how to keep my third pihole (ip-failover) to get in the loop…

[urbanporcupine]

I am a beginner and never used Pi-Hole before.

I checked that Pi-Hole can run on Raspberry pi zero as per the GitHub. But would you recommend to use Raspberry Pi 5 2 GB or 4 GB RAM instead of Raspberry Pi zero. I don't have any Raspberry Pi and I intend to make a new purchase.

[theshrike79]

The 5 is completely overpowered and overpriced to run Pi-hole. Go with the zero instead.

[unethical_ban]

Slightly off topic, but it annoys me that protonvpn does not allow split tunnel of DNS to an internal host. It calls this DNS leak protection, which is a good default. But I want to run my own DNS server and I know what I'm doing, and the Proton GUI won't let me.

[aspenmayer]

The GUI app should have a custom DNS option:

https://protonvpn.com/support/custom-dns

[Netcob]

Finally a REST API!

I've been waiting for this - I wanted to play around with blocking distractions on various rules, but controlling pi-hole remotely was a huge pain and often didn't work until now.

[nirav72]

Have they added more to the existing API? They already had an http API to enable/disable blocking.

[dmacvicar]

I do something similar to Pi-Hole using plain dnsmasq.

I use two old PINE64 (one with FreeBSD, one NetBSD to make it more fun), and the Ansible configuration downloads https://github.com/ShadowWhisperer/BlockLists and creates a file dnsmasq can use. Which lists from the repo to use is defined as a variable.

Works very well and I feel I can understand what is going on.

[RandomDistort]

Not sure if this is the right place to ask, but I've got a semi-obscure DNS question.

I'd like to use Cloudflare's Zero Trust DNS filtering with DoH by running a DNS proxy on my network.

I can get this to work great with github.com/adguardTeam/dnsproxy (running on a Pi 4B) but what I would really like is to have different devices (based on their IP on the network) get their queries forwarded onto a different DoH upstream.

Is this possible in a simple way?

[woleium]

Perplexity thinks so:

https://www.perplexity.ai/search/i-d-like-to-use-cloudflare-...

[ConanRus]

We’ve integrated a new REST API and embedded web server directly into the pihole-FTL binary. This eliminates the need for lighttpd and PHP"

oh noes!

[mrbluecoat]

5+ year development cycle. Impressive! https://pi-hole.net/blog/2023/10/09/pi-hole-v6-beta-testing/

Any details on what HTTPS support provides, other than a TLS connection to the admin dashboard?

[thomassmith65]

That works for me. It means I don't need to relearn everything every year, and the major versions probably won't be riddled with bugs.

[eellpp]

Have used pi hole for over 5 years and very happy with it. Most times I use it via phone to manage kids devices to block/unblock access etc and this also works quite well . Thank you very much

[miningape]

Ha! I bought a Pi5 as a Christmas present for myself, I've only done some basic setup and gotten sidetracked by other projects - but setting up pi-hole is near the top of my list of sh*t to get done

[edm0nd]

It's suuuper easy to setup pihole on it. Takes literally 1 curl request and then like 3 minutes.

[sizzle]

Will it block YouTube ads?

[ProllyInfamous]

I've had the same PiHole rule (for years!) which blocks all the text-splash-over-ads... but it becomes very cat and mouse if you want to block the pre-roll video ads (any rule that initial works... won't for very long).

Instead, use yout-ube.com [insert a hyphen into any URL] and ALL ads disappear.

[10729287]

Short answer : no.

[ncrmro]

Nice.

I wish pihole or adguard would add support for change DNS records based on the query subnet. I believe this is called DNS views.

That way my local devices and wireguard devices can get the correct IP for internal services.

[VTimofeenko]

In unbound those are indeed views[1]. I moved from pihole to unbound+nsd a couple of years ago for precisely this use case. Block filters courtesy of[2].

[1]: https://unbound.docs.nlnetlabs.nl/en/latest/topics/filtering...

[2]: https://github.com/StevenBlack/hosts

[Marsymars]

I managed this by getting a gTLD (digit-only .xyz is cheapest) for internal-only services and then running a Caddy instance to reverse-proxy to my internal services. I don't port forward or open ports to that Caddy instance, so it's not available externally.

[dpacmittal]

With ddwrt and adguard, it took a while to setup but I can ping all my devices with <hostname>.lan.

[kayson]

I wish pfblocker-ng was as easy to use and polished as pihole. It seems silly to run an extra DNS resolver if I'm already running one on pfsense, but the interface makes it tempting

[Havoc]

Can it do native dns over http yet? Without hacky unbound proxy I mean.

That’s why I switched to affairs home but wouldn’t mind switching back

[TZVdosOWs3kZHus]

Came here to give a big THANK YOU to everyone making this project possible.

I am using Pi-Hole for about 8 years and can't imagine a world without it.

Another big THANK YOU to all list maintainers out there. You're doing an incredibly useful service to the community.

[tailspin2019]

Seconded! I’ve been using it for multiple years and it is extremely good, and reliable.

There are always some features that I wish it had, but ultimately it does a really good job.

It’s easy to take for granted the hard work that goes into creating and maintaining such awesome tools.

[opengears]

if you are on openwrt i can recommend checking out unbound and adblock as alternatives (running directlly on your routers without the need of a raspberry pi)

[issafram]

FINALLY. that dev branch was out there forever

[nirav72]

Still no wildcard domain support for local DNS.

[jedisct1]

I just use dnscrypt-proxy directly.

[bangaladore]

Ironically their website has been hugged to death.

[NeckBeardPrince]

I don't think you know what irony means.

[piyuv]

Why is it ironic? They’re not providing load balancing or anything similar

[peme969]

noice