Hacker News Reader

Comment by jrm4 | Hacker News Reader

Whoa.

Customized adblocking DNS servers?

This is definitely striking me as one of those "why didn't I think of that" and "why don't we already have a lot of this?" Any ideas? Seems like you could go wild with this and do something like "Tor"ify, or "torrentify" or dare I say "blockchain" it?

Someone can probably school me on why this is harder than it sounds.

View on HN

This is what Pi-hole basically does.

And, Pi-hole is basically just dnsmasq, so you don't actually need a Raspberry Pi and the official Pi-hole software if you already have a Linux box on your home network doing other things. Just configure dnsmasq and you've got Pi-hole's functionality. With custom firmware, your Internet router can host dnsmasq, so you don't even need a separate box (this is what I use).

Yup.

I run a PiHole in the cloud so I can PiHole my phone without exposing my home network at all.

EDIT: On my phone, I do use Firefox with uBlock Origin, but the PiHole blocks ads that aren't in the browser, or use an app's browser view.

Trustworthy DNS seems so critical to security, I erred on the side of PiHole on a pi at home, self cloud hosting my DNS scarred me a bit.

My PiHole in AWS requires me to VPN into it, so DNS requests are protected by the VPN. Neither AWS or anybody in the middle can interfere with it.

I run pi hole in an x86 docker container on my NAS. No raspberry pi required, despite the name.

The reports an dynamic modifications to rule sets are a big advantage of pi hole. Sure, you can do it with dnsmasq conf files and logs, but the web UI has a lot of niceties.

Mind providing more info on how you set that up?

I think it was just this image:

https://hub.docker.com/r/pihole/pihole/

I used synology's docker app. I had to enter the port numbers into their web GUI manually.

Thanks! I have Synology as well, so that's perfect.

I think I misspoke. I understand Pi-Hole.

What I'm talking about is publicly usable adblocking DNS servers. As in instead of me at home having to install anything, just (probably clear a cache or something) and change all my DNS servers to a public reachable-by-anyone DNS server. No installation.

NextDNS, which I've been using for over 2 years now, might help in your endeavor. In addition to its stock lists of lookup rules, you are allowed to customize your own blacklists/whitelists.

Thank you for mentioning this. It's so convenient to manage that kind of filtering through a service. Works for all platforms too. I can finally bteak my reddit addiction again.

I use NextDNS but I don't use it for adblock because if it breaks a website (which happens) I need a quick way around it that isn't a DNS change. I suppose I could use another browser that uses DNS over HTTPS via Cloudflare but I've chosen Firefox and uBlock origin. I use NextDNS to block actual websites like Twitter, Reddit and occasionally HN. It is nice to support a company that provides configurable DNS.

AdGuard Home is another option along with the PiHole another commented mentioned. I have that running at home forcing all port 53 traffic to it via the firewall. So ads are blocked on all devices on the network. So easy I sometimes forget I have it running and then I browse on mobile away from home and get bombarded with ads and am reminded why I do it.

They do also have their own paid DNS service, but I haven't attempted to use it. Might be a way to deal with mobile better.

For this reason alone, I am seriously tempted by PiHole's companion, PiVPN. Browsing without this protection just seems crazy to me.

I keep my phone VPN'd to my home network via wireguard 100% of the time, pointing at my AdGuard Home hosts for DNS. This works great, the beauty of wireguard is it reconnects in under a second so it's never annoying.

You do need a reasonable upload speed to do this, though. Otherwise I guess you could use an "always free" VM at Oracle or something.

Yeah, definitely thinking about doing something similar. Was wondering about something like Zero Tier as well. I just don't use my phone all that much away from home, so it hasn't been up on the priority list.

For what it's worth, the "sometimes forget I have it running and then I browse on mobile away from home and get bombarded with ads" bothered me enough personally to attempt to smooth it over. Ended up using Tailscale DNS so that every device on my tailnet/VPN benefits. It was painless and has been solid for ~4mo now.

I think https://en.wikipedia.org/wiki/DNS_over_HTTPS really made this possible. I recently started using NextDNS and it simply gives you a custom URL to drop in your DNS configs. If we were just doing IP address DNS server lookup you'd have some severe limitations on matching up customers to servers.

It's not harder than it sounds. Pihole is used that way and can be totally owned by you, alternatively nextdns if you want an external solution.

It'd not hard and alternative DNS-es were there as long as the DNS itself, for various reasons. There are even commercial variants like OpenDNS. In all these cases, the control is in the hands of the entity maintaining the blocklists. There is no advantage in "torrentifying" (there's no much to hide) or "blockchaining" it.

It's not harder than it sounds! Pi-hole is the most popular one (could it be the most individually self-hosted FLOSS service if we don't count stuff like SSH?) but you have various options and it's not that tricky to roll your own based on dnsmasq or unbound. If you're on openwrt there are two options with Luci web-UI as well.

Reply on news.ycombinator.com