Pihole

Only do that if your pihole is on the LAN and not directly connected to the internet.

sudo apt update
sudo apt upgrade
#answer Y

wget -O basic-install.sh https://install.pi-hole.net
#read and be confident of the content first, or simply just run :
sudo bash basic-install.sh

#disable wifi and bluetooth on 3B, 3B+, 3A+, 4B and Zero W
echo "dtoverlay=disable-wifi" | sudo tee -a /boot/config.txt
echo "dtoverlay=disable-bt" | sudo tee -a /boot/config.txt
sudo systemctl disable hciuart

#utilities
sudo apt -y install crudini vim

# add few lists
cd ~
wget https://raw.githubusercontent.com/jpgpi250/piholemanual/master/NextDNS.sh
wget https://raw.githubusercontent.com/jpgpi250/piholemanual/master/AdguardTeam.sh
wget https://raw.githubusercontent.com/jpgpi250/piholemanual/master/firebog.sh
wget wget https://raw.githubusercontent.com/jpgpi250/piholemanual/master/quidsup.sh
#we do not use ipv6
#https://raw.githubusercontent.com/jpgpi250/piholemanual/master/IPv6check.sh
sudo chmod +x /home/pi/NextDNS.sh /home/pi/AdguardTeam.sh /home/pi/firebog.sh /home/pi/quidsup.sh

# insert other lists.
sudo pihole-FTL sqlite3 /etc/pihole/gravity.db
insert or ignore into adlist (address, enabled)
values ('http://someonewhocares.org/hosts/hosts', 1);
insert or ignore into adlist (address, enabled)
values ('http://v.firebog.net/hosts/Easyprivacy.txt', 1);
insert or ignore into adlist (address, enabled)
values ('https://raw.githubusercontent.com/hoshsadiq/adblock-nocoin-list/master/hosts.txt', 1);
insert or ignore into adlist (address, enabled)
values ('https://gitlab.com/ZeroDot1/CoinBlockerLists/raw/master/list.txt', 1);
insert or ignore into adlist (address, enabled)
values ('file:///home/pi/quidsup/notrack-blocklist.txt', 1);
insert or ignore into adlist (address, enabled)
values ('file:///home/pi/quidsup/notrack-malware.txt', 1);
.quit

# take into accoutn all the list we added
pihole -g
# flush local dns cache
ipconfig /flushdns

# watchdog
# Enable watchdog to send mails, whenever triggered:
sudo apt-get -y install watchdog
sudo sed -i -r 's/^#?max-load-5.*/max-load-5 = 18/' /etc/watchdog.conf
sudo sed -i -r 's/^#?max-load-15.*/max-load-15 = 12/' /etc/watchdog.conf
sudo sed -i -r 's/^#?watchdog-device.*/watchdog-device = \/dev\/watchdog/' /etc/watchdog.conf
sudo sed -i -r 's/^#?watchdog-timeout.*/watchdog-timeout = 15/' /etc/watchdog.conf
sudo systemctl restart watchdog.service

#use schedtools to optimize CPU for some process
sudo apt-get -y install schedtool

#install need restart
sudo apt-get -y install needrestart
sudo sed -i 's/#$nrconf{kernelhints} = .*/$nrconf{kernelhints} = 0;/'  /etc/needrestart/needrestart.conf
sudo sed -i 's/#$nrconf{ucodehints} = 0;/$nrconf{ucodehints} = 0;/'  /etc/needrestart/needrestart.conf
cd ~
wget https://raw.githubusercontent.com/jpgpi250/piholemanual/master/needrestart.sh
chown +x /home/pi/needrestart.sh

# random generator

# cron entries
echo "
30 23 * * 6 root PATH="$PATH:/home/pi/" /home/pi/NextDNS.sh >/dev/null 2>&1
30 5 * * * root PATH="$PATH:/home/pi/" /home/pi/needrestart.sh >/dev/null 2>&1" | sudo tee /etc/cron.d/pihole

#mail setup
sudo apt-get -y install msmtp
sudo ln -s /usr/bin/msmtp /usr/lib/sendmail
echo "
defaults
tls on
auth off
host YOURSMELANIP
port 25
aliases /etc/aliases
account default
from pi@pi.hole"| sudo tee /etc/msmtprc

sudo sed -i  '/^default:/d' /etc/aliases || true
pi@pihole:~ $ echo "default:YOURADMINEMAIL" | sudo tee -a /etc/aliases

# protect your pi
# we assume you already changed the default password, and configured the pi to only accept your rsa key, no password for ssh
sudo sed -i 's/#net.ipv4.conf.default.rp_filter=1/net.ipv4.conf.default.rp_filter=1/' /etc/sysctl.conf
sudo sed -i 's/#net.ipv4.conf.all.rp_filter=1/net.ipv4.conf.all.rp_filter=1/' /etc/sysctl.conf
sudo sed -i 's/#net.ipv4.conf.all.accept_redirects = 0/net.ipv4.conf.all.accept_redirects = 0/' /etc/sysctl.conf
sudo sed -i 's/#net.ipv6.conf.all.accept_redirects = 0/net.ipv6.conf.all.accept_redirects = 0/' /etc/sysctl.conf
sudo sed -i 's/#net.ipv4.conf.all.send_redirects = 0/net.ipv4.conf.all.send_redirects = 0/' /etc/sysctl.conf
sudo sed -i 's/#net.ipv4.conf.all.accept_source_route = 0/net.ipv4.conf.all.accept_source_route = 0/' /etc/sysctl.conf
sudo sed -i 's/#net.ipv6.conf.all.accept_source_route = 0/net.ipv6.conf.all.accept_source_route = 0/' /etc/sysctl.conf

sudo reboot

www.msftncsi.com
dns.msftncsi.com
ipv6.msftncsi.com
www.msftconnecttest.com
ipv6.msftconnecttest.com

yum --enablerepo=smecontribs install smeserver-dhcpmanager

nslookup flurry.com

Pihole

Contents

Install Pihole on a dedicated raspberrypi

Install OS

Configure a static IP

Install pihole

Setup your pihole for a SSL certificate

Tweak pihole using cli

Tweak pihole using web interface

windows update

allow dns filtering for your vpn clients

additional tweak

Setup your SME to give pihole as DNS for your network, for machines using DHCP

Setup your static IP machines to use

Setup SME firewall /router firewall to filter/redirect DNS request

Why using SME Server as upstream server, and pihole only given by the dhcpd service to LAN

Testing your Pi-hole installation

References

Navigation menu

Search

	Work in Progress:
	unnilennium has marked this page as a Work in Progress. The contents off this page may be in flux, please have a look at this page history the to see list of changes.

	Note:
	TODO - See Below - but note still under developement