Pihole

	Work in Progress:
	unnilennium has marked this page as a Work in Progress. The contents off this page may be in flux, please have a look at this page history the to see list of changes.

This is a small how-to on how to install and configure a pihole with your SME Server 10.

There are multiple way to configure this, but we will describe at least one that could fit most uses.

Where to install pihole ? it could be on a dedicated VM, a docker image (or any other alternative, or on a dedicated bare metal system such as a raspberry pi. You do not need something too powerfull so an old Raspberry pi B with 1GB should be a start as 512 GB is the minimal according to pihole site.

Install Pihole on a dedicated raspberrypi

Install OS

First step would be to install your OS on a dedicated SD card. You need something at least 8GB, as pihole needs 2-4 GB space and minimal raspbian needs 1.4GB after install is finished.

Get pi-imager or download your image and burn it to the SD card (https://www.raspberrypi.com/software/operating-systems/).

I strongly suggest you to use pi-imager and set ssh to use only your ssh key, set your keyboard, a password etc. You could do for the wifi, but suggest keeping the good old reliable cable.

also you migh want to disable uneeded hardware : wifi and bluetooth (Raspberry Pi® 3B, 3B+, 3A+, 4B and Zero W) see

echo "dtoverlay=disable-wifi" | sudo tee -a /boot/config.txt
echo "dtoverlay=disable-bt" | sudo tee -a /boot/config.txt
sudo systemctl disable hciuart
sudo reboot

Configure a static IP

Initial loging in might be harder as you will need to find the IP of this new toy. you could refer to dhcp logs or arp from your SME. Then I strongly suggest you to get the MAC address of the interfaces and use the server-manager to set a static IP for this host. You will need a static IP latter to get this working. Also having an easy hostname to remember will help : pihole.mydomain.com

Install pihole

First remember to update your system. If raspberry OS then do once logged in :

sudo apt update
sudo apt upgrade
#answer Y

Then following pihole website simply do :

wget -O basic-install.sh https://install.pi-hole.net
#read and be confident of the content first, or simply just run :
sudo bash basic-install.sh

Folow the Installer, you will have a reminder about the static IP, if you have set the IP accordingly in SME Server with a hostname you can ignore the step of configuring it again in the installer, as dhcpd will always give the ip configured this way.

Select Custom for the Upstream DNS Provider. This is where we will use SME Server as upstream Server ! Why do we choose that ? see section below. USe SME Server Local interface IP (mostly something like 192.168.X.1)

Select your desired lists.

Select yes for the admin interface, and lighthttpd.

For privacy domain do according to your local law, and your needs see : https://docs.pi-hole.net/ftldns/privacylevels/

Relax and see the installer do the job.

Note the Password and go to your Web interface to enjoy the result.

Setup your pihole for a SSL certificate

	Note:
	TODO

Tweak pihole using interface

If you have windows machines that need updating , go to http://pi.hole and login.

Set in domain the following whitelist

www.msftncsi.com
dns.msftncsi.com
ipv6.msftncsi.com
www.msftconnecttest.com
ipv6.msftconnecttest.com

you might also read and apply some part of https://jpgpi250.github.io/piholemanual/doc/Block%20Ads%20Network-wide%20with%20A%20Raspberry%20Pi-hole.pdf

Setup your SME to give pihole as DNS for your network, for machines using DHCP

You will need to install Dhcpmanager contrib on your SME Server. Follow the procedure under install:

yum --enablerepo=smecontribs install smeserver-dhcpmanager

Go to your server-manager, and then to the panel "dhcpd", then

• set First DNS server with the pihole IP
• set Second DNS server with the pihole IP (yes twice, see below)
• leave Third DNS Server empty.
• set to enable personalized DNS servers.

Then click on save/restart, this will restart the dhcpd service with new settings.

By default SME Server will put itself as backup dns service if you only fill the pihole, this will act as a failsafe in case of pihole behing down, but could allow some requests not processed by pihole if too slow to answer,

Setup your static IP machines to use

As explained, static ip machines that have their own network information set in their own configuration (not those that rely on dhcpd to address them an IP set on SME) have not idea of what is dhcp, and hence needs you to set the dns server with the ip of your pihole.

Setup SME firewall /router firewall to filter/redirect DNS request

	Note:
	TODO

Why using SME Server as upstream server, and pihole only given by the dhcpd service to LAN

In other words, why not doing the opposite and set SME to rely on pihole?

1. you want your local services on your SME have access to a proper DNS unfiltered result.
2. you want qpsmtpd get DNS result depending on your localisation (spam and DNSBL...)
3. you do not want to rely on an external DNS service pooling requests sending them to pihole, redirecting them to your local services. There are chances that DNSBL will fail with a result too many requests.
4. you might want to be able to have some machines relying on SME result without pihole filtering.

References

• https://www.raspberrypi.com/software/operating-systems/
• https://docs.pi-hole.net/main/prerequisites/#supported-operating-systems
• https://github.com/pi-hole/pi-hole/#one-step-automated-install
• https://discourse.pi-hole.net/t/installing-pi-hole-on-existing-apache-server/43968/3
• https://github.com/jpgpi250/piholemanual
• https://jpgpi250.github.io/piholemanual/doc/Block%20Ads%20Network-wide%20with%20A%20Raspberry%20Pi-hole.pdf