681
edits
Changes
Jump to navigation
Jump to search
Line 15:
Line 15: − − also you migh want to disable uneeded hardware : wifi and bluetooth (Raspberry Pi® 3B, 3B+, 3A+, 4B and Zero W) [https://github.com/raspberrypi/firmware/blob/master/boot/overlays/README see]<syntaxhighlight lang="bash"> − echo "dtoverlay=disable-wifi" | sudo tee -a /boot/config.txt − echo "dtoverlay=disable-bt" | sudo tee -a /boot/config.txt − sudo systemctl disable hciuart − sudo reboot − </syntaxhighlight> − − + Line 36:
Line 28: − + − + Line 53:
Line 45: − + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + − + Line 62:
Line 156: − + + + + + + + + + + + + + + + + Line 79:
Line 188: − + − + + − + Line 91:
Line 201: + + + + + +
→Setup your static IP machines to use
I strongly suggest you to use pi-imager and set ssh to use only your ssh key, set your keyboard, a password etc. You could do for the wifi, but suggest keeping the good old reliable cable.
I strongly suggest you to use pi-imager and set ssh to use only your ssh key, set your keyboard, a password etc. You could do for the wifi, but suggest keeping the good old reliable cable.
=== Configure a static IP ===
=== Configure a static IP ===
Initial loging in might be harder as you will need to find the IP of this new toy. you could refer to dhcp logs or arp from your SME. Then I strongly suggest you to get the MAC address of the interfaces and use the server-manager to set a static IP for this host. You will need a static IP latter to get this working. Also having an easy hostname to remember will help : pihole.mydomain.com
Initial logging in might be harder as you will need to find the IP of this new toy. You could refer to dhcp logs or arp from your SME. Then I strongly suggest you to get the MAC address of the interfaces and use the server-manager to set a static IP for this host. You will need a static IP later to get this working. Also having an easy hostname to remember will help : pihole.mydomain.com
=== Install pihole ===
=== Install pihole ===
#read and be confident of the content first, or simply just run :
#read and be confident of the content first, or simply just run :
sudo bash basic-install.sh
sudo bash basic-install.sh
</syntaxhighlight>Folow the Installer, you will have a reminder about the static IP, if you have set the IP accordingly in SME Server with a hostname you can ignore the step of configuring it again in the installer, as dhcpd will always give the ip configured this way.
</syntaxhighlight>Follow the Installer, you will have a reminder about the static IP, if you have set the IP accordingly in SME Server with a hostname you can ignore the step of configuring it again in the installer as dhcpd will always give the ip configured this way.
'''Select Custom for the Upstream DNS Provider'''. This is where we will '''use SME Server as upstream Server''' ! Why do we choose that ? see section below. USe SME Server Local interface IP (mostly something like 192.168.X.1)
'''Select Custom for the Upstream DNS Provider'''. This is where we will '''use SME Server as upstream Server''' ! Why do we choose that ? see section below. Use SME Server Local interface IP (mostly something like 192.168.X.1)
Select your desired lists.
Select your desired lists.
{{Note box|TODO}}
{{Note box|TODO}}
=== Tweak pihole using interface ===
=== Tweak pihole using cli ===
As per the instruction of https://jpgpi250.github.io/piholemanual/doc/Block%20Ads%20Network-wide%20with%20A%20Raspberry%20Pi-hole.pdf, log as pi user to your pi and do<syntaxhighlight lang="bash">
#disable wifi and bluetooth on 3B, 3B+, 3A+, 4B and Zero W
echo "dtoverlay=disable-wifi" | sudo tee -a /boot/config.txt
echo "dtoverlay=disable-bt" | sudo tee -a /boot/config.txt
sudo systemctl disable hciuart
#utilities
sudo apt -y install crudini vim
# add few lists
cd ~
wget https://raw.githubusercontent.com/jpgpi250/piholemanual/master/NextDNS.sh
wget https://raw.githubusercontent.com/jpgpi250/piholemanual/master/AdguardTeam.sh
wget https://raw.githubusercontent.com/jpgpi250/piholemanual/master/firebog.sh
wget wget https://raw.githubusercontent.com/jpgpi250/piholemanual/master/quidsup.sh
#we do not use ipv6
#https://raw.githubusercontent.com/jpgpi250/piholemanual/master/IPv6check.sh
sudo chmod +x /home/pi/NextDNS.sh /home/pi/AdguardTeam.sh /home/pi/firebog.sh /home/pi/quidsup.sh
# insert other lists.
sudo pihole-FTL sqlite3 /etc/pihole/gravity.db
insert or ignore into adlist (address, enabled)
values ('http://someonewhocares.org/hosts/hosts', 1);
insert or ignore into adlist (address, enabled)
values ('http://v.firebog.net/hosts/Easyprivacy.txt', 1);
insert or ignore into adlist (address, enabled)
values ('https://raw.githubusercontent.com/hoshsadiq/adblock-nocoin-list/master/hosts.txt', 1);
insert or ignore into adlist (address, enabled)
values ('https://gitlab.com/ZeroDot1/CoinBlockerLists/raw/master/list.txt', 1);
insert or ignore into adlist (address, enabled)
values ('file:///home/pi/quidsup/notrack-blocklist.txt', 1);
insert or ignore into adlist (address, enabled)
values ('file:///home/pi/quidsup/notrack-malware.txt', 1);
.quit
# take into accoutn all the list we added
pihole -g
# flush local dns cache
ipconfig /flushdns
# watchdog
# Enable watchdog to send mails, whenever triggered:
sudo apt-get -y install watchdog
sudo sed -i -r 's/^#?max-load-5.*/max-load-5 = 18/' /etc/watchdog.conf
sudo sed -i -r 's/^#?max-load-15.*/max-load-15 = 12/' /etc/watchdog.conf
sudo sed -i -r 's/^#?watchdog-device.*/watchdog-device = \/dev\/watchdog/' /etc/watchdog.conf
sudo sed -i -r 's/^#?watchdog-timeout.*/watchdog-timeout = 15/' /etc/watchdog.conf
sudo systemctl restart watchdog.service
#use schedtools to optimize CPU for some process
sudo apt-get -y install schedtool
#install need restart
sudo apt-get -y install needrestart
sudo sed -i 's/#$nrconf{kernelhints} = .*/$nrconf{kernelhints} = 0;/' /etc/needrestart/needrestart.conf
sudo sed -i 's/#$nrconf{ucodehints} = 0;/$nrconf{ucodehints} = 0;/' /etc/needrestart/needrestart.conf
cd ~
wget https://raw.githubusercontent.com/jpgpi250/piholemanual/master/needrestart.sh
chown +x /home/pi/needrestart.sh
# random generator
# cron entries
echo "
30 23 * * 6 root PATH="$PATH:/home/pi/" /home/pi/NextDNS.sh >/dev/null 2>&1
30 5 * * * root PATH="$PATH:/home/pi/" /home/pi/needrestart.sh >/dev/null 2>&1" | sudo tee /etc/cron.d/pihole
#mail setup
sudo apt-get -y install msmtp
sudo ln -s /usr/bin/msmtp /usr/lib/sendmail
echo "
defaults
tls on
auth off
host YOURSMELANIP
port 25
aliases /etc/aliases
account default
from pi@pi.hole"| sudo tee /etc/msmtprc
sudo sed -i '/^default:/d' /etc/aliases || true
pi@pihole:~ $ echo "default:YOURADMINEMAIL" | sudo tee -a /etc/aliases
# protect your pi
# we assume you already changed the default password, and configured the pi to only accept your rsa key, no password for ssh
sudo sed -i 's/#net.ipv4.conf.default.rp_filter=1/net.ipv4.conf.default.rp_filter=1/' /etc/sysctl.conf
sudo sed -i 's/#net.ipv4.conf.all.rp_filter=1/net.ipv4.conf.all.rp_filter=1/' /etc/sysctl.conf
sudo sed -i 's/#net.ipv4.conf.all.accept_redirects = 0/net.ipv4.conf.all.accept_redirects = 0/' /etc/sysctl.conf
sudo sed -i 's/#net.ipv6.conf.all.accept_redirects = 0/net.ipv6.conf.all.accept_redirects = 0/' /etc/sysctl.conf
sudo sed -i 's/#net.ipv4.conf.all.send_redirects = 0/net.ipv4.conf.all.send_redirects = 0/' /etc/sysctl.conf
sudo sed -i 's/#net.ipv4.conf.all.accept_source_route = 0/net.ipv4.conf.all.accept_source_route = 0/' /etc/sysctl.conf
sudo sed -i 's/#net.ipv6.conf.all.accept_source_route = 0/net.ipv6.conf.all.accept_source_route = 0/' /etc/sysctl.conf
sudo reboot
</syntaxhighlight>
=== Tweak pihole using web interface ===
==== windows update ====
If you have windows machines that need updating , go to http://pi.hole and login.
If you have windows machines that need updating , go to http://pi.hole and login.
Set in domain the following whitelist<syntaxhighlight lang="ini">
Set in domain the following whitelist in "Domains"<syntaxhighlight lang="ini">
www.msftncsi.com
www.msftncsi.com
dns.msftncsi.com
dns.msftncsi.com
www.msftconnecttest.com
www.msftconnecttest.com
ipv6.msftconnecttest.com
ipv6.msftconnecttest.com
</syntaxhighlight>you might also read and apply some part of https://jpgpi250.github.io/piholemanual/doc/Block%20Ads%20Network-wide%20with%20A%20Raspberry%20Pi-hole.pdf
</syntaxhighlight>Go now to "Settings" and choose "DNS" tab". There you will scroll down to "Advanced DNS settings", and
* uncheck "'''Never forward non-FQDN <code>A</code> and <code>AAAA</code> queries'''"
* check "'''Use Conditional Forwarding"'''
* fill the 3 input field with your network informations
** your SME network should be noted as 192.168.1.0/24 if your SME IP is 192.168.1.1 and you have a netmask of 255.255.255.0
** your SME Server LAN IP
** you Primary domain.
==== allow dns filtering for your vpn clients ====
go to the pi-hole panel and select Settings/DNS. roll to the lower right, and change setting to '''Respond only on interface eth0.'''
''<u>Only do that if your pihole is on the LAN and not directly connected to the internet.</u>''
==== additional tweak ====
you might also read and apply some part of https://jpgpi250.github.io/piholemanual/doc/Block%20Ads%20Network-wide%20with%20A%20Raspberry%20Pi-hole.pdf
=== Setup your SME to give pihole as DNS for your network, for machines using DHCP ===
=== Setup your SME to give pihole as DNS for your network, for machines using DHCP ===
=== Setup your static IP machines to use ===
=== Setup your static IP machines to use ===
As explained, static ip machines that have their own network information set in their own configuration (not those that rely on dhcpd to address them and IP set on SME) have no idea of what idhcp is, and hence needs you to set the dns server with the ip of your pihole.
As explained, static ip machines that have their own network information set in their own configuration (not those that rely on dhcpd to address them and IP set on SME) have no idea of what dhcp is, and hence needs you to set the dns server with the ip of your pihole.
=== Setup SME firewall /router firewall to filter/redirect DNS request ===
=== Setup SME firewall /router firewall to filter/redirect DNS request ===
{{Note box|TODO}}
{{Note box|TODO - See Below - but note still under developement}}
https://wiki.koozali.org/DNS_Block
== Why using SME Server as upstream server, and pihole only given by the dhcpd service to LAN ==
=== Why using SME Server as upstream server, and pihole only given by the dhcpd service to LAN ===
In other words, why not doing the opposite and set SME to rely on pihole?
In other words, why not doing the opposite and set SME to rely on pihole?
# you do not want to rely on an external DNS service pooling requests sending them to pihole, redirecting them to your local services. There are chances that DNSBL will fail with a result too many requests.
# you do not want to rely on an external DNS service pooling requests sending them to pihole, redirecting them to your local services. There are chances that DNSBL will fail with a result too many requests.
# you might want to be able to have some machines relying on SME result without pihole filtering.
# you might want to be able to have some machines relying on SME result without pihole filtering.
=== Testing your Pi-hole installation ===
<syntaxhighlight lang="shell">
nslookup flurry.com
</syntaxhighlight>
Should return 0.0.0.0 if Pi-hole is working.
== References ==
== References ==