bogeholm / pidns

Configure DNS over HTTPS with cloudflared

Pi DNS

Set up your Raspberry Pi as an ad blocking DNS server, using Pi-Hole and Cloudflare DNS-over-HTTPS 🚀

Executive summary

This repo contains semi-manual steps for setting up a Raspberry Pi using Pi-Hole on your home network to block ads.

We'll use Cloudflare DNS-over-HTTPS for outgoing DNS requests, and transparently redirect all DNS requests to the Pi-Hole no matter which DNS server was requested.

This:

Becomes this:

🥂🍾

Contents

• raspberry/ - general Raspberry Pi setup & tools
• ufw/ - ressources for enabling the ufw firewall
• cloudflared/ - scripts for downloading and installing the Cloudflare Argo Tunnel client, and using this to proxy DNS on port 54
• pihole/ - install and configure Pi-Hole
• unifi/ - router and firewall setup. The specifics are for a Unifi Security Gateway Pro 4, but the rules and settings themselves are general and can be applied on any capable router/firewall combo.

F.A.Q.

• Q: Why not one big setup script? Why not use Ansible, Puppet, or Docker Compose, or ... ?
• A: Too much hassle😃 I like setting up stuff like this, and I'll likely change something next time I need to do it anyway.

Acknowledgements

• @scotthelme: DNS over HTTPS
• @scotthelme: Catching naughty devices
• u/floofcatfuzz: Unifi + PiHole, doing it right with USG

pidns's Issues

Source default variables from common

Create proper update script

... and schedule with cron

Change Python install from Miniforge to Mambaforge

Add config.gateway.json for rerouting DNS to Pi

Default to latest version of cloudflared

Use something like the following (source):

LATEST=$(curl -sSfL --proto=... "https://api.github.com/repos/<org>/<repo>/releases/latest" | jq --raw-output .tag_name)

Install and configure fail2ban

https://linuxhandbook.com/fail2ban-basic/

Update list of blocklists

Include at least https://www.github.developerdan.com/hosts/

Figure out how to run tests

Update starship install method

ARM versions available in releases: https://github.com/starship/starship/releases/latest

Add blacklist

https://www.version2.dk/holdning/dns-anbefalinger-2022

Update documentation

Should include:

• USG setup w/ screenshots where applicable
• Pihole setup w/ screenshots where applicable
• Testing of alternate DNS if Pihole is down

Update WiFi obtainment method

ubuntu@ubuntu$ cat /etc/netplan/50-cloud-init.yaml 

...
network:
    ethernets:
        eth0:
            dhcp4: true
            optional: true
    version: 2
    wifis:
        wlan0:
            optional: true
            access-points:
                "{{WiFi SSID}}":
                    password: "{{WiFi Passphrase}}"
            dhcp4: true