Install
curl -sSL https://install.pi-hole.net | bash
Gravity Lists
- https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
- https://mirror1.malwaredomains.com/files/justdomains
- http://sysctl.org/cameleon/hosts
- https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist
- https://s3.amazonaws.com/lists.disconnect.me/simple_tracking.txt
- https://s3.amazonaws.com/lists.disconnect.me/simple_ad.txt
- https://hosts-file.net/ad_servers.txt
- https://smokingwheels.github.io/Pi-hole/allhosts
- http://someonewhocares.org/hosts/hosts
- https://www.malwaredomainlist.com/hostslist/hosts.txt
- https://s3.amazonaws.com/lists.disconnect.me/simple_malvertising.txt
Fix static IP assignment
- Edit the file /etc/network/interfaces
- Make sure you have lines that look something like:
# The primary network interface
allow-hotplug eth0
iface eth0 inet static
address 192.168.1.2
netmask 255.255.255.0
gateway 192.168.1.1
Fixing HTTPS Issues That Cause Slow-Loading Pages
Pi-hole is only handling the DNS queries and doesn’t know about the other protocols that are taking place. But we can use iptables to manage these protocols to prevent time-outs allowing Pi-hole to work it’s magic.
There are several iptables rulesets you can put in place to optimize your Pi-hole’s performance; to prevent your Pi-hole from timing out over HTTP/HTTPS requests on ports 80 and 443, resulting in a faster browsing experience.
iptables -A INPUT -p tcp --destination-port 443 -j REJECT --reject-with tcp-reset
iptables -A INPUT -p udp --destination-port 80 -j REJECT --reject-with icmp-port-unreachable
iptables -A INPUT -p udp --destination-port 443 -j REJECT --reject-with icmp-port-unreachable
ip6tables -A INPUT -p tcp --destination-port 443 -j REJECT --reject-with tcp-reset
ip6tables -A INPUT -p udp --destination-port 80 -j REJECT --reject-with icmp6-port-unreachable
ip6tables -A INPUT -p udp --destination-port 443 -j REJECT --reject-with icmp6-port-unreachable
These changes won’t be applied permanently unless you save them:
iptables-save > /etc/iptables/rules.v4
ip6tables-save > /etc/iptables/rules.v6
Enable the block page
- Edit the file /etc/pihole/pihole-FTL.conf
- Add the line:
BLOCKINGMODE=IP
More about blocking modes
Pi-hole FTLDNS supports two different methods for blocking queries. Both have their advantages and drawbacks. They are summarized on this page. The blocking mode can be configured in /etc/pihole/pihole-FTL.conf.
This setting can be updated by sending SIGHUP to pihole-FTL (sudo killall-SIGHUP pihole-FTL).
Pi-hole’s unspecified IP blocking (default)
/etc/pihole/pihole-FTL.conf setting:
BLOCKINGMODE=NULL
Blocked queries will be answered with the unspecified address
;; QUESTION SECTION:
;doubleclick.net. IN ANY
;; ANSWER SECTION:
doubleclick.net. 2 IN A 0.0.0.0
doubleclick.net. 2 IN AAAA ::
Following RFC 3513, Internet Protocol Version 6 (IPv6) Addressing Architecture, section 2.5.2, the address 0:0:0:0:0:0:0:0 (or :: for short) is the unspecified address. It must never be assigned to any node and indicates the absence of an address. Following [93]RFC1122, section 3.2, the address 0.0.0.0 can be understood as the IPv4 equivalent of ::.
Advantage
- The client does not even try to establish a connection for the requested website
- Speedup and less traffic
- Solves potential HTTPS timeouts as requests are never performed
- No need to run a webserver on your Pi-hole (reduces complexity when running other web services on the same machine)
Disadvantage
- Blocking page cannot be shown and whitelisting has to be performed from the dashboard or CLI
Pi-hole’s IP (IPv6 NODATA) blocking
/etc/pihole/pihole-FTL.conf setting:
BLOCKINGMODE=IP-NODATA-AAAA
Blocked queries will be answered with the local IPv4 addresses of your Pi-hole (as configured in your setupVars.conf file). Blocked AAAA queries will answered with NODATA-IPV6 and clients will only try to reach your Pi-hole over its static IPv4 address
;; QUESTION SECTION:
;doubleclick.net. IN ANY
;; ANSWER SECTION:
doubleclick.net. 2 IN A 192.168.2.11
Advantage
- Shows blocking page from which blocked domains can be whitelisted
- Serves IPv4-only replies and hence mitigates issues with rotating IPv6 prefixes
Disadvantage
- Requires a webserver to run on your Pi-hole
- May cause time-outs for HTTPS content even with properly configured firewall rules
Pi-hole’s full IP blocking
/etc/pihole/pihole-FTL.conf setting:
BLOCKINGMODE=IP
Blocked queries will be answered with the local IP addresses of your Pi-hole (as configured in your setupVars.conf file)
;; QUESTION SECTION:
;doubleclick.net. IN ANY
;; ANSWER SECTION:
doubleclick.net. 2 IN A 192.168.2.11
doubleclick.net. 2 IN AAAA fda2:2001:4756:0:ab27:beff:ef37:4242
Advantage
- Shows blocking page from which blocked domains can be whitelisted
Disadvantages
- Requires a webserver to run on your Pi-hole
- May cause time-outs for HTTPS content even with properly configured firewall rules
- May cause problems with alternating prefixes on IPv6 addresses (see IP-AAAA-NODATA)
Pi-hole’s NXDOMAIN blocking
/etc/pihole/pihole-FTL.conf setting:
BLOCKINGMODE=NXDOMAIN
Blocked queries will be answered with an empty response (no answer section) and status NXDOMAIN (no such domain)
;; QUESTION SECTION:
;doubleclick.net. IN ANY
Similar advantage to NULL blocking, but experiments suggest that clients may try to resolve blocked domains more often compared to NULL blocking.
Command aliases
It might be useful to add these aliases to your ~/.bashrc file:
alias wl="pihole -w"
alias bl="pihole -b"
alias wild="pihole -b --wild"
alias ew="sudo vim /etc/pihole/whitelist.txt"
alias eb="sudo vim /etc/pihole/blacklist.txt"
Then, for example, if you want to whitelist example.com, you can just type
wl example.com