Reading Time: 8 minutes

I finally turned my attention to a project that had been tickling the back of my task list since we moved into this house. It was our first house with appliances, other than a TV, that were internet-capable. I turned off most of the network options so they cannot communicate but there are a couple—an old Sony PS3 game console, a refrigerator—that get software updates that I wanted to keep enabled. I had long considered adding a DNS sinkhole by using the Pi Hole application and I finally put it into place.

There’s really a lot less to it than I thought. Pi Hole is a mature application and it really was more of deciding how to do it than getting it accomplished. The first place to start was the hardware and figuring out where to run it.

Pi Hole can be created as a Docker image and I have been fiddling with containers of late. But I didn’t really want to make this more complicated than necessary. I don’t know enough about Docker at this point that I would want to use a container with an app that I also didn’t know much about.

Fortunately, I was able to dig out an old Raspberry Pi. We bought one for one of the kids back in 2012, the original Model B that came with ethernet and a pair of USB ports. The kid that got this is now programming in VBScript and Python and doing amazing things with ArcGIS. The device itself, once no longer needed, went into my cables box along with other old but not yet unusable tech. I had done a bit of clean up when we moved from Canada but I tend to keep most things that have a potential future use. With something like a Raspberry Pi, you just never know.

The key question as it always is with technology was whether I met the minimum requirements. The Pihole project requires a couple of gigabytes of storage and 512MB of RAM. Fortunately, that’s exactly what I had on hand. The Model A only had 256MB but the Model B has 512MB.

In a sense, I was lucky. If I had had to buy a new Pi computer, I might have balked. Even the most basic Raspberry Pi you can buy now has way more firepower than I would need for this project. But it also means that, if you don’t have a Pi, you can pick one up for less than $50 US and know it has plenty of memory to do this and more.

Installation and Configuration

The longest part of the process was waiting as I used the Pi imager on my Windows computer to load the Raspberry Pi operating system to an SD memory card. I am using a 16 GB card, which itself was a cast off when I upgraded the card in my camera. Waste not, want not.

While it was working through this process, it gave me more time to look beyond the installation process. I realized, belatedly, that I had misunderstood one of the fundamentals of the Pi Hole or any DNS sinkhole. In my mind’s eye, it was a potential throttle on network activity. Say, for example, I’m uploading a file to the internet that is a couple of gigabytes in size. In my head, I was picturing the entire file having to go through the sinkhole, linearly: my PC, Pi Hole, router, modem, internet.

It’s wrong and I’m embarrassed at how long it took for me to get the picture right in my head. I loaded the card into the Raspberry Pi, connected a monitor, keyboard, and mouse to it, and set it up for our internal network. As I was doing that, I started to realize that the only thing that had to use that 512MB of RAM was the DNS query itself. That was lightweight and cached and had nothing to do with bandwidth. So, although every device inside our network is looking at the PiHole, once they have an authorized destination, the experience for the device is the same as it ever was. The only change is that, when a device tries to convert a resource request from a domain name to an IP address, the Pi Hole intercepts it rather than it being sent right on to Google or Cloudflare or some other DNS.

The Raspberry Pi installation worked smoothly. Once I could see the device on my monitor, it restarted a few times as it got itself configured. It was pretty slow as it loaded the graphical user interface, given the RAM, but that was easy enough to wait through. I gave it a static IP address and turned on secure shell (SSH) as I figured I would want to be able to remotely administer it at some point. Since SSH is blocked from outside, I wasn’t worried about it being available for internal access.

To save time, though, I planned to run the Pi Hole installer while I had it up on my monitor. This didn’t work for me. The keyboard configuration and my keyboard were not matched and I wasn’t able to figure out why. The Pi Hole installation instructions are very simple but they required the use of the “|” (pipe) symbol. My keyboard can obviously type that but the key was not recognized in the Raspberry Pi configuration.

I took a chance and assumed that, if I connected remotely, this issue might go away. So I shutdown the Pi, unplugged it from ethernet and power, and reconnected it directly to the router and the adjacent power backup. By the time I was back to my home office, it was available on the network.

When I connected—using PuTTY—my hunch paid off. I was able to log in as my Pi user and run the installation for Pi Hole. Once it finished, I had the information I needed to access the web interface and I could start to complete the configuration for bringing it online. As I understand it, the web interface is a duplication of command lines you can run but I am finding the web intuitive. I have not explored the command line any further at this point.

The Pi Hole handles the DNS queries so I wanted it to use the same service we were currently using, which is a modified Cloudflare resource. Although you can use the 1.1.1.1 service, we have used the Family one that includes malware blocking at 1.1.1.2 (and 1.0.0.2). There is an option to pre-populate common public DNS services in Pi Hole or you can type in your own custom IP addresses. Clicking the Cloudflare option will use 1.1.1.1 so I typed our alternates in below.

For ease of customization, I also turned on the Pi Hole’s DHCP server. This meant that any device that connected to our router would get served the correct DNS information as part of its connection. I turned off the DHCP on our router so that there wouldn’t be any confusion and set up the range of available addresses to be the same. At this point, the next time a device renewed its IP address, it would get the information from the Pi Hole instead of the router.

We use dynamic IP addressing (DHCP) but have always used a custom DNS option on the router. Otherwise, when you connect, you get the DNS servers provided by your internet service provider (ISP). I’m always a bit leery of trusting the ISP. The ISP is trying to sell you a product, upsell you to new products, and extract marketing information about you. It probably also stems from having had some very small ISPs in the past who I wasn’t confident were careful about securing and maintaing their services. Nowadays, I’m more worried that my ISP will try to customize the DNS so that it can take me to ads or tracking services or otherwise use this basic tool for malicious ends. Better to take a chance with a more public, if commercial, option.

I moved our youngest kid into their dorm last week and took a moment to make sure their computer was also reconfigured. When it accessed the building internet, it was given three DNS servers: two from Google and one from the ISP. First of all, I try not to use anything Google. But I really didn’t like the idea that the ISP was in there. I edited the network adapter settings on the PC so that it used custom DNS (in this instance, Cloudflare).

Legal Tech Daily

Message History

Delivery option(s)