Unbound on OPNsense ftw
Self-Hosting a DNS Sinkhole is really important
Submitted 2 weeks ago by chagall@lemmy.world to selfhosted@lemmy.world
Comments
trojanbark@lemmy.world 2 weeks ago
Imaginary_Stand4909@lemmy.blahaj.zone 2 weeks ago
I love Unbound bro. Gives a neat list of the noisest domains which I can quickly add to my list if I don’t need that site 😌
MuttMutt@lemmy.world 2 weeks ago
Absolutely. Remember to enable a cron job in the OpnSense - System > Settings > cron to update the Blocklists. Otherwise you are likely out of date.
Unfold1127@lemmy.world 2 weeks ago
Just moved to an OPNsense network. Setting up unbound was so nice and simple. Much preferred over pihole.
trojanbark@lemmy.world 2 weeks ago
Agreed. I used pihole initially when I was first learning networking, but when I got a dedicated machine and installed OPNsense, I learned how much easier so many things can be.
Fmstrat@lemmy.world 1 week ago
I switched to pihole. Just found it… easier.
trojanbark@lemmy.world 1 week ago
I started on pihole, then the devs messed it all up and made it complicated, so I started using unbound on OPNsense and holy poop was it so much easier for me. But I mean as long as everyone is using something, that’s what really matters. Don’t let these corporations take even an inch
moldy_rice@piefed.keyboardvagabond.com 2 weeks ago The situation is so concerning, he notes, because there isn’t much that people can do to protect themselves from zero-click ad attacks other than blocking ads as thoroughly as possible on all websites and platforms—a fact that intelligence agencies like the NSA and CIA seem to know all too well.
Or disable JavaScript
DeadDigger@lemmy.zip 2 weeks ago
Well yes but no with html5 a lot of JavaScript functions are now possible with html alone so a number of stuff like click or core having or even SQL injections into local databases are now possible with html5 even with JavaScript disabled
- moldy_rice@piefed.keyboardvagabond.com 2 weeks ago
Link?
chagall@lemmy.world 2 weeks ago
This should be the top comment tbh
bigmclargehuge@lemmy.zip 2 weeks ago
I like technitium. Way better than pi hole.
lIlIlIlIlIlIl@lemmy.world 2 weeks ago
In what way(s)?
bigmclargehuge@lemmy.zip 2 weeks ago
It’s a more complete dns server. You can more easily do dns over https, set up zones, and custom dns entries are a lot easier imo.
In summary it’s more focused on being dns, the ad blocking is a feature on top. You also don’t have to manually configure unbound for recursive dns like you do pi hole. Etc etc
EncryptKeeper@lemmy.world 2 weeks ago
The main way is it has a built in recursive DNS server so you don’t have to duct tape Pi Hole and Ubound together
kmartburrito@lemmy.world 2 weeks ago
This is the way
sem@lemmy.blahaj.zone 2 weeks ago
What is a DNS sinkhole and how is it related to the content of the article? Didn’t seem to mention DNS
chagall@lemmy.world 2 weeks ago
What is a DNS sinkhole
A DNS sinkhole is a little program that sits in between your computer and the DNS server that provides your internet lookups. It looks at all of your DNS requests in an unencrypted format. If a DNS lookup from your browser, mobile app or any other internet connected machine matches an entry it has in its “blocklist” then it returns a value of
0.0.0.0(or some other customizable value includingNXDOMAIN). But if the DNS entry is not on the blocklist, then that request will be forwarded to Cloudflare (1.1.1.1), Google (8.8.8.8), Quad9 (9.9.9.9) or other DNS provider and get an accurate value for the DNS lookup.Most of the time, the blocklists consist of adware domains such as Google Ad Services, Facebook Ads, Amazon Ads, etc. This has the effect of removing ads from devices that normally are unable to block ads such as ads inside mobile apps, ads in Roku, etc.
how is it related to the content of the article?
The article indicated that the malicious spyware was transmitted through viewable ads on the target’s mobile device. This is combated most effectively by using a DNS sinkhole.
I should note that the article does not mention if current blocklists would have thwarted this attack. However, it does say that the ads were transmitted, in some instances, via Google Ad services, which these blocklists do effectively target.
TrickDacy@lemmy.world 2 weeks ago
Tldr; pi-hole
cantstopthesignal@sh.itjust.works 2 weeks ago
Unfortunately a lot of the magnificent 7 of advertisers have caught on to this and will serve ads dynamically in many of their platforms.
puppinstuff@lemmy.ca 2 weeks ago
This sounds like AdGuard Home is an example?
sem@lemmy.blahaj.zone 2 weeks ago
Thank you, that kind of explanation exactly what i was hoping for!
andrewoidxyz@lemmy.world 2 weeks ago
Nowadays the internet is pretty much unusable without ad blockers/dns sinkholes
heyeddi@lemmy.world 2 weeks ago
Calling it ad blocking undersells it. The ad network is the delivery path in that report, so blocking at DNS is a security layer, not tidiness. The thing I’m building goes a step further: it holds tracker connections open instead of refusing them, so they waste their own time instead of retrying instantly. Has anyone tried tarpitting at home? I’m curious whether it broke smart TVs or apps that phone home hard.
Wispy2891@lemmy.world 2 weeks ago
The problem with tarpitting is that apps will try to download the ads before showing you the content, and you will be more annoyed than before
andrewoidxyz@lemmy.world 2 weeks ago
DNS blockers work so why would I need your solution? I dont care if the sites try to reconnect cause the connection wont work nonetheless
kata1yst@sh.itjust.works 2 weeks ago
Love blocky. Seems like it flies under the radar.
dehyzer@piefed.social 2 weeks ago
Is Adguard Home still a good option for this kind of thing?
Reannlegge@lemmy.ca 2 weeks ago
Yes, from what I understand. They are using ad services from the big ad companies, and because capitalism sucks they are completely fine with selling the spots.
if you do not have a system to VPN into your home I would suggest get a firewall (preferably one you can install openWRT of opnSense on) and VPN into your LAN when away from home.
jsnfwlr@lemmy.ml 2 weeks ago My TPlink omada router has Wireguard built in, so I use WG tunnels on my mobile devices to tunnel home where my PiHole (soon to be replaced by Technitium) blocks ads and malicious content.
LemmyPlaceDN@europe.pub 2 weeks ago
I only know the basics of networking, so I’ve been wondering why this “DNS-sinkhole” fubctionality can’t simply be implemented directly in private routers as a simple blocklist instead of adding a new device to your network. Do routers not support this for technical or security reasons?
glitch1985@lemmy.world 2 weeks ago
Most consumer routers don’t offer this functionality out of the box, likely because manufacturers don’t consider it essential for most users. There’s no major technical reason it couldn’t be built in though. You can already set up DNS sinkholing with OPNsense or pfSense if you don’t mind running and managing your own router.
BlackSwan@lemmy.blahaj.zone 2 weeks ago
Routers are usually hardware level optimized for throughput, filtering is inherently computationally expensive compared to routing, especially if you have to keep up multi-gigabit throughput
You could totally do it at the router, it would just become a more expensive piece of hardware and most people choose to cheap out
cron@feddit.org 2 weeks ago
I doubt a DNS filter would noticeably increase CPU usage. We’re not talking about deep packet inspection here.
RememberTheApollo_@lemmy.world 2 weeks ago
A Raspberry Pi 3b is adequate to run PiHole to do the job, or implementing AdGuard DNS.
However, these require a little skill and knowledge to implement.
Consumer routers aren’t built to do the job.
IphtashuFitz@lemmy.world 2 weeks ago
I love my Pihole. It blocks ads on my PCs, my iPads, our streaming devices, etc. It also blocks telemetry gathering by other device manufacturers.
Appoxo@lemmy.dbzer0.com 2 weeks ago The german router “FritzBox” recently did implement this.
A very rudimentary version of it but still.
Decronym@lemmy.decronym.xyz 2 weeks ago
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters DNS Domain Name Service/System PiHole Network-wide ad-blocker (DNS sinkhole) VPN Virtual Private Network
3 acronyms in this thread; the most compressed thread commented on today has 8 acronyms.
[Thread #134 for this comm, first seen 17th Oct 2026, 01:50] [FAQ] [Full list] [Contact] [Source code]
giant_smeeg@feddit.uk 2 weeks ago
Whats with that title? It doesn’t say the word DNS, Sink, self or host in the article…
Whys it important to self host? I use ControlD and NextDNS and both have been great.
lemmylump@lemmy.world 2 weeks ago
[deleted]Reannlegge@lemmy.ca 2 weeks ago
I have a finally tuned pihole that offers different blocking for different vLANs on my home network and VPNs, I would not trust a third party for ad blocking. However you do you.
I was watching SomeOrdanryGamers video on this and his pihole did not block all the ads on an ad infected site, but mine could. I have used canyoublockit many times to stress test my system, wish there was something newer though.
lemmylump@lemmy.world 2 weeks ago
Trust it, no.
Is it better than nothing yes.
Listen, some folks can afford to build and dedicate time and resources to making a pi-hole for their network.
Those who can’t need to know there are alternatives, some are better than others, I’m just sharing information.
Seimhe@lemmy.world 2 weeks ago
Thanks for the tip. I can’t find pricing on the NextDNS site. Is it free?
Don’t think I have the spoons for things like PiHole.
GenderNeutralBro@lemmy.sdf.org 2 weeks ago
It’s free for a limited number of queries per month. Generally enough for one device (depending on personal usage, obviously).
Mullvad has a free ad-blocking DNS you can use, too. I recommend the “base” version: mullvad.net/en/…/dns-over-https-and-dns-over-tls
vision@lemmy.blahaj.zone 2 weeks ago
The last time I opened the Wired site was like 10 years ago, it’s still telling me “You’ve read your last free article.” See you in 2036 ig
chagall@lemmy.world 2 weeks ago
Ha. Here’s the direct source: citizenlab.ca/…/how-discover-tech-turned-targeted…
This reads like a dystopian fever dream, fuck me.
BeatTakeshi@lemmy.world 2 weeks ago
I guessed that an Israeli company would be behind this, and I was right. Am I antisemite?
Thank you sir, the posted article is paywalled
floofloof@lemmy.ca 2 weeks ago
Do they know how ominous that sounds? It reads like they got mad at my freeloading and sent out a hitman.
Or they know the date and time of your very natural death…
anon_8675309@lemmy.world 2 weeks ago
Tells me that too. Then I copy the url into my readeck instance and it pulls the article for me and gives me a better reading experience.
Reannlegge@lemmy.ca 2 weeks ago
Wow they gave you a time to come back, they have just said I have surpassed my 5 free articles for years now, I think it is because I am using a “DNS sink hole”/adblocker I do not care enough to turn my pihole off just to try and read it.
I have gotten a static IP, and clear my cache regularly since my last attempt to read a wired article so it is not that they are using anything to see that I have tried them before.
trolololol@lemmy.world 2 weeks ago
Na I have regular DNS and I can’t read from wired for years too