Advertisements and Tracking are a Problem
Almost all mobile devices and especially smart devices are nowadays tracking you to use that data in sophisticated schemes. Where you can on browsers at least choose the browser and plugins to safeguard you, with IoT devices you are out of luck.
Additionally the whole tracking and advertising is also using quite some bandwidth in everyday surfing. So blocking traffic, does not only make surfing more agreeable, it’s also faster, while you are preserving your privacy! So i guess, it’s worth a try ;)
Below we will look at a core technology in the internet: Domain Name System (DNS). And how we can use it to help us.
How does DNS work
Instead of explaining DNS myself, have a look at this simple scrollable explanation: https://www.verisign.com/en_US/website-presence/online/how-dns-works/index.xhtml
Or in one simple image:
Now, as you can imagine, we can use DNS to create lists of targets, we just don’t want to resolve the malicious domain and that’s it ;) Unfortunately you home router is not equipped to help us here.
That’s why we have a quick look at PiHole and a small device, called a RaspberryPi. Essentially a RaspberryPi is a very small, very power efficient computer, where will run our adblocking machine.
Learn more about a raspberry pi: https://www.raspberrypi.org/
It’s really small and versatile:
You just have to get one of those devices and install the PiHole Software from: https://pi-hole.net/ on that machine. The last thing you should do after the installation is to set now the DNS from your provider to the PiHole device.
After the installation you should configure your block lists. Here my recommendation (to bet set under: http://pi.hole/admin/settings.php?tab=blocklists):
When you got it live it will work like this:
You will mainly use this awesome dashboard where you can configure everything!
Using the PiHole is a very smooth and just working solution. You just have one challenge now:
No safeguards when you are on the road!
That’s a real bummer, as you should use this technology also, when you are on the road. Running a PiHole locally seems messy and constantly connecting to a VPN also seems impractical.
That’s where NextDNS comes into play! It’s basically a PiHole-as-a-service. It can basically provide the very same service as your PiHole, on the road. For more information, you can also read this very good article: https://medium.com/@mlapida/replacing-pi-hole-with-nextdns-faed99277997
Setting that up is also quite easy:
- Register under https://my.nextdns.io
- Configure your log storage endpoint (select EU, if you live in EU and so on)
- Configure your endpoints
- Configure your security and privacy settings The blocklists are already there to pick. No need to look for the urls.
- Check the logs and analytics
One of the prime motivation to use the service is it’s wide range of supported protocols and devices. It supports for instance the private DNS mode of Android natively and supports endpoints for DNS-over-TLS and DNS-over-HTTP. Exactly what we need.
You can of course set the external DNS servers of NextDNS directly in your router and forget about it. But you will not have 2 features to be considered:
- No device difference in the logs. All is coming from your router
- No encrypted DNS communication (through DoT, for example)
In order to combine now the PiHole (or just an ordinary base RaspberryPi) with NextDNS, we can just install the nextdns CLI on the Raspberry Pi and route the upstream DNS requests there.
Just follow the instructions from here: https://github.com/nextdns/nextdns
Create a config file under “/etc/nextdns.conf”. You should enable caching and auto activate, when you let it run alone:
hardened-privacy false timeout 5s config YOUR_NETWORK_ID log-queries false cache-size 0 cache-max-age 0s max-ttl 0s report-client-info true detect-captive-portals false bogus-priv true listen :5353 use-hosts true setup-router false auto-activate false
Now you only have to set the upstream DNS server in the PiHole to “127.0.0.1#5353 and deactivate the blocklist rules (next dns does that for you and we cache locally…)
Thanks for reading and feedback is welcome!