Comment by kd913 | Hacker News Reader

Comment by kd913 | Hacker News Reader

Parent Full thread

Can I heavily recommend the use of them as a pihole + Wireguard VPN + DNSCryptProxy Server.

Pihole -> Great use for a network wide adblocker/DHCP server.

Wireguard VPN -> In combination with a DDNS setup and some port forwarding enables the use of a global private VPN. I think it's a prerequisite for a decent home-automation setup.

DNSCryptProxy -> Great for ensuring all DNS requests on the network via DNS over HTTPS. Kind of useful because frankly ISPs are sniffing DNS traffic. Also useful for bypassing DNS based ISP filters.

The above basically enabled me to create a 5 country wide private VPN by giving VPNs to family members. It enables me to print/scan things from abroad, access CPU resources/servers/GPUs/Webcams/automation and obviously browse as if I am in another place.

My family when they are abroad, can now work as if they aren't.

It also saves power (reducing analytics traffic), improves privacy and takes about a weekend to setup.

They also make great personal gifts too.

Any good tutorials on setting up Wireguard? This (and Pihole) have been on my todo list for a while.

I should probably write a blog on how to do this. I have a setup guide for myself, but unfortunately it contains a lot of obviously private details that I can't post (ie access to my cloudflare/VPN stuff).

A lot of my stuff is ad-hoc from my personal exploration and experience on Linux.

In regards to the wireguard specific stuff, this isn't a bad guide.

https://mikkel.hoegh.org/2019/11/01/home-vpn-server-wireguar...

The harder part with the VPN stuff is the following.

1) Setting up a clear route of forwarding traffic to the pihole. To do so, you would need to setup netplan/systemd-networkd so your pi gets a static private IP. (Not that easy if you are doing a full ipv6 route too.)

2) Setup a DDNS mechanism (as you most likely are getting a dynamic IP). My suggestion for this was to get a domain name (8 quid a year) and use cloudflare as a DDNS host. You also need to punch a UDP port through your router to forward to your pi.

3) Then setup the rest of the wireguard stuff.

4) Setup the pihole and ensure all interfaces are covered so your VPN has a DNS server.

Part 2 is the hardest bit as I kind of needed some custom scripting to ensure cloudflare had working routes to my networks. e.g. https://gist.github.com/Kedstar99/2d8ab0e9bec3a5629562b4ab01...

The above script obviously running as a systemd service that restarts automatically.

Obviously you can use something else like noip or some other DDNS solution.

I did this a few months ago. I’d previously tried a few years ago, and found no good online resources. Now they’re a dime a dozen.

The community around WG has gotten much easier for noobs to get into, and the porcelain around the tool itself has made it quite easy to use, IMO.

The easiest way is to use some kind of manager on top of wireguard. Tailscale is very good and free for a single user (or with headscale) Otherwise there is innernet, wiretrustee, ...

I like wg-netns. It allows setup of a wireguard tunnel, similar to wg-quick does, in a Linux network namespace. So I can run some processes using the VPN, and others without.

By specifying the namespace in a systemd service file, I can let a service use a specific VPN.

https://github.com/dadevel/wg-netns

> Any good tutorials on setting up Wireguard? This (and Pihole) have been on my todo list for a while.

Pihole pretty much installs itself (it even has a pre-made image). WireGuard will take reading, testing and failing.

I recommend doing these things one thing at a time, and doing the Pihole first.

You can set up a Pi-Hole (DNS sinkhole) and Pi-VPN (Wireguard installer and CLI-frontend for small deployments) very quickly. And you can do it on any debian VM or computer, not just Pi.

Once you have the base OS ready to go, it will take you less than 30 minutes if you know how to muck with your DHCP/firewall settings in your router.

https://github.com/pi-hole/pi-hole/#one-step-automated-insta...

Install Pi-Hole, then edit your DHCP server to hand out the Pi-Hole as the DNS server.

https://pivpn.io/

After installing Pi-hole, install this. Choose Wireguard, not OpenVPN. port-forward the Wireguard UDP port to your VPN server. use the "pivpn" command to create client configs and the "qr" subcommand to scan the config into your phone.

The easiest way on the Pi is to install the HomeAssistant plugin, but it's quite easy to set up on a Linux too. Generate two keys, copy paste them in a five line config, same thing on the client. On a phone install the app and scan a QR code that you rsync over to your PC. There's a tutorial on the Wg website.

If you're a Linux person, just skip all the other non-sense and create a systemd-networkd file. It's by far the simplest solution I've used, and doesn't require goofy unit files to start/stop/restart via wg tool.

https://www.freedesktop.org/software/systemd/man/systemd.net...

Then choose your firewall of choice to setup NAT and forwarding. I used firewalld, but not sure I'd recommend it. It's just the first solution I got working.

I'd recommend just using Tailscale. It's wonderful.

Tailscale is great. It's really changed my world and it's so dang simple.

I used trailofbits/algo a long time ago for initial setup. Worked well at the time.

I use pivpn - it’s a pretty straightforward helper for both openvpn and wireguard

> DNSCryptProxy -> Great for ensuring all DNS requests on the network via DNS over HTTPS. Kind of useful because frankly ISPs are sniffing DNS traffic. Also useful for bypassing DNS based ISP filters.

If you're using PiHole, you can just use cloudflared to do DoH. https://docs.pi-hole.net/guides/dns/cloudflared/

On a different note, biggest reason I've never installed a VPN at home is because I just prefer a deny-everything home network and worry I'll misconfigure something and cause a security issue.

YMMV but I’ve noticed that cloudflared has stability issues over time whereas dnscrypt has been rock solid for me (I run both on different systems). Probably going switch everything to dnscrypt esp since it supports odoh now.

cloudflared service itself has been running fine. If there were other issues, such as connectivity, then I don't know. Didn't experience any.

OTOH, I'm beginning to migrate to pfsense and pfblockerng at home. So, it is possible that I may retire my pi-hole at some point. Currently I'm running both as I transition and test.

I migrated away from cloudflared to dnscrypt-proxy because cloudflared didn't start up properly for me. On each reboot I had to manually stop and start it otherwise it was flooding the logs with failures. It was a bit weird and frustrating to diagnose.

I use DNSCryptProxy because I can use it with Firefox as a local TRR server, supports additional filtering, supports DNSCrypt and ODoH caching and is open source.

It also picks from 140 or so anonymous DoH relays, with specifics for nologs and dnscrypt support.

Why would I go for just 1 arbitrary provider rather than the lowest latency choice out of 140?

I also think the latter point is a bit overblown. So long as you keep your kernel updated and you only expose a single high UDP port, it should all be fine. I have ufw enabled on each pi, along with various logging mechanisms in place to see if things seem reasonable. That and 2fa for actual ssh access.

> Why would I go for just 1 arbitrary provider rather than the lowest latency choice out of 140?

Because a ISP that can compromise any one of those 140 different single points of failure can now make that one have the lowest latency and give you malicious DNS results just like you never secured anything.

This is the same problem as allowing 140 different CAs to issue certificates for subdomains of com, rather than forcing the fucking registry to do it when you get a domain name in the first place.

https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Configuratio...

>minisign_key is a public key, used to verify that the content is legitimate. Lists can thus be served from any location, even from an untrusted ISP: dnscrypt-proxy will immediately detect and reject something that has been tampered with.

>https://dnscrypt.info/stamps-specifications/ >https://dnscrypt.info/faq

An ISP will not be able to spoof the sources or these stamps. They wouldn't put the effort in. Even if they did, it is factored and thought about.

More harmful would be a malicious DoH relay but I trust the devs.That I think is fixed by mandating the use of DNSSec too for my relays.

I ended up Tailscale for Wireguard myself. I was really worried about letting all these server software out on the wide open internet because I can't guarantee I'll be around 24/7 to monitor in case of a security problem and this way I can be lazier. :)

The added benefit is that I can force all devices to use PiHole while connected to Tailscale and have DNS-adblocking on the go!

Upvote for Tailscale.

I find it super useful!

Even if just for remoting into various boxes; the kids for instance often tether their PCs off their phones or I'm tethered and want to remote to my LAN.

(I have terrible internet)

I do something similar but different choice of software. There is much more that is possible using this approach (distributing exact same hardware with preinstalled configs to each network particpant). These RPis are gateways. They are gateways to an overlay network controlled by users and not surveilled by "tech" companies trying to sell ad services. I like to imagine them as modern day IMPs. https://en.wikipedia.org/wiki/Interface_Message_Processor

for $18 you can have this instead : https://www.amazon.com/dp/B0932J39HC?ref=myi_title_dp&th=1

I run pihole with 256MB version(which is $1 less) for two years fanlessly, and this includes enclosure too, load the software and hook it to my wireless router's ethernet port and just forgot about it.

I tried using a Pi4 for a pihole and it kept crashing. Overheating I think. But, if I solve that, the SD card would kill it eventually.

Not if you get a good SD card, or a USB SSD.

When I was trying, boot from USB wasn't available.

you can disable all logging in pihole - which i do and my sd card from 2016 is still going strong.

What power supply were you using?

My Pi 4 running 2 instances of Octoprint kept crashing until I switched to their official power supply. On previous models I always got away with whatever power supply I had around but the 4 doesn't play around when it comes to power consumption.

The one it came with!

I had to replace the one mine came with. It was new-ish, so I was able to get it for free under warranty, but be aware- quality control for their power supplies is not great (at least as of ~2017)

I've had various Pi models over the years starting with the original and I've never gotten a power supply with it. You must have bought a bundle deal, which could mean a good or bad one depending on the seller..

I've had a bunch of Pi Zero W cameras in 24x7 use for years in a very harsh desert environment where ambient air temps regularly exceed 120F, and have never had a single crash of any of them, not even a failed SD card despite being written to daily for storing motion-activated images (the sunrise/sunset is always captured). I don't even have fans on these, and they're in the compact pi foundation red and white case for camera use. It's really been quite impressive.

What I've heard is a crashing Pi is usually due to sagging voltage on an inadequate power supply, and that's probably even more an issue on the more demanding/powerful Pi4. On my cameras I just use the wall warts adafruit sells for the Pi, and haven't had any power problems.

Again, I'm using the supply it shipped with. Not that having to use their supply because they screwed up the spec is an acceptable situation, mind you.

Be careful with the gear you use on your Pis, just like any system. If you’re using a no-name USB-C power supply and dirt cheap generic SDHC cards, you will likely have problems. By default, the Pi4 doesn’t come with a power supply and while you might be tempted to power it from your PC, spend the money for the official power brick, or, even better, get the official Pi Power over Ethernet hats. For SD, buy from a reputable source and get a brand name (Samsung or Sandisk).

This is anecdata from my part, but I’ve got eight or 10 Pis running (Flightaware/ADSBexchange, PiHole/Influx/Grafana/Wireguard, a couple of Octoprint, Home Assistant - with a relay HAT for triggering dampers, Showmewebcam, and a handful of other things). Once I switched to good power supplies and good SDHC cards, my problems went away. My most heavily loaded machine is the PiHole machine which also has influx running and writing to the SDHC card - it’s probably a ticking time bomb, but it’ll celebrate it’s fourth birthday on the same card in two months.

I walked into the Cambridge Raspberry Pi shop on launch day and bought a Pi 4, a power supply, and an SD card with NOOBS. It isn't my hardware that's at fault and, even if it was, it doesn't excuse developing hardware that doesn't work with in-spec USB-C power supplies and depends on inherently fragile storage media.

I missed this -- but my comment elsewhere about the FW update for overheating definitely applies for a launch day Pi4!

As long as you use something like the official PSU and don't connect particularly power-hungry USB devices to it you should be fine.

As far as the SD card goes you can boot off an external hard drive or SSD via USB and that should guarantee longevity.

My biggest problem with headless Pis was that they would randomly disconnect from the wifi network and disappear, turning off power saving on wifi didn't solve it. In the end the real solution ended up being to just create a 2.4ghz-only network and connect them to that. Somehow they just don't play well with networks that have the same SSID for 2.4 and 5ghz on my Ubiquiti gear.

I hate to beat the drum but, as I've said in some other replies, I used the official PSU.

If it was one of the original Pi4s you would need to get the FW update that fixed the USB chip power that was the source of many overheating issues -- though that came out relatively soon after release.

Reply on news.ycombinator.com