Setting up a Pi Hole made my home network faster
brianchristner.io
brianchristner.io
https://github.com/boostchicken-dev/udm-utilities/tree/maste...
They really solved what has always been a major pain with local hosting and made it really easy to use.
I ended up using NextDNS over pihole, but only because it was just easier to get the same result.
I hope it becomes more ubiquitous (hah) even on lower cost ones eventually.
Consider the case of a web page. The content you want (the news article) consists of say 100 get requests totaling 1mb. The content you don’t want (ads) consists of 120 get requests totaling 1.2mb.
When pihole is in use the content you want does not have to contend with adversarial content. You have half as many requests, there’s 50% less data in the pipe, you get what you wanted faster.
Gaming is not impacted because your games don’t call advertising servers. If they did (for some insane reason) the real game requests get served immediately not having to wait in line behind the ad content.
Often when someone joined a server there would be a tiny bit of lag for all of the users.
I figured out the server was using a java method that indirectly was doing a blocking DNS lookup. I think it was reverse DNS but I forget which method it actually was, and if it was blocking the main thread or just the networking thread.
(PiHole still wouldn't have created an additional cost though.)
DNS performance is very fast, better than ISP dns usually.
General web usage is much, much more pleasant.
No issues with gaming.
I ran mine on a Raspi Model B. You know, the one with the RCA plug and SD card slots. From 2012. At some point the SD was so messed up I couldn't ssh into it any more, but it still worked.
Now Pihole is running on my Thinkcenter minipc as a Socker image along with a good dozen others. I don't have to worry about SD corruption or sudden shutdowns any more.
If you add a bunch of extra-aggressive blocklists maybe you'll have issues but if you stick with the recommended OOTB lists, you'll be fine.
The resolution has to be done a way or another, by default this is your ISP and they usually suck. I had hand-picked DNSes before (there is a utility that tests plenty of them from your connection) and after adding a pihole on a simple RPi it was even faster.
If you want a one-purpose device for it, then you would be looking into buying a SOC computer like a Raspberry PI 3 (should be cheaper than the 4) and about an hour to set it up.
One little thing I have done is set my router's secondary DNS to 1.1.1.1, just in case the power fails or the PI goes down. When I set mine up I completely forgot to set ESXI to auto-power on the VM, so after a brief power outage I had no internet for almost an hour because I had no redundant DNS configured. I got blindsided by my own mistake. Now everything is on a UPS and the VMs are correctly configured in case power is lost long enough to require a shutdown.
https://pi-hole.net/ has more info on the install.
https://github.com/openwrt/packages/blob/master/net/adblock/...
There have been other issues too.
https://krebsonsecurity.com/2021/12/ubiquiti-developer-charg...
"On Wednesday, a former Ubiquiti developer was arrested and charged with stealing data and trying to extort his employer while pretending to be a whistleblower.
"Federal prosecutors say Nickolas Sharp, a senior developer at Ubiquiti, actually caused the “breach” that forced Ubiquiti to disclose a cybersecurity incident in January."
This also shows that not every breach is what it seems, and investigating fully before publicly disclosing can sometimes help prevent disinformation. The “whistleblower” in this case was intentionally lying, and every customer that dedicated time to mitigation had to pay part of the cost.
Bug #1 was when they stopped supporting 32-character SSIDs, so my main network called "Smart Meter Surveillance Network" suddenly was no longer editable. Switching routing platforms is easier than setting up all my devices again.
Bug #2 was the one I wrote up here on Reddit (https://www.reddit.com/r/UNIFI/comments/ghs4bg/arp_for_clien...), which was where ARPing for a client on a meshed wireless AP, from the wired network, would fail. If the client was on a non-meshed AP, it worked.
I expect better from my network, so I dumped Unifi and went to OPNsense on a fanless PC.
I'm curious for solutions to:
- cheap(ish) rackmount fanless switches or routers with SFP+
- cheap(ish) rackmount PoE
- cheap(ish) rackmount low-power servers
What do you use?
But here's my setup in a nutshell:
- Motorola MB7612 Cable Modem
- Protectli FW4B silent PC as router/gateway
- Synology DS1019+ for storage, Plex, and Pi-hole via Docker
- 2x Rucuks R610 APs running Unleashed firware (off-lease eBay purchases, enterprise grade APs, about $150/ea, both wired/non-mesh)
- Brocade ICX6430-C12 Switch (4x 802.11at PoE, handles the APs, another eBay special, cost around $90)
This is working well for me, and unlike the UniFi stuff I can now pretty easily swap out any piece of it with another brand of the same function and things will be fine. The single ecosystem of Unifi always bothered me a bit.
If I want a new VLAN (or special WLAN) it's a little harder than on UniFi, but it's really just setting it up on OPNsense, defining it on the requisite ports on the switch, and turning up the new SSID (if needed).
I also don't miss Unifi's single pane of glass view either. All the shiny threat stuff isn't particularly actionable, and there's a bunch of gaps (IIRC like how it'd wouldn't have usable timestamps for some things) so I was never able to use it to make decisions.
I run the Synology with a LACP link; that's plenty fast as its more a storage/backup box than anything that needs to be performant. Speeding all that up would just be a matter of replacing the switch and adding a card into the Synology, but I don't need that for now. (I'd probably get a new NAS before that.)
I personally grew a strong distaste for several reasons. When I first started my homelab I was ready to go all in with Ubiquiti. Equipment looked nice, great looking UIs, great price. Seemed like everything was perfect for the prosumer. I bought some access points and a UDM pro to start, with plans for some POE switches next. First thing that irked me was that I had to log into everything through the cloud. And it wasn't possible to set up the UDM and access points at the time without a cloud account, though I know this has since changed. Second was that they were sending all kinds of telemetry to HQ. One of the reasons I set up a homelab is for privacy and data sovereignty, so having my low level network equipment spy on me is a huge no-go. The third thing that really pissed me off is that there was no way to manage any clients on my network that didn't go through a Ubiquiti access point. I had an old Airport Pro that I was using and all the clients that connected through it were not visible to the UDM pro. Both official support and the reddit forums said it wasn't possible and it didn't make sense anyway, and gaslit me and even removed some of my posts and comments. What is the point of a firewall if you can't disable traffic to some clients (e.g. I didn't want my robot vacuum phoning home to china). I SSH'd into the UDM and indeed see the vacuum in the ARP table so there was no technical reason to not allow me to set firewall rules for it in the UI. I mean the UDM gave these clients DHCP addresses, so it's obvious that the UDM was aware of them. It became clear - it's a business lock-in strategy to force you to go all-in on Ubiquiti equipment. They don't support heterogeneous mixed-vendor networks. I said fuck that and returned it all. Switched to open source products like OPNSense and used professional equipment from EBay and couldn't be happier. Way more control for the same price, no spying, and no vendor lock-in.
Forcing users to use a cloud account and an app for setup, and enabling telemetry without disclosing it to users, although once they were called out on it by folks noticing a bunch of traffic to their servers they eventually confirmed it was happening and added an opt-out option (see https://www.theregister.com/2019/11/07/ubiquiti_networks_pho...), also there was something about NVR and not being allowed to self host it, or use old hardware... I never bothered to really look into that one, but it seemed to come up a lot.
https://discord.gg/ubiquitiinstock
I've scored a few Protect items via alerts here, but be prepared to be patient.
• lies about supporting older versions of APs, telling me I need to upgrade to get x-such-feature, and then they support it later on the older hardware. • Various features sold as _coming_soon_, that really take several years to come about. • making more and more of their setup require a total buy-in of the whole infrastructure when I only wanted one piece of it. • It just wan't very reliable. I'd have to reboot all the APs every now and then to get them communicating well again (this seems to be limited to myself and not my friends, but happened on two generations of the UBNT hardware)
But what did them in on the end for me was some version upgrade totally blew up my network, that does depends on different SSIDs mapping to different VLANs, but after the upgrade, they bridged everything together. Found that unacceptable, so I gave up fighting them, dropped in another enterprise vendor, and now things are truely rock solid.
Yes, they give out many enterprise features for a very low cost, and the feature set does far surpass any of the consumer price range gear that they hover their price points around.
OOTH, since I do work with lots of Enterprise gear, I know when used gear is falling off in price to affordable for home levels, and how much more life I can reasonably get from it. Sure, I don't have 802.11ax, but I don't think my last round of UBNT AP buys can upgrade to 802.11ax either, would have had to buy another round of UBNT gear.
IIRC the udm-utilities also work on the UDM Pro SE, though i'd be a lot more worried about "messing up" when it's not confined to a docker container.
We use this at some of our clients in the MSP space
only fixed cost was the pi to run in (pi version 1 ram if by far enough for just pihole +unbound)
The overhead is very minuscule.. I always forget that I'm using it...
But otherwise I concur, I've run pihole for years without any manual intervention needed.
In my opinion, additional being a curios software engineer I find it quite interesting.
Necessary? Perhaps not but helpful.
Heating valves for example.
The definition of iot from Wikipedia also does it.
But honestly why I hate my iot window blinds device it's the perfect excuse to use vlan at home.
However, I'm more worried about when they start hardcoding DoH servers.
I can’t filter it or redirect it like I can with plain old DNS.
Many years ago I anticipated that "developers" would no longer allow end users to choose DNS servers. The developers' work, i.e., software, was dropping in market value and they began to adopt a Trojan Horse "business model". End users could use the software for free with the expectation that few would notice/complain about increased surveillance and data collection, or injected advertising.
The so-called "MITM proxy" is neither a new nor radical idea. Corporations routinely "MITM" TLS traffic from their networks. Enterprise hardware/software companies have provided turnkey solutions.
The issue is not limited to addresses for DNS servers. For example, WhatsApp hardcodes IP addresses in their mobile app. For that problem I use an application firewall.
The PiHole is essentially a slightly modified version of dnsmasq running on a RPi. It is funny that no one has tried using other DNS software. Given a choice of DNS software, I would not choose dnsmasq. It also still seems that no one has presented a "PiHole" that uses a forward proxy instead of a DHCP/DNS server. Similar to corporations, home users need a turnkey solution for monitoring their home networks.
You'd think thats thr job of the router companies - they sell you hex-core routers for $390 or whatecer, but no usefull functionality
TBH, I always found the Chromecast proposition to be unreasonable: "Look at this neat form factor single board computer you just paid for. Too bad only Google is allowed to have control over it. Sorry, you cannot use this for your own projects because [unspecified]. Google must be allowed to conduct surveilllance and gather data." By comparison, lack of complete control over the RPi GPU is rather easy to ignore. AFAIK, the RPi Foundation is not selling online ad services. Compare the number of cool projects people have done with the RPi versus the Chromecast.
1. I think it used to be possible to force use of different DNS servers via DHCP as well.
But if the network outright blocks random DNS requests, that only leaves DoH, which would require fixed IPs, which should be able to be detected and blocked, right?
Sure, the setup becomes a bit more involved...
This doesn’t work with DNS over https of course.
So you won’t necessarily even get to play this cat and mouse game - the dns requests are indistinguishable from your web requests.
I guess you could mitm your own ssl traffic and strip out dns answers there?
But then … how soon until we see DoHoH?
DoH over Tor already exists, but more importantly, Oblivious DoH (kind of like DoHoH) is being standardized by the IETF: https://datatracker.ietf.org/doc/draft-pauly-dprive-obliviou...
ODoH isn't going to be defeated by TLS MitM afaik.
This means that the DNS response for the web server would always be the proxy itself, or some set of proxies (and it would have to be the same IP for both wanted and unwanted traffic). What does DNS even add at that point? You'd be better off just making your "wanted" and "unwanted" servers the same server.
Few of these ideas can be expected to work unless Evil, LLC controls the program the end user chooses to read the web. When an advertsing services company is also the majority share "web browser" vendor, then ideas like this become feasible. Whereas if web users can choose any client to access the web,[FN1] then these ideas would be non-starters. The open source text-only browser I am using is not going to read the IP address of an ad server embedded in a web page and connect to it automatically. Even if it did, I would simply edit the source code to disable that behaviour and re-compile.
1. In theory they can but in practice they generally don't.
I guess, at this point, the other commenter's solution of "just stop using those things" may be the best.
> I guess, at this point, the other commenter's solution of "just stop using those things" may be the best.
Yeah. Assuming this doesn't change, this is the end result for me, at least.
The next step in the arms race is DoH. Afaik no one has a generic answer to that beyond "treat devices behaving hostilely as hostile".
If it's running on Win/Mac/Linux/Android/iOS, block the app from talking to the gateway, or even the entire LAN.
Now what ?
Not sure what potential issues are are being mentioned here, but I'd say a separate VLAN for IoT devices + QoS [0] should rule out most of the concerns.
Essentially it's just DNS filtering on steriods. You start with an empty (or preseeded) ipset, and a firewall rule that says to reject/drop all outbound traffic if the destination isn't in the ipset. Dnsmasq is setup as the default dns provider in DHCP, and it's setup to add all resolved IPs to the ipset (with an expiration so stale entries get removed).
Then it's just DNS filtering per the usual. DoH, DoQUIC, DoT, etc don't work as their hardcoded IPs are blocked by default, and DNS filtering knocks out domain resolution of the endpoints. Even if an alternate resolver is allowed through the firewall, none of it's responses get into the ipset, so it's still broken (and is a sign I need to update the DNS filter).
Works a treat on my IoT devices
https://www.sidnlabs.nl/en/news-and-blogs/dns-resolution-req...
For example, can you stream Netflix @ 4K via RasPi? I assume no, due to super strict DRM.
It is a little bit surprising to me that the big streaming companies have not creating an open source operating system (similar to Android) that can be used by manuf to create TVs. Then, smaller manuf can find ways to offer bloatware- / adware-free options. Maybe this already exists, and this comment makes no sense!
HDR and OLED are available in some monitor models, but to my knowledge there aren't any 55" monitors with HDR and OLED, and especially eARC.
https://docs.netgate.com/pfsense/en/latest/recipes/dns-redir...
If the dns request is over 443 and the DoH server is the same host as the served resource, what can be done ?
The next step in the arms race would then be to implement DoHoH.
Sigh.
The DNS queries for these bypass any of your own DNS settings.
They even bypass host file overrides.
https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Cyber-Si...
This is a big reason why I will never buy another Chromecast branded product, or Google product, again. Congratulations on successfully monetizing my time and annoying me into swearing off Google products altogether.
> Nearly 70% of smart TVs and 46% of game consoles were found to contain hardcoded DNS settings - allowing them to simply ignore your local network’s DNS server entirely. On average, Smart TVs generate an average of 60 megabytes of outgoing Internet traffic per day, all the while bypassing tools like PiHole.
https://labzilla.io/blog/force-dns-pihole
For those devices which ignore DHCP/NDP provided DNS addresses, you could create a firewall to redirect outgoing port 53 traffic to your own server.
- It disables (and hides) the annoying ads on our Samsung smart TV
- Browsing is noticeably smoother (especially recipe websites on mobile!)
- Most front-end browser trackers are blocked
- It's now possible to see how often apps or devices tend to phone home by just logging into the Pihole web interface
- We're not giving (most of) our DNS activity to our ISP
- Updating to a newer version is a breeze with docker
- I've not locked it down further with a firewall yet to force all DNS requests to go through the Pihole, but I'm planning to.
- I won't run a Pihole container on my UDM as it will likely mess with future updates and settings, keeping things separate feels better.
- Sometimes I consider adding more blocklists but every time I do, something gets annoying somewhere and I usually end up reverting to the standard config.
(edit, formatting)
Encrypted DNS looks like any other encrypted stream, there's no reason for subversive apps to rely on DHCP provided DNS servers when they can be guaranteed to serve ads without them.
Combined with pfsense's recursive resolved (unbound), it makes for a pretty great home dns setup.
Jokes aside, I'd love a blog post on this. Seriously. Very likely to apply the knowledge as well.
also have you done migration between the two? if so, how hard was it?
I tried the auto-migration in OPNsense (backup from PFsense, restore to OPNsense) a couple times. Both times it got it mostly right, but whatever it got wrong blocked pretty much all traffic and was difficult to figure out why because everything looked right. I gave up and stayed with PFsense, but figured if I ever really did want to switch I would start from scratch.
- pfSense CE is an EOL product (and its replacement Plus is closed source). https://news.ycombinator.com/item?id=26479725 / https://news.ycombinator.com/item?id=27775408
- The Wireguard fiasco. https://news.ycombinator.com/item?id=30719403
Pi-hole is to pfBlocker as a Raspberry Pi is to a custom-built router
- When I'm away from home and traveling, if something goes wrong, the Pi-Hole is usually the single source of that error, and is hard to solve by talking to my wife to walkthrough the settings.
- A few websites (India in my case), mostly government ones, do not work when Ads are blocked. Try paying LIC Premium or even login to LIC of India with your DNS modified, Ads Blocked!
- Wife want ads in some of her apps, "What did you do to my Ads!"
Since then, the family was on NextDNS[2] for almost two years - premium member hitting million+ request a month from a 4-member family. With NextDNS slow to update when macOS changes the way they deal with Private Relay, I stumbled on AdGuard's DNS[3] (in beta now). I already bought the lifetime (family) AdGuard license sometime back. So, I tried it and am on it now.
With the current setup, the last-mile choices of blocking ads or not blocking (for some website) is at the client (wife, daughter, and other devices). This works good so far -- everyone have a choice without being totally locked down. I have also taught my 13-year old daughter to keep a watch on Little Snitch.
Here is the typical settings for all of the devices in our family, which works well when inside the home or outside.
Apple's Private Relay (ON) > AdGuard with DNS Routing (OFF/ON) > (Optional VPN when needed) > Balanced/Bonded common ROUTER with minimal locked down settings > All of the ISP's entry routers.
Nonetheless, I've been meaning to tinker so I can have Pi-Hole sitting between our family and the Internet but optionally circumventable easily -- perhaps a big Amber Button which even my 5-year old can press and go into the Internet momentarily.
Edit: I forgot to add my thinking/concept/philosophy in all of this -- We should be able to walk out from most entrapments/situations/entities with minimal or no change needed.
1. https://brajeshwar.com/2019/pi-hole-blocking-ads-at-home/
Cripes! That is amazing data. Thank you to share.
At the end of the day I looked at a few of the sites with her and whitelisted a couple of them, but basically told her that (based on the lists I was using) if the pihole was blocking the site entirely then it was either straight spam marketing or the site itself was malicious in some way.
What is the advantage of this in this case?
I now run it in a docker container because of this, but I can’t speak to OPs motivations
Not specific to PiHole, but perhaps keeping the OPs infrastructure management consistent may have monitoring and maintenance benefits.
And specifically mentioned in the very next sentence:
> The Pi Hole project already has a nice Docker project utilizing compose.
It is a supported configuration for PiHole so it fits in nicely, no need to even product their own docker based solution.
Not much of a docker user myself (I've tinkered, and we use it for some things in DayJob, but for my own stuff I use VMs or occasionally LCX if I do want a container instead), but the answer to your questions was really quite obvious.
Had I a convenient way to set it up in a Docker container, it would've been better. Of course, since I don't run anything in Docker at home, that would also constitute a special setup I have to maintain.
I used to run pihole on various Linux distros I was testing for home server stuff. It used to be that some distros needed a few packages added to support pihole properly but nowadays the app itself is more streamlined and/or most common distros include the minimum components. I think pihole did focus on streamlining to enable easier docker support which is where I should be putting my install whenever I get back to messing with the homelab. I've been working in windows systems for work so everything is currently Win Server based which plex doesn't seem happy with but is easier than running the whole thing as VMs on my older hardware.
- I download the ISO for my system (Arch Linux)
- I install it on a drive
- I install docker and a (very) few other things
- I recover /etc/docker and data from a backup
- I run my docker-compose
- the server is up
Time: around 30 min to 1 hour without any documentation.
For me - THAT is the real power of docker.
That you can manage & think of this machine (program/process/container/vm) the same was as every other machine & dont have to ever ever ever ask "what should i do in this case?" or "what's right for this case?" because it's a unified answer that works well & operates the same everywhere.
Uniformity & no special cases. Death to pitiful old ways.
Much more recently I realized that this phenomenon of One Rule, One Exception falls under the umbrella of - or perhaps explains the effectiveness of - the Rule of Three. Two exceptions are bad, and work is partially pre-empted to correct that problem.
ublock origin works fine as a plugin in firefox on android, and blocks ads just as effectively on firefox on desktop.
the ability to install arbitrarily chosen firefox compatible plugins on firefox on android is a huge deal for me. it makes it almost as powerful and useful as firefox desktop.
the only time I need to touch chrome anymore is when using some rare 1% of online shopping website that seems to think a firefox useragent is a bot.
I've looked into this and it seems like there is no software out there that makes this easy. For it to be convenient enough to make sense, I think there would have to be some router 'login' page which makes downloading and installing the certificate as easy as possible. But, even 'easy as possible' would probably be too inconvenient for any guests who just want to use your wifi. Maybe it could be optional somehow. Don't install the custom certificate? Fine but you'll still get ads. Install the custom certificate? Awesome, your ads will be blocked.
Back then you could simply block ad.youtube.com and there would be no ads but today Google is serving ads via their main domain. You can't block ads unless you block youtube.com.
So now no DNS based adblocker can block YouTube ads. uBlock is the only option which works inside browser only.
PiHole works at the DNS level, it can't block things if they're served from the same domain
Without being able to read the destination IP address, all the middlemen between your device and your destination server, wouldn't know where to forward your request. Your request would never make it to its destination website. The destination IP address is retrieved when you access a website. When you type google.com into the address bar, your computer sends out something called a DNS request to something called a DNS server. That DNS server sends back the destination IP address for the website you're trying to access. This DNS request is unencrypted and so PiHole can simply intercept it before it leaves your network, check if it's an ad domain, and if it is an ad domain, send back trash data to your device instead. Your device, unable to retrieve the destination IP address, is now blocked from accessing that content.
To prevent people from being able to block their ads via DNS, Google hosts ads on domains which are critical to using their services. For example, YouTube ads might come from youtube.com. This way, if you block YouTube ads using PiHole, you are also blocking the entire YouTube service as well.
UBlock Origin and other browser-based adblocking tools are able to block with a more fine-grained approach because they live in your browser and don't have to worry about SSL.
I think you should install both though. Pihole can block ads on apps, and can block CNAME cloaking.
Additionally I can recommend the "Privacy" web browser on Android combined with the "Rethink DNS" firewall.
Both are amazing tools that help speed up your phone, and allow you to even filter ads out of specific apps that use e.g. an embedded cloudflare DoH resolving mechanism.
If you want to dig deeper, there's always the Aurora App Warden and Permission Manager X which allows you to modify other Apps and remove their Activities and Services that are coming from ad frameworks.
I do still have issues with keeping Wireguard running when I switch from lan to wan with my phone, so for now I'm setting it as conditional (only Wireguard on when outside of lan).
https://nicolaslouge.com/post/install-adguard-home-raspberry...
Our phones and smart devices all use either DoH or hardcode a specific DNS resolver. I haven't spent the time going all the way down to re-routing all port 53 traffic, but I doubt it'll do much.
To me the future of the home network is largely dead as long as I can't reasonably manage the software on these devices.
My phone uses whatever DNS I configure it to use. When I'm at home, it uses my PiHole.
If you mean individual apps going their own way, that's a different problem.
||mask.icloud.com^$dnsrewrite=NXDOMAIN;;
||mask-h2.icloud.com^$dnsrewrite=NXDOMAIN;;
||mask-api.icloud.com^$dnsrewrite=NXDOMAIN;;
||mask-t.apple-dns.net^$dnsrewrite=NXDOMAIN;;
||mask.apple-dns.net^$dnsrewrite=NXDOMAIN;;
||mask-api.fe.apple-dns.net^$dnsrewrite=NXDOMAIN;;
0.0.0.0 trashsite1.com
0.0.0.0 trashsite2.com
The only downside I see is that my approach is not network-wide. Any other reasons I should reconsider?
Previous subthread about it: https://news.ycombinator.com/item?id=22535387
(But it doesn't look like wildcard pattern matching doesn't work for the substring middle part of the string like your example.)
It’s an elegant and efficient way of taking back control of your network and the content It shows you.
I run it in a pi zero w with a little wooden case and a low power phone charger (500ma) I Velcroed it to my router.
I highly recommend that everyone do it.
Also, ublock origin can only protect you from CNAME cloaking (a commonly used to evade ad blockers) on firefox. It can't protect against CNAME cloaking in chrome or other browser. But pihole can.
You should still install an adblocker in your browser though as some ads are loaded from the same domain they're serving site contents from, such as youtube ads. Ad blockers can remove ads based on full urls, not just domains.
I ran in to a similar issue on Windows, which is described here: [1]
After following that article's suggestion to disable the Windows "DNS Client" service name resolution returned to normal.
[1] - https://tinyapps.org/blog/201809300700_large_hosts_file.html
I love pihole - but this is still slightly exaggerated. DNS-based sinkholin does have its limitations.
your queries are not leaked…
Your question is better asked to the creators in question I think. They prefer to provide you content through an ad-supported model.
Use the networking section of the developer tools in your browser. On a mainstream site I was just visiting, the page itself was about 50 kilobytes and it downloaded just under 3 megabytes of ad and tracking JS.
Of course I could've bought a new router and set that up to work between the Pi and the Comcast one, but that was more than I wanted to put into it.
Now I have a different service with a different router, so if I can ever find the Pi, maybe I'll try it again.
I set up a Pi-hole for my home network easy enough on a Fritzbox router, with the Pi-hole as DNS. I've since gone a step further, and now use the Pi-hole for DHCP too. The router now just routes.