I have an automatic WireGuard VPN set up on my devices to VPN into my home network when I'm not connected to my SSID, so my local DNS still works remotely.
My primary problem with Pi-hole or any other DNS-based blocker is that it silently breaks things. YouTube stopped saving my spot in videos. I couldn't click through on any link that involved a tracking service.
These things accomplish their stated task well, but leave behind an insidious trail of browser errors, broken pages, and broken apps without ever indicating to the user what the cause of the problem really is.
DNS just isn't the right tool for fixing shitty UX in the browser DOM or a mobile app. It's a happy coincidence that it works more often than not.
In fact pi-hole works so well that I'm always struck by how awful the internet has become when I venture away from my home network. Doctorow's enshitification in action.
It's really an issue with feedback, though. When my ad blocker breaks a page, it says that it blocked something. When pi-hole breaks a page, it just appears to be broken.
1: https://discourse.pi-hole.net/t/commonly-whitelisted-domains...
Still, these problems are so small compared to the value I get out of my PiHoles. Blocking ads for years on end while having troubles maybe 3-4 times in total. All the other time it just works.
I saw some people setup pihole 5min temporary off buttons one way or another to get by. I run lockdown also.
For the price of a single Pi, I can get NextDNS ad protection for _all_ my devices for multiple years. No matter where they are.
I run it on my NAS Linux server (in a Docker container) where I have a bunch of other things. Zero problems, now using it for more than two years.
Most likely it can be made to work, but I have more money than time to spend on faffing about with stuff that should Just Work, so I threw $10 at NextDNS which solved all my issues instantly :)
NextDNS has been fantastic. And like you said, easily portable.
Exact same setup for me also.
I also run Tailscale since I have run into some remote networks that blocked wireguard's port.
I like the idea and might set that up but my residential ISP doesn't have great peering and latency isn't great. I wonder if that extra roundtrip would be noticable or not.
I also had my banking app stop working one day. Never could get it working. Eventually I just got fed up with having to switch vlans or to mobile data to check my bank and got rid of the pi-hole.
The blocker on PFsense eventually had the same issue.
Realistically, I was probably running too many overly restricting blocklists for my actual needs.
But, I also don't want to fiddle with messing with the out of the block blocklists that also caused me issues.
Not really. You can pull your phone out and do it in less than a minute
> it isn't always obvious which weirdly-spelled domain is causing the issue
It typically /is/ pretty obvious. You can drill down to the device making the request, and it becomes obvious once you see the blocked query
To each their own though. I personally don't want to pay a company to do something for me that I can do myself.
I generally will go in and whitelist things if a site breaks due to a DNS block, but of course putting your partner on the same VLAN can be problematic. I "got around" that by having a button in Home Assistant that will completely turn off Pi-hole (and now AdGuard). So my partner will go in and toggle that if there's a problem.
AdGuard Home does also have the ability to completely disable blocking for specific clients.
I also realize that you shouldn't expect most people to do that, let alone know how to.
I am someone who is very aggressively anti-ad.
One potential workaround, if your hardware supports it, is to broadcast two separate SSIDs for general users: one with a blocklist, and one without as a fallback. Users just need to know when to use each.