Before I fully understood what pihole was doing, it does not block out going things, it was amazing to see how much ad poop was trying to get to my TV. As I got more and more into this very inexpensive hobby of home labing /s I decided just to remove the TV from my wifi and my pihole went from blocking in the high 60% range to something more like the mid 30% range.
I went the Flint 2 route, I do not currently need wifi 7 but I did flash it with vanilla Openwrt. With the clean vanilla OpenWRT I have added 2 VPNs, I am considering adding a third (one is personal, one is to show off to friends, and the third one will be for my off site back up). I have a poop load of vLANs (IoT stuff, home lab stuff, my personal stuff, guest stuff, child safe vLAN, Personal VPN vLAN, guest VPN vLAN). I have a bunch of wifi APs, (personal, guest, kiddo safe, IoT, and a few because I am an asshole and believe all them waves belongth to me!).
My plan was to host my own email server but this girl loves her hair and did not want to pull it all out, so I just continued on using a third party for that, this is why I got a firewall I controlled because I needed static IP addresses for email but I would recommend getting one if you are adding your own firewall just to by pass everything your ISP is doing, I have fibre but even when I had DSL my ISP had to keep their modem in there, port 1 is just a dumb switch that goes to my firewall.
Originally I had a VPN running on a pi zero 2 (do not do this it is not that great to do it), but now my Flint 2 takes care of it and I do not notice any slow downs when I am away from the LAN. As a Canadian my PM just recently said we are at war with the US, sure it is a trade war not a pew pew boom war but war non the less and as an ex-Apple fan girl I was already slowly moving my stuff away from Apple things and use a pi 4 for HA I have a pi 5 running a bunch of services including pihole, would highly recommend, I have another pi 5 running stuff, and a pi zero 2 running my secondary pihole. I would highly recommend pihole to anyone who is just starting home labbing or been at it for a while, there is some disagreement with people who use other ad blockers but I found pihole first and feel in love with it. You will be so glad to have a VPN with whatever ad blocker you choose (pihole). But getting a static IP is a good idea, sure there are hacks to get things working with things like duckdns.org, your own domain, or whatever else.
You mention hackers and bots, I have crowdsec running on my firewall with things going to all my other devices and a honey pot on my pi zero 2, but my suggestion is if you do not want to set up crowdsec and just rely on the firewall make sure you use strong passwords, I have vaultwarden for those, and change your ssh ports on your devices and while you are at it do not use anything in the 8080 port range.
I am so afraid of an SD card dying and killing my HA so I have a HD setup. I have one good SD card of the 10’s of cards I have killed and it is now running my ssh honey pot on a pi 0 2.
I do not care to admit how many times when I was first getting into home labbing that I could not figure out why I could not reach a pi or the internet. All because I either killed an SD card for pihole or just plain out forgot to put one in!
I have always used cups and never had problems with what you are talking about, however using the web ui is relatively new to me. SANE I have always had issues with no matter the UI I use.
I learnt basic HTML as a youngling in the 90’s so back before it got very complex, no formal training. I pretended to learn python for my 100 level comp sci in the mid 00’s but completely forgot it after the class was over. I just got into the hobby recently because I did not want to continue paying for stuff but not owning stuff, and it was getting silly expensive for my unlimited free trial hack and personal blog. Plus I wanted to start getting away from big tech, so learning about self hosting from the web and double checking my stuff with Claude really helps.
I have a flint 2 (glinet) as my firewall as well, I had read somewhere that I should install vanilla OpenWRT so I did (I have added stuff to it so I like coming up with different flavours when talking to people like rocky road). I have Caddy running in docker on a pi in my LAN I have a password file of some sort that Caddyfile references at the top. Don’t ask me how I formatted it because I do not remember that part but take my secondary pihole as an example of using a domain that cannot be reached, from outside of my lan.
pihole52.reannlegge.ca {
@allowed {
remote_ip 10.0.0.0/8
}
handle @allowed {
redir / /admin{uri}
reverse_proxy http://10.0.69.52:31415/
}
handle {
respond "Not available from this network" 403
}
import easydns_tls
log {
output file /var/log/caddy/pihole52.log
format json
}
}
While other places on my domain can be reach outside of my vLANs. I have to secure some things up as I found that my SearXNG is open to the WAN.
Edit: looks like search.reannlegge.ca was available on the WAN if you where in Canada but I have changed that to only on my vLANs and VPNs
I got into self hosting because my place flooded and I was waiting on insurance and the repair people to fix give the go a head and then to actually fix my place I do not really go anywhere so I was fine with being blasted with ads when I was out of my home, until I caught myself watching ads to get extra whatever from a mobile game. I had a pi zero 2 (with a PoE hat) that was not being used for anything so I thought why not use it to host wireguard, I had looked at a few options for VPNs but thought wireguard fit my needs the best. It “worked” I do not know if it was just my copper internet speeds or the silicon in the pi zero 2 which slowed everything down but now that I have a dedicated OpenWRT firewall, fibre, and a static IP (well technically 2 I just do not use the second one because the weekend project of spinning up my own SMTP and IMAP server had me at the point where I wanted to pull out my hair), I have wireguard automatically turn the VPN on when I am away from my LAN. So I would only see the adds if I went on someone elses device.
I use easyDNS and they have a wild card option for their email, so I have a formula whenever I am signing up for something my email addresses are always nameofservice_funSaskathchewanwordplusthreerandomnumbers@reannlegge.ca. When I started this I was on hosthero and they use cpannel with no wildcard options you have to go in and create the email address before you use it. When I left hosthero, because they cost to much and are not the friendliest company to deal with I had something approaching 300 unique email addresses after 4 or 5 years because I did just not bother closing them after I continued using the free trial of whatever or just stopped the forwarding to my main email address or whatever email it needed to be sorted into.
Now I just have everything automatically go into junk mail unless it is something I need than I make the effort to log into their easyMAIL web thingy and sort where it should go. I have it set to delete things that are a week old (I think it could be a month?) so if I do not need it I do not need to worry about it and it will just go away on its own other things are sorted into folders and very few things are sent to my inbox.
I was never really a windows user, I grew up on Mac OS (Apple DOS, 7, 9, and X). I am stuck with an iPhone and an iPad because I do not have the money to replace them at the moment but as soon as there are no longer updates for them they are being stripped of most of the data, being put onto my IoT vLAN and being used as HA kiosks. I say so long to things as soon as updates are not being pushed because they become attack vectors. I have had my ID stolen once before, probably not because of out dated things but I want to limit the places bad actors can get to me (just know the process of making sure stuff doesn’t hurt you further is hell).
I have a Mac mini I am thinking of doing some actual work to get Debian installed on but I turned on the Mac just to get my iTunes purchased music off of it and than half assed an attempt to get refit installed and get Debian running, maybe some day I will get it working but that day is not now.
I have 2 instances of pihole running in my LAN, I have wireguard on my firewall to get to those two ad blockers when I am away from home. I am so glad I was able to figure out how to get it back up and running without needing to redo all the work.
I have pihole do a lot more than just block ads; they also block a few different tlds (like .zip), they have different lists for different vLANs, and there are several different regex things I have in it.
They are not on the same pi, sure they are both docker images but they are on different pi’s
I have a Flint 2 with a vanilla install of openWRT, that hosts wireguard. I have 2 static IPs, because I thought hey running my own mail and smtp services cannot be that hard (turns out yes it is hard and not worth the time to deal). Any who I have Wireguard running on my firewall and Caddy running on one of my pi’s, it gets TLS from lets encrypt.
I have a couple of domains that Caddy uses to point things out to the world or my LAN/vLANs/VPNs. Very few of the things go out to the whole world, but if I wanted to share say a Jellyfin server with someone I could wip up a VPN that only allows Jellyfin through and points DNS to my piholes. Why do I mention my ad blocker? I mention pihole because that what hosts the A records to my domain names that Caddy can serve up, I do not remember why I set it up like this, I would have to look through my notes but pihole points “service”.domain1or2.xyz to caddy which than points to the right service.
Edit: went and looked A records are hosted on pihole for my LAN/vLANs/VPNs to prevent things needing to go out and come back just to tell devices where on my LAN services are.
I started using Navidrom as suggested by someone in the group. I do not have audio books but it has a spot for them. If you want to get all fancy like you can use the MusicBrainz Picard for tagging stuff differently (or something like that I am really feeling the glue and sealant they used to put down the laminate in my place right now) but AudioMuse-AI does something to (again really feeling it).
I use a Flint 2, I think I have something like 5 AP’s On it and it covers my whole home. I have a bunch of vLANs as well for the APs and VPN’s. It came with some custom OpenWRT install but I flashed it with a vanilla version instead. I was using an Apple Airport Extreme prior to getting the Flint 2, but my place flooded and I got board so I took up the hobby of home labbing while I wait on insurance to get things rolling (after a few months the flooring is finally going in tomorrow) my original plan was going to be use the Airport as an extender but I did not need that, but yes APs with the same SSID will work together. My Flint 2 has SMB setup to back up its settings to a pi I have on my LAN.
I decided that living on a hope and a dream of maybe someday seeing if my Mac Mini still worked I can now gleefully say it is working* if I cannot figure out how to update it further oh well I will just continue on with it as is and harden it the same way I do everything else. But right now it is downloading my music library, which I will promptly backup before trying to update it further.
*I need to figure out how to update it to the last OS version it can handle.
You should really have a good hardware firewall before you do that. Change ports, change ports for everything you can nothing I run is on the standard port I make sure of that other than 80 and 443 for unbound I would if I could but I like having access to the internet I should have mentioned that with pihole.
Before I fully understood what pihole was doing, it does not block out going things, it was amazing to see how much ad poop was trying to get to my TV. As I got more and more into this very inexpensive hobby of home labing /s I decided just to remove the TV from my wifi and my pihole went from blocking in the high 60% range to something more like the mid 30% range.