(Part 2) Best products from r/pihole

I tried using an older Pi to host my pi-hole and compared it to a newer 3b+ and found no real difference in DNS lookups, but updates and the web interface were a lot slower and some things would run out of memory on the really old Pi. Ordered a second 3b+ and replaced the old Pi.

Power supply quality is critical, get a good one from Adafruit or Canakit.

A case is important to protect the Pi from damage, something simple is good enough, a dog-bone style works well and is a bit cooler if you have a safe place to mount the Pi, a more fully enclosed one is safer if the Pi is going to be banging around with a bunch of other stuff. Cooler really doesn't matter in a home install unless you are going to add something to your Pi that will cause it to run hot, fans, heatsinks and such really aren't needed.

SD cards are cheap, Samsung or Sandisk 32 GBs are excellent and you save pennies by going cheaper or smaller.

For Ethernet there is little difference in cables for the lengths you'll be using, and standard cable will work, get one a couple feet longer than the minimum and you'll have slack to work with.

So Pi, power supply, case, SD card and Ethernet cable will get you set up with a very nice Pi-hole.

The most difficult part is planning out which devices go where and how to best segment services from one another. Some folks with extensive labs and equipment get quite granular with their approach, potentially having separate VLANs for everything from storage (NFS, SMB, etc.) traffic to networking devices and servers. I'm FAR from an expert, so my goal was to start simply and begin by getting this IoT traffic separated. Using (redundant) Pi-hole(s) it's quite easy to see how much traffic is generated from a single Roku device, we're seeing 10+ thousand requests daily for various Roku logging servers, plus additional Google traffic related to various smart home speakers (Google Home Mini x4) and on and on it goes.

I'd also encourage you to redirect DNS traffic for devices (such as the Google Home Minis), as they come with hard-coded DNS servers which will work around your Piholes, or other DNS blacklisting efforts. That's a separate project which can be implemented on your router with some sNAT & dNAT rules which will invisibly redirect traffic to your chosen DNS servers, be it locally or upstream. I'm achieving these things by running Unbound with Pi-hole, as my own little in-house, recursive DNS servers, rather than using the typical upstream DNS, provided by either your ISP, or Cloudflare (1.1.1.1 & 1.0.0.1), Google (8.8.8.8 & 8.8.4.4) or Quad9 (9.9.9.9 & 149.112.112.112)... but that's up to you to decide what's best for your own network.

Here's a great video to hopefully get you started. I can't seem to find the blog post I was thinking of, but I learned a lot from this video, then you just have to translate specifics to your type of router and networking gear:

> https://www.youtube.com/watch?v=6ElI8QeYbZQ

Hope this helps. Please let us know how you make out, or if I was unclear in my ramblings above. I'm still learning too, so please keep in mind that I'm anything of an expert, but I enjoy tinkering and am trying to take our data privacy seriously. It's a constant trade-off to be able to utilize much of today's technology. We want to be able to continue controlling lights, locks and things remotely and/or with our voice, so the least I could do was try and restrict the en masse data collection.

EDIT: What type of router are you using? Not sure who mentioned having a Meraki device. I'm using an Edgerouter 12 with UniFi wireless access point (UAP-AC-LR) and a Cisco SG300-20 small business switch, but the ER12 also had its own 8-port built in switch, and I've also got an ultra cheap TP-Link 8-port switch (TL-SG108E), as it was the absolute cheapest way for me to get a budget Gbps switch that supported advanced features that a truly managed switch would have, such as QoS, VLANs, port mirroring, LAG groups and such.

I'm going to break this up and just cover the purchasing of the hardware, as I'm sure there are plenty of guides available for how to set up a Raspberry Pi, as well as guides for setting up Pi-hole.

Firstly, we need some hardware to host the Pi-hole on. You want something that has lots of community support, so the Raspberry Pi is going to be your no-brainer choice. The Pi's consume very little power - barely $4 a year to your electricity bills, so that's thankfully not a concern. Your cheapest option is a Raspberry Pi Zero (v1.3 is going to be your best bet, but you also need to purchase an Ethernet adaptor instead of using WiFi). However, your easiest-to-set-up option is going to be the Raspberry Pi 3B as it comes with an Ethernet port.

For the hardware, no matter where you buy it from (Amazon, The Pi Hut, Pimoroni, etc), you need to make sure you have the following (either via an "all in one" kit, or by purchasing the items separately):

• The Pi you've chosen (Zero, 3B, etc)
  
• A suitable power supply such as this (This one can be used on either the Zero or 3B. The Zero needs much less power, so any old USB power supply can do the job)
  
• A case that fits your Pi
  
• A Micro SD card. This is an important one!! You can go with one that has NOOBS preinstalled, or you can buy one from a reputable brand that isn't going to die in six months time. I personally use two 8GB Samsung (Baby Blue) in my two Zeroes as I'm not doing anything fancy on them that require transfer speeds over 24MB/s. They'll also work perfectly on the 3B!
  
• If using a Pi Zero, get a Micro USB Ethernet adaptor. Grab one with a model number, and see if you can search around online to see if they're compatible with the Debian Linux distribution: they should work with a Raspberry Pi.
  
• An afterthought: do make sure you've got a spare Ethernet cable handy!
  
  I'm going to preface this with the disclaimer that I've not read these following linked tutorials, so can make no claim to the simplicity of their content. Having said that, now, you can follow one of many online tutorials that cover setting up your Raspberry Pi. Once set up, you can follow a tutorial on setting up Pi-hole such as this one. That video (with any luck) should hopefully cover the more technical stuff like how to change your DNS server on all your household devices.

Ok man, 5 hours later I am finally happy with my setup.

I did not get a AC66U_B1. Instead I got a T-Mobile AC1900 - https://smile.amazon.com/gp/product/B01MYTAURW
It was $57 like new from Amazon Warehouse, sold by Amazon. When I got it, it said on the box refurbished, it should not have been but whatever I turned it on and it works fine.

It is a RT-AC68U but with different firmware. I had this before and you can flash it to be a normal RT-AC68. Thats what I did following this guide - https://www.bayareatechpros.com/ac1900-to-ac68u/

Merlin setup and used your steps, its working perfectly.
pihole conditional forwarding on and all my hosts show up just like I wanted now too

Thanks for the guide!

Edit: picture of setup - https://i.imgur.com/tKDuYi8.jpg

Thank you kindly for the response, sir. I have this DS3231 real-time clock module from Atomic Market and it's been working out pretty well. I was apparently too dense to realize that the Pi-hole DNSSEC checkbox was redundant on top of Unbound. That has now been resolved and I'll hope for the best.

And I believe the drivers to be active,
> >$ lsmod | grep i2c_

i2c_dev 20480 0
i2c_bcm2835 16384 0

Should I have ntpd installed, as well, or will my device(s) be able to accurately pull the correct time from my router, which has a series of four NTP servers configured, running: ntpd 4.2.8p10@1.3728-o ?

EDIT: My router tends to get out of sync. I believe this to be due to the fact that the /etc/resolv.conf file is changed back to 127.0.0.1 after every reboot by Vyatta so it loses the ability to access the outside world. It's SUPPOSED to redirect queries to DNS1/2, but that's not possible without the basic configuration in place (which is only important for me to change when I need to make updates, or run patches/fixes on the device). Updated manually, repaired the ntp servers and enable "iburst" for fast time sync and all seems to now be well. Thanks for your assistance. Will make sure I have a couple more NTP servers on the network to avoid this in the future.

For routers, anything with decent reviews on Amazon will probably get the job done. I tend to go with Asus and TP-Link, but there are lots of good models out there. I've had mixed results with Netgear and Belkin in the past, but worth it if you find one on a good deal.

• Any of these TP-Link models would probably work for you.
  
• I would also highly recommend this T-Mobile branded Asus "refurb." (I've bought 3 of them in the past for various different uses, and they were solid each time).
  
  For a modem, anything DOCSIS 3.0 or up should do for most people. Eg:
  
  
• Linksys
  
• TP-Link
  
• Netgear
  
  Of course, if you have specific high-end needs, these might not quite meet those, but I doubt whatever xfinity has you using would either.

okay, is there a list somewhere of routers that give you that capability? was looking on amazon at some of the gigabit routers. https://www.amazon.com/NETGEAR-Nighthawk-AC1750-Gigabit-Ethernet/dp/B00R2AZLD2/ref=sr_1_3?s=pc&ie=UTF8&qid=1524849878&sr=1-3&keywords=gigabit+router this one looked pretty good speed and price wise.

I've had zero problems over the years using pfsense (originally m0n0wall) with various pieces of equipment. If the uptime isn't listed in hundreds of days, the hardware (or driver support) isn't reliable! I started with an "ancient-even-back-then" Pentium 233Mhz MMX and a few bits of support kit (Linksys PCI NICs, IDE to CF adapter, ISA VGA card in case I needed direct access for some reason). Couldn't ever bear to throw it away, pretty sure it would only need a new AT power supply to put back in service: http://i.imgur.com/obsY5Su.jpg

So, the first step is starting with something reliable as a base. An old LGA775 sounds perfect! Don't go nuts trying to find dual integrated Intel gigabit NICs or whatever...unless maybe you're trying to start a small WISP or something! I believe most "problems" would stem from regularly pushing consumer equipment to the edge of their maximum throughput: most folks are not likely to do that (otherwise they'll likely have the budget for the proper hardware).

For example: I used the built-in adapter because I'm cheap and lazy, and knew I might need to swap it out...but it's never given a bit of trouble so far (knock on wood). For reference, the two pieces I'm currently pushing data through without issue (~119 day uptime at the moment (~1.2TB down, ~250GB up), ~500-1000 active connection on average, load average is almost always measured as 0.0x):

https://www.amazon.com/gp/product/B00JB40498 (Realtek 8111GR I think)

https://www.amazon.com/gp/product/B001CY0P7G (Intel 82574L I think)

I have found that others recommended this (never used myself):

https://www.amazon.com/gp/product/B000BMZHX2

I have one of these laying around, would it be good?

I have a spare PC, but I don't feel like keeping it on all the time! Space is an issue too, something small like a Raspberry would be nice!

depends where you live...in EU you can get very, very capable wifi access point for 25€ https://www.alza.at/mikrotik-cap-lite-d5255835.htm

or this one for 18€ which looks so cheap that it's suspicious but it's got the full blown firmware version: https://www.alza.at/mikrotik-rb931-2nd-d5255846.htm

or this one which is powered by mini usb and I use it as mobile hotspot sometimes because it lasts > 24h with powerbank

https://www.amazon.com/MikroTik-RB941-2nD-RouterBoard-2-4GHz-Access/dp/B00UR758BM?ref_=ast_bbp_dp

two pis + two sdcards + two power supplies might be bit cheaper than that but will never match a dedicated device in terms of reliability IMO.

Don't get me wrong, I have been playing with RPIs for quite a while and currently have pi-hole, but I would never use it as my core routing device.

Don't forget a good power supply or micro usb cable.