DNS Filtering Setup

🎣 Phishing Domains

What they are: Fake websites designed to steal login credentials, personal information, or financial details by impersonating legitimate services.

Why block them: Protects against identity theft, account takeovers, and financial fraud. Essential for family safety and business security.

Examples: Fake banking sites, counterfeit shopping platforms, fraudulent government portals

🦠 Malware Domains

What they are: Websites that distribute malicious software including ransomware, spyware, trojans, and other harmful programs.

Why block them: Prevents device infections that can encrypt your files for ransom, steal sensitive data, or turn your devices into botnets.

Examples: Drive-by download sites, malicious software repositories, infected ad networks

🏦 Banking Trojan Domains

What they are: Specialized malware domains that target online banking and financial transactions, designed to steal banking credentials and hijack financial sessions.

Why block them: Protects your financial accounts from sophisticated attacks that can drain bank accounts and steal credit card information.

Examples: Banking credential harvesters, transaction interceptors, financial session hijackers

🎛️ Command & Control (C2) Server Domains

What they are: Control infrastructure used by cybercriminals to command infected devices (botnets) and coordinate cyber attacks.

Why block them: Prevents infected devices on your network from receiving malicious commands and stops data exfiltration to criminal servers.

Examples: Botnet command servers, data exfiltration endpoints, remote access tool controllers

For Raspberry Pi

1. Download and flash Raspberry Pi OS Lite to MicroSD card
2. Enable SSH by creating empty "ssh" file in boot partition
3. Boot Pi and connect via SSH (default: pi@raspberrypi.local)
4. Update system: sudo apt update && sudo apt upgrade -y
5. Set static IP address in router or system configuration

For Ubuntu/Debian Systems

1. Install minimal Ubuntu Server or Debian
2. Configure static IP address
3. Update system: sudo apt update && sudo apt upgrade -y
4. Install curl: sudo apt install curl -y

Automated Installation

# Download and run Pi-hole installer
curl -sSL https://install.pi-hole.net | bash

Installation Options:

• Choose your network interface (usually eth0 or wlan0)
• Select upstream DNS provider (we'll change this to Unbound later)
• Choose default blocklists (StevenBlack's list is good to start)
• Install web admin interface (recommended)
• Install web server (lighttpd)
• Log queries for statistics (recommended)

Install Unbound

# Install Unbound DNS resolver
sudo apt install unbound -y

Configure Unbound

# Create Unbound configuration
sudo nano /etc/unbound/unbound.conf.d/pi-hole.conf

Configuration content:

server:
    # Port and interface configuration
    port: 5335
    interface: 127.0.0.1
    
    # Privacy and security settings
    do-ip4: yes
    do-udp: yes
    do-tcp: yes
    do-ip6: no
    prefer-ip6: no
    
    # Performance settings
    num-threads: 1
    msg-cache-slabs: 8
    rrset-cache-slabs: 8
    infra-cache-slabs: 8
    key-cache-slabs: 8
    
    # Cache settings
    rrset-cache-size: 256m
    msg-cache-size: 128m
    so-rcvbuf: 1m
    
    # Privacy settings
    unwanted-reply-threshold: 10000
    do-not-query-localhost: no
    
    # DNSSEC validation
    auto-trust-anchor-file: "/var/lib/unbound/root.key"
    
    # Hide DNS server info
    hide-identity: yes
    hide-version: yes
    
    # Harden against DNS manipulation
    harden-glue: yes
    harden-dnssec-stripped: yes
    harden-below-nxdomain: yes
    harden-referral-path: yes
    
    # Use 0x20-encoded random bits in query
    use-caps-for-id: no
    
    # Reduce EDNS reassembly buffer size
    edns-buffer-size: 1232
    
    # Perform prefetching
    prefetch: yes
    
    # Access control
    access-control: 127.0.0.1/32 allow
    access-control: 192.168.0.0/16 allow
    access-control: 172.16.0.0/12 allow
    access-control: 10.0.0.0/8 allow

Start Unbound Service

# Start and enable Unbound
sudo systemctl start unbound
sudo systemctl enable unbound

# Test Unbound is working
dig @127.0.0.1 -p 5335 google.com

Update Pi-hole DNS Settings

1. Access Pi-hole admin panel: http://[pi-hole-ip]/admin
2. Go to Settings → DNS
3. Uncheck all upstream DNS servers
4. Add custom DNS: 127.0.0.1#5335
5. Enable "Never forward non-FQDNs"
6. Enable "Never forward reverse lookups for private IP ranges"
7. Save settings

Verification Commands

# Test Pi-hole is blocking ads
nslookup doubleclick.net [pi-hole-ip]

# Test Unbound is resolving
dig @127.0.0.1 -p 5335 google.com

# Check Pi-hole query log
tail -f /var/log/pihole.log

Essential Security Blocklists

Add these URLs to Pi-hole Settings → Blocklists:

# Phishing domains
https://raw.githubusercontent.com/Tempest-Solutions-Company/pihole_blocklists/main/phishing_domains.txt

# Malware domains  
https://raw.githubusercontent.com/Tempest-Solutions-Company/pihole_blocklists/main/malware_domains.txt

# Banking trojan domains
https://raw.githubusercontent.com/Tempest-Solutions-Company/pihole_blocklists/main/banking_trojan_domains.txt

# Command & Control servers
https://raw.githubusercontent.com/Tempest-Solutions-Company/pihole_blocklists/main/c2_domains.txt

Additional Protection Blocklists

# Comprehensive ad blocking
https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts

# Privacy and tracking protection
https://someonewhocares.org/hosts/zero/hosts

# Cryptocurrency mining protection
https://raw.githubusercontent.com/Tempest-Solutions-Company/pihole_blocklists/main/crypto_mining.txt

# Adult content filtering (optional)
https://raw.githubusercontent.com/blocklistproject/Lists/master/porn.txt

Essential Health Checks

# Check Pi-hole status
pihole status

# Check Unbound status
sudo systemctl status unbound

# Monitor system resources
htop

# Check DNS resolution speed
dig @127.0.0.1 google.com | grep "Query time"

# View recent blocked queries
pihole tail

Setup Automatic Updates

# Create update script
sudo nano /opt/pihole-update.sh

#!/bin/bash
# Update Pi-hole gravity database
pihole -g

# Update system packages
apt update && apt upgrade -y

# Restart services if needed
systemctl restart unbound
systemctl restart pihole-FTL

# Make executable
sudo chmod +x /opt/pihole-update.sh

# Add to crontab (daily 3 AM)
echo "0 3 * * * /opt/pihole-update.sh" | sudo crontab -

Local Network Resolution

Configure Pi-hole to resolve local hostnames by forwarding queries for your local domain to your router.

• Settings → DNS → Advanced DNS settings
• Enable "Use Conditional Forwarding"
• Set local network details (192.168.1.0/24, router IP)
• Local domain name (e.g., "home.local")

Client-Specific Filtering

Create different filtering policies for different devices or users:

• Kids Group: Strict filtering with adult content blocking
• Work Group: Social media and entertainment blocking during work hours
• IoT Group: Minimal filtering for smart home devices
• Admin Group: Bypass filtering for troubleshooting

Replace Router DHCP (Optional)

Let Pi-hole handle DHCP to ensure all devices use your DNS server:

1. Disable DHCP on your router
2. Enable DHCP in Pi-hole Settings → DHCP
3. Configure IP range and lease time
4. Set static IP reservations for important devices

Configuration Backup

# Backup Pi-hole configuration
pihole -a -t

# Backup Unbound configuration  
sudo cp /etc/unbound/unbound.conf.d/pi-hole.conf ~/unbound-backup.conf

# Create automated backup script
#!/bin/bash
DATE=$(date +%Y%m%d_%H%M%S)
mkdir -p /home/pi/backups
pihole -a -t /home/pi/backups/pihole-backup-$DATE.tar.gz
cp /etc/unbound/unbound.conf.d/pi-hole.conf /home/pi/backups/unbound-$DATE.conf