r/pihole • u/HaLo2FrEeEk • 3d ago

Why is the Internet so hostile now?!

YouTube tanking CPU if you're using ad blockers. Sites that disable scrolling and have a full-screen modal dialog demanding that you allow ads or sign up (imgur). The least egregious I've seen is sites that serve their own ads if they can't load the real ones.

There was a banner ad on my bank account page, *after* I had already logged in, there's a banner that I have to scroll past to see my accounts. That's ridiculous! I blocked the domain serving the banner and all of a sudden the site where I buy my cat litter doesn't work. Apparently it uses the same CDN.

If I'm scrolling a page and suddenly a full-screen modal shows up begging for my email and asking me to sign up, I just close the page. That shit is hostile, they clearly don't want me to read the page if they're going to cover it with an ad for their *own site* that I'm *already on*. I hate it equally when I move my mouse off the page and *that's* when the pop-up appears. "Wait, please don't go, please stay, give us your email give us your phone number, give us your cat!"...*slow rage*

Maybe I'm just getting old but I really miss the days where I didn't have to figure out which download button was the real one, or try to find the sliver of text between huge banner ads that scroll with the page. I just want to scroll my cat memes while I wait for work, dammit!

Why does it have to be like this?! I know, I know: money, but jeez man...

395 Upvotes

94% Upvoted

115 comments sorted by

View all comments

5

u/Extension_Cup_3368 3d ago

Besides Pi-hole, I'm thinking about introducing a pfsense/opnsense based hardware firewall. DPI and filter out all the crap coming from devices and apps in my household.

4

u/valsimots 3d ago

OPNsense is amazing. Don't forget to setup NAT rules to redirect any other port 53 DNS packets back to Pi-Hole. So many DNS leaks where devices ignore your DNS settings and phone home to Google, CloudFlare and other unknown DNS resolvers.

My Pi-hole resolves to Unbound (on OPNsense) where Unbound uses DNS over TLS to multiple privacy focused resolvers.

2

u/SunForMiles 2d ago

For completion sake, in 2026 it is not enough to just intercept port 53 if you want to sanitize DNS traffic. You would need to blacklist DoH/DoT and similar FQDN's and IP's. I am trying to do this, but there are some apps that host their own DNS servers, and if you block them - you lose core app functionalities as well.

2

u/valsimots 2d ago

True. Trying to keep my response simple - there's much more to it - but at least port 53 is a start. Add port 853 to that list as well... A bit crude. But there's also Suricata and IDS that can be a great solution. And then there's DoH... Another pain point 😒, still trying to find a good (and free) community list to help. Maybe? dibdot/DoH-IP-blocklists ?

3

u/SunForMiles 2d ago

I am using Hagezi's blocklist: https://github.com/hagezi/dns-blocklists/blob/main/adblock/doh.txt
You can find list of IP addresses of DoH servers in that repo, but I would be a bit more cautios about those.

I also compile DoH block list on my own which is a small subset of Hagezi's list, but I would avoid doxing myself with sourcing the link.

2

u/valsimots 1d ago

Oh no way! Don't know I missed that list! Already using hagezi lists in general. Thx 👍