homelab

6602 readers

1 users here now

founded 4 years ago

MODERATORS

CMonster@lemmy.ml

Explain Firewall PCs like I'm very inebriated please (lemmy.tf)

submitted 10 months ago by sabreW4K3@lemmy.tf to c/homelab@lemmy.ml

9 comments fedilink hide all child comments

Having got my Raspberry Pi for Christmas, I was finally able to enter the world of home labs and I'm slowly getting everything up and running.

That said, one thing I was super excited about but hasn't come to fruition was Pi-Hole. That's for two reasons, one my Pi isn't hardwired into the router and two my router kinda sucks (Virgin Media Hub 5).

So I came here to ask for recommendations for a router. One that would allow me to run vLANs and use my Pi for adblocking. Honestly the advice I got was like fire and I was like water.

I wanted a simple cheap solution and everyone was like just spend 🥺

Eventually though, my ignorance waned and I started looking into what the suggestions were, which was essentially buy an N100 Firewall Mini PC with 4 Ethernet Port, load up PFSense or OpenWRT, then buy an Access Point, connect it and profit.

So with my dreams of a £50 plug and play experience down the drain, can someone explain to me how it all works? Why is this the suggestion? My Pi is kinda set and leave. My NAS is set and leave, will a firewall PC be the same? Also why a firewall PC over a second Pi?

top 9 comments

sorted by: hot top controversial new old

[–] CosmicApe@kbin.social 14 points 10 months ago

Connect the pi to your router via ethernet, give the pi a static IP, point your router DNS to the IP of the pi. That's pretty much all you need to do aside from actually setting up pi-hole

[–] KairuByte@lemmy.dbzer0.com 11 points 10 months ago (1 children)

Everyone’s giving actual answers, but I have a question: Are you inebriated?

[–] sabreW4K3@lemmy.tf 1 points 10 months ago

Sadly I wasn't at the time.

[–] AlternateRoute@lemmy.ca 7 points 10 months ago* (last edited 10 months ago)

Simple answer would be to attached the pi to the router via the router Ethernet port on the LAN side and learn how DHCP and DNS work.

Pi-hole is primarily a forwarding DNS server that filters DNS requests

[–] pineapplelover@lemm.ee 3 points 10 months ago

Install debian server, open ssh, docker, adguard home (I find this UI easier to use but if you wanna go with pihole go ahead)

[–] Edgarallenpwn@midwest.social 1 points 10 months ago* (last edited 10 months ago)

If you can find a cheap off lease/used enterprise workstation and get a decent nic that could take your budget down for a router . I was running an optiplex 9010 with a i340-T4 as my opnsense box for years and that was ~75 USD in 2020.

Edit: I ended up picking this little box a year ago for 60 bucks and love it. Way less awkward in the living room than a sff PC as a router.

[–] The_Shwa@midwest.social 1 points 10 months ago* (last edited 10 months ago)

I dont know much about your router/ap, but from some light googling the virgin media hub 5 has 2.5gb/s ethernet and wifi 6 which should be fairly decent. I agree with what most comments are saying about connecting the pi using ethernet ("hardwiring" it) and setting a static ip. The raspberry pi image flasher even has an option for that in the advanced settings if I'm not mistaken. If youre worried about not being able to plug a keyboard/mouse and monitor to the pi look at ssh. If you arnt comfortable with command line/terminal I cant say I'd recommend setting up your own router/firewall.

If you dont have any ethernet ports available on your router then looking at a good switch for 2.5 gbps might be a better bet, I always perfer physical connections to wifi.

If you do want to jump down the rabbit hole of pfsense/opnsense/openwrt then hit ebay and look for a cheap workstation and an intel nic, that will get you started messing about with it. Be sure to do research about power consumption of the device youre getting, the raspberry pis sip power but beefier machines will suck some power and might show up on your electricity bill.

I use opnsense, the forums are a good place to look at hardware that you might want to gravitate towards, intel nics have been my best bet but there are plenty of resources to tell you what is compatible and what isnt with openbsd.

[–] its_me_gb@feddit.uk 1 points 10 months ago* (last edited 10 months ago)

The biggest issue you're going to have is that the Virgin hubs don't allow you to change the DNS server that they hand out via DHCP.

By default, Virgin hubs are in 'Router mode', this means that they use DHCP to hand out IP addresses, a default gateway address (the hubs own IP address), and DNS server addresses. Typically the DNS server will be the Hub itself and any request sent to the hub will then be forwarded on to the DNS servers that the hub had defined for forward lookup.

Virgin have decided that they know best and don't allow you to change the DNS servers that they forward your requests to, so you can't modify the router to point to your PiHole.

There are a couple of options here (and forgive me, I'm doing this from memory as I no longer use virgin):

Disable DHCP (IP addresses management) on the Virgin hub and enable it on the PiHole, if possible. You can then configure the PiHole to hand out the IP addresses for the network, including the PiHole address as the DNS servers (and the Virgin hub as the gateway).
Put the Virgin Hub into 'modem mode'. This requires you to buy an additional router that will allow you to change the DNS servers to point to your PiHole. Putting the Virgin hub in modem mode basically disables all Router functionality and tells it to only terminate the network connection of the virgin connection, you then connect you new router to the hub (and only your new router) to perform all of the functions required to handle your network. You'll also need to disable WiFi on the Virgin hub (but I think it may do that automatically in modem mode).

In my opinion, if you can use the method in point 1, that'll be your easiest and cheapest option, if not, you're going to have to get a new router.

When I had Virgin (many, many years ago) I went down route 2, but mainly because I wanted more control over my network than Virgin would allow me than with their shitty virgin hubs.

[–] AbidingOhmsLaw@lemmy.ml 1 points 10 months ago* (last edited 10 months ago)

I run a Unifi USG-1 router/gateway now but before that I got a used AC1000 router from the thrift store for $5 and loaded OpenWRT on that. I eventually got an Aris modem to replace the Comcrap Gateway because it was messing with the DNS traffic, even when piHole was set as DNS for every machine. So if I were you I would go look at the OpenWRT list of units that will accept their firmware. Pay attention to the hardware revision as well as the model number, it matters.

https://openwrt.org/toh/views/toh_fwdownload

Then head over to a local thrift store or two and see if you can find any for cheep.