# Pi-hole: A black hole for Internet advertisements\n# (c) 2017 Pi-hole, LLC (https:\/\/pi-hole.net)\n# Network-wide ad blocking via your own hardware.\n#\n# lighttpd config for Pi-hole\n#\n# This file is copyright under the latest version of the EUPL.\n# Please see LICENSE file for your rights under this license.\n\n###############################################################################\n# FILE AUTOMATICALLY OVERWRITTEN BY PI-HOLE INSTALL\/UPDATE PROCEDURE. #\n# ANY CHANGES MADE TO THIS FILE AFTER INSTALL WILL BE LOST ON THE NEXT UPDATE #\n# #\n# CHANGES SHOULD BE MADE IN A SEPARATE CONFIG FILE: #\n# \/etc\/lighttpd\/external.conf #\n###############################################################################\n\nserver.modules = (\n \"mod_access\",\n \"mod_auth\",\n \"mod_fastcgi\",\n \"mod_accesslog\",\n \"mod_expire\",\n \"mod_compress\",\n \"mod_redirect\",\n \"mod_setenv\",\n \"mod_rewrite\"\n)\n\nserver.document-root = \"\/var\/www\/html\/admin\"\nserver.error-handler-404 = \"\/pihole\/index.php\"\nserver.upload-dirs = ( \"\/var\/cache\/lighttpd\/uploads\" )\nserver.errorlog = \"\/var\/log\/lighttpd\/error.log\"\nserver.pid-file = \"\/var\/run\/lighttpd.pid\"\nserver.username = \"lighttpd\"\nserver.groupname = \"lighttpd\"\nserver.port = 8080\naccesslog.filename = \"\/var\/log\/lighttpd\/access.log\"\naccesslog.format = \"%{%s}t|%V|%r|%s|%b\"\n\n\nindex-file.names = ( \"index.php\", \"index.html\", \"index.lighttpd.html\" )\nurl.access-deny = ( \"~\", \".inc\", \".md\", \".yml\", \".ini\" )\nstatic-file.exclude-extensions = ( \".php\", \".pl\", \".fcgi\" )\n\ncompress.cache-dir = \"\/var\/cache\/lighttpd\/compress\/\"\ncompress.filetype = ( \"application\/javascript\", \"text\/css\", \"text\/html\", \"text\/plain\" )\n\nmimetype.assign = ( \".png\" => \"image\/png\",\n \".jpg\" => \"image\/jpeg\",\n \".jpeg\" => \"image\/jpeg\",\n \".html\" => \"text\/html\",\n \".css\" => \"text\/css; charset=utf-8\",\n \".js\" => \"application\/javascript\",\n \".json\" => \"application\/json\",\n \".txt\" => \"text\/plain\",\n \".svg\" => \"image\/svg+xml\" )\n\n# default listening port for IPv6 falls back to the IPv4 port\n#include_shell \"\/usr\/share\/lighttpd\/use-ipv6.pl \" + server.port\n#include_shell \"\/usr\/share\/lighttpd\/create-mime.assign.pl\"\n#include_shell \"\/usr\/share\/lighttpd\/include-conf-enabled.pl\"\n\nfastcgi.server = ( \".php\" =>\n ( \"localhost\" =>\n (\n \"socket\" => \"\/tmp\/php-fastcgi.socket\",\n \"bin-path\" => \"\/usr\/bin\/php-cgi\"\n )\n )\n )\n\n# If the URL starts with \/admin, it is the Web interface\n$HTTP[\"url\"] =~ \"^\/admin\/\" {\n # Create a response header for debugging using curl -I\n setenv.add-response-header = (\n \"X-Pi-hole\" => \"The Pi-hole Web interface is working!\",\n \"X-Frame-Options\" => \"DENY\"\n )\n\n $HTTP[\"url\"] =~ \".ttf$\" {\n # Allow Block Page access to local fonts\n setenv.add-response-header = ( \"Access-Control-Allow-Origin\" => \"*\" )\n }\n}\n\n# Block . files from being served, such as .git, .github, .gitignore\n$HTTP[\"url\"] =~ \"^\/admin\/\\.(.*)\" {\n url.access-deny = (\"\")\n}\n\n# Add user chosen options held in external file\n# This uses include_shell instead of an include wildcard for compatibility\ninclude_shell \"cat external.conf 2>\/dev\/null\"<\/code><\/pre>\n\n\n\n4). service lighttpd restart<\/p>\n\n\n\n
5). pihole -a -p (Sets a password for the Pi-Hole interface)<\/p>\n\n\n\n
6). dnf install firewalld<\/p>\n\n\n\n
7). systemctl enable firewalld<\/p>\n\n\n\n
8). systemctl start firewalld<\/p>\n\n\n\n
9). firewall-cmd –zone=public –add-port=80\/tcp –permanent
firewall-cmd –zone=public –add-port=443\/tcp –permanent
firewall-cmd –zone=public –add-port=22\/tcp –permanent
firewall-cmd –zone=public –add-port=8080\/tcp –permanent
firewall-cmd –zone=public –add-port=444\/tcp –permanent<\/p>\n\n\n\n
10). firewall-cmd –permanent –add-rich-rule=’rule family=”ipv4″ source address=”My IP” port protocol=”tcp” port=”53″ accept’
\n firewall-cmd –permanent –add-rich-rule=’rule family=”ipv4″ source address=”My IP” port protocol=”tcp” port=”853″ accept’
\nfirewall-cmd –permanent –add-rich-rule=’rule family=”ipv4″ source address=”My IP” port protocol=”udp” port=”53″ accept’<\/p>\n\n\n\n
11). vi \/etc\/firewalld\/zones\/public.xml<\/p>\n\n\n\n
<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<zone>\n <short>Public<\/short>\n <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.<\/description>\n <service name=\"ssh\"\/>\n <service name=\"dhcpv6-client\"\/>\n <service name=\"cockpit\"\/>\n <service name=\"http\"\/>\n <port port=\"80\" protocol=\"tcp\"\/>\n <port port=\"8080\" protocol=\"tcp\"\/>\n <port port=\"22\" protocol=\"tcp\"\/>\n <port port=\"443\" protocol=\"tcp\"\/>\n <port port=\"444\" protocol=\"tcp\"\/>\n <rule family=\"ipv4\">\n<source address=\"67.x.x.x\"\/>\"\n <port port=\"53\" protocol=\"tcp\"\/>\n <accept\/>\n <\/rule>\n <rule family=\"ipv4\">\n<source address=\"67.x.x.x\"\/>\"\n <port port=\"853\" protocol=\"tcp\"\/>\n <accept\/>\n <\/rule>\n <rule family=\"ipv4\">\n<source address=\"67.x.x.x\"\/>\"\n <port port=\"53\" protocol=\"udp\"\/>\n <accept\/>\n <\/rule>\n<\/zone><\/code><\/pre>\n\n\n\nYou will now want to make a note of the lines that begin with “<source address=”. In this example they are lines 15, 20, and 25.<\/p>\n\n\n\n
12). mkdir \/scripts<\/p>\n\n\n\n
13). vi \/scripts\/dns.sh<\/p>\n\n\n\n
myhost=$(dig +short myhome.tplinkdns.com)\n\nstart='<source address=\"'\nend='\"\/>\"'\ncomplete=\"${start}${myhost}${end}\"\n\ncp \/etc\/firewalld\/zones\/public.xml \/etc\/firewalld\/zones\/public2.xml\nsed -i '15d' \/etc\/firewalld\/zones\/public2.xml\nsed -i \"15i $complete\" \/etc\/firewalld\/zones\/public2.xml\n\nsed -i '20d' \/etc\/firewalld\/zones\/public2.xml\nsed -i \"20i $complete\" \/etc\/firewalld\/zones\/public2.xml\n\nsed -i '25d' \/etc\/firewalld\/zones\/public2.xml\nsed -i \"25i $complete\" \/etc\/firewalld\/zones\/public2.xml\n\nrm \/etc\/firewalld\/zones\/public.xml\nmv \/etc\/firewalld\/zones\/public2.xml \/etc\/firewalld\/zones\/public.xml\n\nfirewall-cmd --reload<\/code><\/pre>\n\n\n\nMake sure to replace myhome.tplinkdns.com with the Dynamic DNS domain\/subdomain you have setup on your home router. In this example I am using a router provided by TP-Link.<\/p>\n\n\n\n
Also make sure to replace the 6 lines of sed with the line numbers for your source address. If for example my 1st line was 12 instead of 15 the command would be: sed -i ’12d’ \/etc\/firewalld\/zones\/public2.xml and sed -i “12i $complete” \/etc\/firewalld\/zones\/public2.xml<\/p>\n\n\n\n
14). chmod +x \/scripts\/dns.sh<\/p>\n\n\n\n
15). crontab -e<\/p>\n\n\n\n
*\/5 * * * * \/scripts\/dns.sh<\/code><\/pre>\n\n\n\nThis runs our check script every 5 minutes. If your Home IP were to change this script will update your firewall so that you still have access to the DNS Server.<\/p>\n\n\n\n
16). yum install stunnel<\/p>\n\n\n\n
17). vi \/etc\/stunnel\/dnstls.conf<\/p>\n\n\n\n
[dnstls]\ncert = \/etc\/letsencrypt\/live\/dns.mydomain.com\/fullchain.pem\nkey = \/etc\/letsencrypt\/live\/dns.mydomain.com\/privkey.pem\n\naccept = 853\nconnect = 127.0.0.1:53<\/code><\/pre>\n\n\n\n18). systemctl enable stunnel<\/p>\n\n\n\n
19). stunnel \/etc\/stunnel\/dnstls.conf<\/p>\n\n\n\n
20). chmod +x \/etc\/rc.local<\/p>\n\n\n\n
21). vi \/etc\/rc.local<\/p>\n\n\n\n
#!\/bin\/bash\n# THIS FILE IS ADDED FOR COMPATIBILITY PURPOSES\n#\n# It is highly advisable to create own systemd services or udev rules\n# to run scripts during boot instead of using this file.\n#\n# In contrast to previous versions due to parallel execution during boot\n# this script will NOT be run after all other services.\n#\n# Please note that you must run 'chmod +x \/etc\/rc.d\/rc.local' to ensure\n# that this script will be executed during boot.\n\ntouch \/var\/lock\/subsys\/local\nstunnel \/etc\/stunnel\/dnstls.conf<\/code><\/pre>\n\n\n\n22). vi \/etc\/lighttpd\/external.conf<\/p>\n\n\n\n
$HTTP[\"host\"] == \"dns.mydomain.com\" {\n # Ensure the Pi-hole Block Page knows that this is not a blocked domain\n setenv.add-environment = (\"fqdn\" => \"true\")\n\n # Enable the SSL engine with a LE cert, only for this specific host\n $SERVER[\"socket\"] == \":444\" {\n ssl.engine = \"enable\"\n ssl.pemfile = \"\/etc\/letsencrypt\/live\/dns.mydomain.com\/cert.pem\"\n ssl.privkey = \"\/etc\/letsencrypt\/live\/dns.mydomain.com\/privkey.pem\"\n ssl.ca-file = \"\/etc\/letsencrypt\/live\/dns.mydomain.com\/fullchain.pem\"\n ssl.honor-cipher-order = \"enable\"\n ssl.cipher-list = \"EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH\"\n ssl.use-sslv2 = \"disable\"\n ssl.use-sslv3 = \"disable\"\n }\n\n # Redirect HTTP to HTTPS\n $HTTP[\"scheme\"] == \"http\" {\n $HTTP[\"host\"] =~ \".*\" {\n url.redirect = (\".*\" => \"https:\/\/%0$0\")\n }\n }\n}<\/code><\/pre>\n\n\n\n23). service lighttpd restart<\/p>\n\n\n\n
24). Login to the Cloud Panel and edit your firewall rules to allow the following TCP ports: 22, 53, 80, 443, 444, 853, and 8080 as well as UDP port: 53<\/p>\n\n\n\n
You have now setup and fully protected your PiHole Server.<\/p>\n\n\n\n
You can then set your router or any device on your home connection to use the IP of your server as your DNS Server. <\/p>\n\n\n\n
You can also use any device or OS that supports DoT to use your domain name for additional protection (Ex: dns.mydomain.com). On Android Phones this is called Private DNS but be aware that as you are only allowing it from the Home IP if you were to go to 4G you would lose the connection to the DNS Server. A workaround for this would be to use a App such as “Tasker” to automatically change your DNS Server when connecting to 4G to use a Publicly available option such as 1dot1dot1dot1.cloudflare-dns.com. More details about this can be read HERE<\/a>.<\/p>\n\n\n\nDoT is not currently natively supported by Windows 10 but support may come in the future. In the meantime you can either use normal DNS or look for 3rd-party apps to add support for DoT to Windows.<\/p>\n\n\n\n
Currently we would recommend Stubby on Windows 10:<\/p>\n\n\n\n
![\"\"](\"https:\/\/server-help.org\/wp-content\/uploads\/2020\/05\/scxreen.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/server-help.org\/wp-content\/uploads\/2020\/05\/sc-754x1024.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/server-help.org\/wp-content\/uploads\/2020\/05\/complete-1-1024x310.png\")
<\/figure>\n\n\n\n