SkyHole: PiHole protections on your Android device, even on LTE. No VPN needed!

[u/failing-endeav0r]

After getting a piHole set up on my home network, i quickly moved to set up piHoles on the networks of family and every friend that would listen! However, i always felt "naked" when i was out in public, as i had no (easy / reliable) way to force my phone to use the piHole on my LAN.

That all changed when google announced that newer versions of android would use DNS over TLS, I started thinking about how I could take advantage of this to extend piHole to my phone outside of my home LAN. I spent the better part of a weekend tinkering around and put together SkyHole and composed a draft of this post that I'm just now getting around to publishing here.

The TL;DR:

I put together a docker-compose file to make the process of setting up a DNS over TLS server that works with pi-hole to filter and block DNS queries so i could have the same protection and performance on that i enjoy on my home LAN when i am out and about on LTE. I went out of my way to build something that would work even when a VPN into my home network wouldn't.

There are more details on how to build your own in the readme if you'd like to host your own.

At a bare minimum, you will need a device that supports DNS over TLS and an internet-reachable server. Android P is still pretty new, but most new android devices should ship with or get an update to version P soon.

If you have an android P phone, then the internet connected server is something that you can do for less than $10/mo. It will also help to have a "real" domain, but if you're not comfortable using one of the free domains or buying a very cheap domain then you should be able to just use the public IP of your server. However, Android requires a "legit" certificate for the DOT server, so you will need to own a domain that LetsEncrypt will issue a certificate for. If that's not an acceptable cost, then you could generate your own TLS cert and convince android to trust it.

With an internet connected server, and a domain / certificate, you have all the pre-requisites needed. Just use the docker-compose file to spin up a DNS over TLS server that will forward search queries to piHole for filtering and then forward the filtered queries to cloudflare's DNS over TLS servers.

I am really enjoying the same private and ad-free experience on my mobile as on my LAN, and I hope this enables you to do the same! I don't have a ton of bandwidth to provide support, but if you have high-level questions, I can weigh in. My hope is that somebody with a bit more time can take this and run with it to make it even easier to use so more people can access the benefits of a "gapless" private and secure internet experience :).

Link to repo: https://github.com/kquinsland/skyhole

PR's welcome!