DietPi-Software | blocky - alternative to pihole and adguardhome

[Joulinar]

could blocky be considered as an alternative to pihole and adguardhome?
https://github.com/0xERR0R/blocky

Originally posted by @hecatae in #4889 (comment)

[Dynamic5912]

Technitium would be better

[hecatae]

Technitium is interesting, but better at what?

[hecatae]

Blocky only does one thing: It resolves (and optionally logs) DNS queries.
There’s no database, there’s no web UI and no DHCP.
You can optionally add a database to Blocky for query logging, which is useful if you need to debug your blocklists or just for getting some more statistics than you can get from the built-in Prometheus metrics endpoint.
Configuration details are over here, https://0xerr0r.github.io/blocky/latest/configuration/

[JappeHallunken]

I just replaced pihole with blocky, I do not need querry logging (only for debugging, but then I can just enable it) and I also do not need statistics. I also do not need a webUI, I'm fine with the config via yaml file. 😁
But if you need some statistics you can activate the Prometheus export and use grafana for visualization.

Right now my DNS feels snappier as with Pihole, but this is just my subjective feeling, I did not run any benchmarks to measure this.
But it's pretty lightweight, under 40M of RAM and CPU time stays at 0 in htop 👍

[JappeHallunken]

If anyone is interested, I use the binary and run it as a systemd service with it's own user. My upstream DNS is unbound, which listens on port 5335.
root@RPi4:~# systemctl cat blocky

# /etc/systemd/system/blocky.service
[Unit]
Description=Blocky DNS proxy
Documentation=https://0xerr0r.github.io/blocky/

Wants=network-online.target
After=network-online.target

StartLimitBurst=5
StartLimitIntervalSec=60s

[Service]
Type=simple

User=blocky
Group=blocky

ExecStart=/usr/local/bin/blocky --config /etc/blocky/config.yml

Restart=on-failure
RestartSec=5s
TimeoutStopSec=30s

# Allow binding to privileged DNS port 53 without root
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE

NoNewPrivileges=yes

# Sandboxing
PrivateTmp=yes
PrivateDevices=yes

ProtectSystem=strict
ProtectHome=yes

ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes

ProtectClock=yes
ProtectHostname=yes

ProtectProc=invisible
ProcSubset=pid

RestrictSUIDSGID=yes
RestrictRealtime=yes
RestrictNamespaces=yes

LockPersonality=yes
SystemCallArchitectures=native

UMask=0077

[Install]
WantedBy=multi-user.target

AmbientCapabilities=CAP_NET_BIND_SERVICE is needed because it binds to a port lower 1024.

here the config file in use:

root@RPi4:~# cat /etc/blocky/config.yml
upstreams:
  groups:
    default:
      - 127.0.0.1:5335

customDNS:
  customTTL: 1h
  filterUnmappedTypes: true
  mapping:
   example.org: 192.168.178.56
    rpi4: 192.168.178.56

conditional:
  mapping:
    fritz.box: 192.168.178.1

blocking:
  denylists:
    ads:
      - https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
      - https://raw.githubusercontent.com/PolishFiltersTeam/KADhosts/master/KADhosts.txt
      - https://raw.githubusercontent.com/FadeMind/hosts.extras/master/add.Spam/hosts
      - https://v.firebog.net/hosts/static/w3kbl.txt
      - https://gist.githubusercontent.com/leviem1/94ee89e816b4d63298a2fb5c9f822bc3/raw/3f3eb67e5cd7845fd0ac57b674a1f2e793012457/fangxiao-domains-pihole-blocklist-11-2022
      - https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/pro.txt

  clientGroupsBlock:
    default:
      - ads

ports:
  dns: 53

log:
  level: info
  format: text

queryLog:
  type: none

I also route my own domain (redacted in the config file as example.org) to my LAN IP, so when I'm inside my LAN I do not need query through the internet to reach my server, which also runs on the RPi.