Pihole was my first venture into privacy, and it was years ago. Of course I did not realize that is what it was at the time, I thought it was just ad blocking. I still have a google account for youtube, and I hate that I am using it but that is where the creaters are. I currently do not have anything strong enough to do the whole YouTube without the google thing yet, I hope to be getting a new to me Mac mini that I will install Debian on next week where I will try invedious but right now I have a pi 5 running librewolf with adguard and sponser block. Do not get me wrong it hurts me knowing I am taking money away from creators doing this but it makes me feel better knowing that the Google is not selling me.

I have my own domain that hosts emails I have a wildcard email address so I can give out random emails to people so that I could stop using Apple’s hide my email as I was slowly moving away from Apple already. When Trump got in for his second term and the boycott the US movement started I started self hosting a lot of services.

I in no way meant to implement everything at once, it has taken me years to get where I am. The pihole was just my gateway drug into doing stuff.

I personally prefer the security of my LAN, it has a Flint 2 running vanilla OpenWRT with lots of vLANs. As much as I believe do not trust your ISP to have your back I have 2 static IP addresses, one was going to host my email and the other would be my internet stuff. I than use wireguard to VPN into my LAN when I am out and about. I have not come across a VPN blocked website, but I have a very finally tuned pihole setup.

I am also not out and about much that I actually see any site that may have a VPN blocking site, but again my pihole is very finally tuned, some times I see the please turn off your ad blocker popup so I find the article published elsewhere, or if it is arstechnica (I think) I still have 98 years or something like that until I can read an article from them.

I also self host a lot of things so it is not like I am worried to much. I read up on my cities transit app and found out how horrible it actually is so I built my own (sorta) it tells me what buses I need to take to get places and it tells me where every operational bus is in the city. I realize it is vibe coded so it needs work, work I will be giving it when I get a new phone as I get out of the Apple Garden.

So does my pihole. You should never trust your ISPs firewall/modem/router, never ever. You should have a hardware firewall/router and than you can set up a VPN into your LAN.

I realize this is Russia spicific but Canada is moving that same way. I luckily am slowly climbing out of the Apple walled garden, my next phone is going to be a pixel so I can install GeapheneOS and use F-Droid as the store, or whatever it is called, so that I can keep my wireguard setup.

Well you see when you are the product, things can be less expensive. When it is something you need to compete with the wealthy they will keep you down!

I will hopefully be adding a new to me computer next week, my lab is put together with a bunch of things it would nice to try this out.

Thanks but this girl has nice new flooring and a new hobby/way of life! I would disagree with you on passwordless log in, do it where ever you can but use ssh-keys and change ports away from 22.

I really do not like using ports in the 8080 range either but I think that is because of my 22 issue.

I do not entirely understand how the sshole works either, but yes I believe it does have something to do with some old thing where the attacker would just have to put in some stupid long password and some ssh protocol would let it in. Most of my homelab uses openssh, I do not believe this had that issue I have keys with password auth turned off so you need my keys to get in, OpenWRT uses DropBear and that did not have the issue.

From what I understand the sshole was a big nothing burger.

I had breifly heard that the CEO was pro-Trump when Trump was re-elected, so I had cancelled then and than searched out Canadian hosts that do not look through my mail. I was first with HostHero, because I could move my blog onto there servers they however charge an arm and a leg for unlimited emails with no wildcard option. I got tired of their angry support people when I was having issues so I went looking for a better solution and found easyDNS, who now hosts my domain, a VPS, and an email with a wildcard option.

I am a dumb ass with a BA in the social sciences not computer science, but I was able to get a vanilla OpenWRT installed on a Flint 2 firewall. Sure I did a lot of reading, youtubing, and got a little AI help. The Flint 2 comes with OpenWRT installed on it but everything I read suggested putting a clean install.

I had a slow start to home labbing I started with one pihole than moved to two, than I thought about getting a VPN running but that did not really work I believe I even tried using duckDNS for that but than I did the dumbest thing anyone can do I opened port 22 in my firewall so that I could SSH in. When my internet mystiralisly stopped working correctly I called up my ISP and wow did I ever learn that opening port 22 was a bad idea for how I had it set up at the time. So that stopped me exploring homelabbing for a while, sure after I had new pi installs set up it was never project after project but I never used port 22 again (until recently now that I have crowdsec running) and never used passwordless login. But earlier this year my place flooded and I was out of my home more frequently so I needed to find a way that I could access my pihole and smb (I had given up on using nextcloud at that point but I think I am coming back around to it), so came the Flint 2. With OpenWRT the 3 or 4 projects turned into an infinite number of possibilities.

ISP routers are also a security issue, when that PHP thing happened I had to go through all my stuff and find what was vulnerable and either update it or replace it, luckily nothing on my firewall was affected. When sshole was the big scare I went and looked everything up on it to make sure I was not in trouble, I wasn’t I use keys with password authentication turned off, but that got me thinking I should see if there are any updates for my firewall. Turns out there were a few, I had never thought of updating a firewall before because the only times my ISP firewall would have been updated is when I broke something and the IT people would just decide to do their thing and break all of my configs, there may have been updates with that.