You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Creating an ad-blocking VPN using Pi-hole and OpenVPN
4
-
description: Learn how to create a secure, ad-blocking VPN using Pi-hole and OpenVPN on a Scaleway Instance. Follow our step-by-step guide for an effective Pi-hole VPN setup.
3
+
title: Creating an ad-blocking VPN using Pi-hole and OpenVPN/WireGuard
4
+
description: Learn how to create a secure, ad-blocking VPN using Pi-hole and OpenVPN or WireGuard on a Scaleway Instance. Follow our step-by-step guide for an effective Pi-hole VPN setup.
5
5
content:
6
-
h1: Creating an ad-blocking VPN using Pi-hole and OpenVPN
7
-
paragraph: Learn how to create a secure, ad-blocking VPN using Pi-hole and OpenVPN on a Scaleway Instance. Follow our step-by-step guide for an effective Pi-hole VPN setup.
8
-
tags: firewall Pi-hole pihole vpn OpenVPN pivpn
6
+
h1: Creating an ad-blocking VPN using Pi-hole and OpenVPN/WireGuard
7
+
paragraph: Learn how to create a secure, ad-blocking VPN using Pi-hole and OpenVPN or WireGuard on a Scaleway Instance. Follow our step-by-step guide for an effective Pi-hole VPN setup.
Pi-hole® is a DNS sinkhole that protects your devices from unwanted content, such as advertisements, without installing any client-side software. It comes with an easy-to-use interactive installer and can block content in non-browser locations, such as mobile apps and smart TVs. This can help to reduce data consumption on mobile plans.
17
+
Pi-hole is a DNS sinkhole that blocks unwanted ads and trackers at the network level. When combined with a VPN, it provides a secure and ad-free internet browsing experience.
18
18
19
-
To secure the connection, we use the PiVPN tool to install an OpenVPN virtual Private Network that routes all traffic over a Scaleway Instance.
19
+
This guide will show you how to:
20
+
- Deploy a secure ad-blocking VPN using **Pi-hole**
21
+
- Install either OpenVPN or WireGuard using **PiVPN**
22
+
- Implement best security practices to protect your Instance
20
23
21
24
<Macroid="requirements" />
22
25
@@ -26,139 +29,111 @@ To secure the connection, we use the PiVPN tool to install an OpenVPN virtual Pr
26
29
27
30
## Deploying the Instance
28
31
29
-
1. Log in to your Scaleway console and [create a new Instance](https://console.scaleway.com/instance/servers/create). For this tutorial, we use a [PLAY2-NANO](https://console.scaleway.com/instance/servers/create?imageKey=3f1b9623-71ba-4fe3-b994-27fcdaa850ba&offerName=PLAY2-NANO&zone=fr-par-1) Instance running on Ubuntu Focal Fossa (20.04 LTS).
30
-
2. Log into the newly created Instance using [SSH](/instances/how-to/connect-to-instance/).
31
-
3. Update the cache of the APT package manager and upgrade the software already installed on the server:
32
-
```
33
-
apt update && apt upgrade -y
34
-
```
32
+
1. Log in to the [Scaleway console](https://console.scaleway.com) and **create a new Instance**.
33
+
2. Choose **Ubuntu 22.04 LTS** as the operating system.
34
+
3. Once the Instance is created, connect to it via SSH:
35
+
```sh
36
+
ssh root@your_instance_ip
37
+
```
38
+
4. Update and upgrade your system:
39
+
```sh
40
+
apt update && apt upgrade -y
41
+
```
35
42
36
43
## Installing Pi-hole
37
44
38
-
1. Download the [Pi-hole](https://pi-hole.net) installer and run it:
39
-
```
40
-
curl -sSL https://install.pi-hole.net | bash
41
-
```
42
-
The installer does some checks and then gives you a series of prompt questions to answer. Choose OK or answer positively to all of them, until you are asked to choose an upstream DNS provider.
43
-
2. Select one of the proposed upstream DNS servers from the list or specify a custom DNS server. Once selected, use the `TAB` key to move to the OK button and confirm by pressing `ENTER`.
44
-
<Lightboxsrc="scaleway-pihole_01.webp"alt="" />
45
-
3. Pi-hole uses third-party filter lists. Select the list you want to use and confirm by pressing the OK button:
46
-
<Lightboxsrc="scaleway-pihole_02.webp"alt="" />
47
-
4. Choose whether you want to filter both IPv6 and IPv4 traffic and confirm by pressing the OK button.
48
-
5. Confirm the network settings by navigating to the YES button. You will be guided through two more network prompts. Confirm them by pressing the OK button.
49
-
6. Choose whether you want to enter the Pi-hole web interface and confirm by pressing the OK button:
50
-
<Lightboxsrc="scaleway-pihole_03.webp"alt="" />
51
-
7. The Pi-hole installer proposes the automatic installation of a web server and its dependencies. If you are not using another web server, select to install it and confirm by pressing the OK button:
52
-
<Lightboxsrc="scaleway-pihole_04.webp"alt="" />
53
-
8. Choose whether you want to log queries and confirm by pressing the OK button:
54
-
<Lightboxsrc="scaleway-pihole_05.webp"alt="" />
55
-
9. Select a privacy mode for FTL and confirm by pressing the OK button:
56
-
<Lightboxsrc="scaleway-pihole_06.webp"alt="" />
57
-
58
-
The Pi-hole installer proceeds with the automatic installation of the required software. Once the installation is complete, the URL to the admin interface and your password are displayed in a prompt. Take note of the password and leave the prompt by pressing the OK button.
59
-
10. Set the listener of the Pi-hole web interface to `local` to avoid it being accessible from the public Internet:
60
-
```
61
-
pihole -a -i local
62
-
```
63
-
11. Optionally, you can customize the password of your Pi-hole's web interface by running the following command:
64
-
```
65
-
pihole -a -p
66
-
```
67
-
68
-
## Installing PiVPN
69
-
70
-
To direct internet traffic via our Pi-hole Instance, we install OpenVPN using the [PiVPN](https://pivpn.io/) project. It provides a very easy way to install OpenVPN and Wireguard on the Instance. In this tutorial, we are using OpenVPN.
71
-
72
-
1. Create a new non-root user for OpenVPN:
73
-
```
74
-
adduser openvpn
75
-
```
76
-
2. Run the following command from an SSH shell on your Instance to download and launch the PiVPN installer:
77
-
```
78
-
curl -L https://install.pivpn.io | bash
79
-
```
80
-
3. A series of prompts displays. Validate them by pressing the OK button until you are asked under which user the OpenVPN application should run. Select the previously created `openvpn` user and validate by pressing the OK button:
81
-
<Lightboxsrc="scaleway-pihole_07.webp"alt="" />
82
-
4. Choose the OpenVPN protocol in the prompt and validate by pressing the OK button:
83
-
<Lightboxsrc="scaleway-pihole_08.webp"alt="" />
84
-
5. PiVPN provides a default configuration, accept it by pressing **Yes**:
85
-
<Lightboxsrc="scaleway-pihole_09.webp"alt="" />
86
-
6. Keep the value for the UDP transport protocol unless you have specific requirements and validate by pressing the OK button:
87
-
<Lightboxsrc="scaleway-pihole_10.webp"alt="" />
88
-
7. You can leave the default OpenVPN port `1194` unless your network configuration requires another port. Confirm by pressing the OK button:
89
-
<Lightboxsrc="scaleway-pihole_11.webp"alt="" />
90
-
8. The PiVPN installer automatically detects the presence of Pi-hole and asks to use it. Validate the prompt by confirming with the **Yes** button:
91
-
<Lightboxsrc="scaleway-pihole_12.webp"alt="" />
92
-
9. The Pi-hole installer asks you if you want to use a custom search domain. Keep the default value and press the **No** button unless you have specific requirements:
93
-
<Lightboxsrc="scaleway-pihole_13.webp"alt="" />
94
-
10. The following prompt asks you if you want to use the Instance's IP address or a custom domain name to connect to your VPN. Keep the default setting, using the public IP address of your Instance and validate by pressing the OK button.
95
-
11. During the installation, PiVPN prompts you if you want to use Elliptic Curves to provide higher connection speed and improved security over RSA. Confirm by pressing the **Yes** button. If you are using some devices using legacy OpenVPN clients that do not support this feature, select **No**.
96
-
<Lightboxsrc="scaleway-pihole_14.webp"alt="" />
97
-
12. Select the desired key size for the certificate. In this tutorial, we use the recommended size of 256 bits. Confirm by pressing the OK button:
98
-
<Lightboxsrc="scaleway-pihole_15.webp"alt="" />
99
-
13. The following prompt informs you that the server key and HMAC key are now being generated. Confirm by pressing the OK button.
100
-
14. The installer now prompts you to enable unattended upgrades, which allow you to update the software on your server automatically to make sure it is using the latest version of the software available in the repository. Validate by pressing the **Yes** button.
101
-
<Lightboxsrc="scaleway-pihole_16.webp"alt="" />
102
-
15. The installation of PiVPN is now complete. You can reboot your Instance as suggested by the installer by pressing the Yes button.
- Select an upstream DNS provider (Google, Cloudflare, Quad9, etc.)
53
+
- Choose **IPv4 + IPv6 filtering**
54
+
- Install the **Pi-hole Web Interface**
55
+
- Set a **strong password** using:
56
+
```sh
57
+
pihole -a -p
58
+
```
59
+
3. Configure Pi-hole for local access only:
60
+
```sh
61
+
pihole -a -i local
62
+
```
63
+
64
+
### Optimizing Pi-hole
65
+
To enhance privacy, you can set up **Unbound**, a local recursive DNS resolver:
66
+
```sh
67
+
apt install unbound -y
68
+
```
69
+
Then, edit Pi-hole settings to use `127.0.0.1#5335` as your custom upstream DNS.
70
+
71
+
## Installing PiVPN (OpenVPN or WireGuard)
72
+
PiVPN allows us to configure a VPN server with either **OpenVPN** or **WireGuard**.
73
+
74
+
Run the following commands to install PiVPN on your Instance.
75
+
```sh
76
+
wget -O pivpn-install.sh https://install.pivpn.io
77
+
chmod +x pivpn-install.sh
78
+
./pivpn-install.sh
79
+
```
80
+
81
+
During installation, you will be prompted to choose:
82
+
- OpenVPN (wider compatibility with older devices, but slower)
83
+
- WireGuard (faster, modern encryption, recommended)
84
+
85
+
Follow the setup prompts and select:
86
+
- A non-root user (`openvpn` or `wireguard`)
87
+
- Default settings for encryption and networking
88
+
- Custom port (e.g., `4343` or `23854` instead of the default 1194 to increase security)
89
+
90
+
## Enhancing security
91
+
92
+
### Firewall configuration
93
+
Restrict access to only necessary services:
94
+
```sh
95
+
ufw allow 22/tcp
96
+
ufw allow 53/udp
97
+
ufw allow 4343/tcp # If using OpenVPN on port 4343
98
+
ufw allow 23854/udp # If using WireGuard
99
+
ufw enable
100
+
```
101
+
102
+
### Change OpenVPN default port
103
+
Edit OpenVPN’s configuration file:
104
+
```sh
105
+
nano /etc/openvpn/server.conf
106
+
```
107
+
Change `port 1194` to `port 4343` (or another port of your choice), then restart OpenVPN:
108
+
```sh
109
+
systemctl restart openvpn
110
+
```
111
+
112
+
### Enable Fail2Ban
113
+
Prevent brute-force attacks by installing Fail2Ban:
114
+
```sh
115
+
apt install fail2ban -y
116
+
systemctl enable fail2ban --now
117
+
```
103
118
104
119
## Adding VPN users
105
-
106
-
You can now add users to your filtered VPN service. It is recommended to create a user profile for each device you want to connect to the VPN. Sharing profiles between devices is not recommended for security reasons.
107
-
108
-
1. Run the `pivpn add` command to launch the interactive user creation wizard.
109
-
2. Enter each parameter of the user and validate by pressing the Enter key on your keyboard:
110
-
```
111
-
Enter a Name for the Client: client <- the identifier of your user
112
-
How many days should the certificate last? 1080 <- the validity of the user's certificate. You can leave the default value
113
-
Enter the password for the client: <- a secret password for your user (Note: the password is not shown when you type for security reasons)
114
-
Enter
115
-
116
-
the password again to verify: <- enter the password again to confirm it
117
-
```
118
-
119
-
The certificate and user profile is now generated and once it is ready, the following message displays:
3. Download the generated `*.ovpn` configuration file on your device and import it into your OpenVPN client.
131
-
4. Connect to your VPN to use your secure and filtered internet connection.
132
-
5. Open the following URL in your web browser to connect to the Pi-hole web interface: `http://10.8.0.1/admin/`. The web interface allows you to further configure Pi-hole and view statistics about your DNS requests:
133
-
<Lightboxsrc="scaleway-pihole_17.webp"alt="" />
134
-
135
-
## Blocking unwanted traffic
136
-
137
-
To avoid keeping an open DNS resolver on the Internet, we restrict the requests from outside our infrastructure. This is very important, as unprotected DNS servers can be abused and participate in [DNS Amplification attacks](https://en.wikipedia.org/wiki/Denial-of-service_attack#Amplification).
138
-
139
-
1. From your Scaleway console, click **Instances** in the **Compute** section of the side menu.
140
-
2. Click the **Security groups** tab. A list of your existing security groups displays.
141
-
3. Click **Create a security group** to go to the security group creation page:
142
-
<Lightboxsrc="scaleway-create_sg.webp"alt="" />
143
-
4. Enter the details for your new security group:
144
-
-**Security group name:** a friendly name for your security group, (e.g. `block-remote-dns`)
145
-
-**Description:** An optional description for your security group
146
-
-**Available Zone:** Choose the geographic region in which your security group will be deployed. The region must match the region of your Instance.
147
-
-**Rules:** Configure rules in your security group to block incoming traffic on Port 53 (DNS) to block external requests to your Pi-hole Instance:
148
-
1 . Click **Add inbound rule**
149
-
2 . Select the rule `Drop`, the Protocol `TCP`, untick the box `All Ports`, and enter the Port number `53`.
150
-
3 . Click **Add inbound rule**
151
-
4 . Select the rule `Drop`, the Protocol `UDP`, untick the box `All Ports`, and enter the Port number `53`.
152
-
153
-
Your configuration should look like the following example:
154
-
155
-
<Lightboxsrc="scaleway-sg_rules.webp"alt="" />
156
-
157
-
- Click **Add an Instance** and select your Pi-hole Instance from the drop-down list.
158
-
- Click **Create a new security group** to launch the creation of the security group.
159
-
160
-
Your Instance is now protected against requests to the DNS server running on it from external hosts. For more information about security groups, refer to our [dedicated documentation](/tutorials/installation-uncomplicated-firewall/).
120
+
For OpenVPN:
121
+
```sh
122
+
pivpn add
123
+
```
124
+
For WireGuard:
125
+
```sh
126
+
pivpn wg add
127
+
```
128
+
Download the VPN configuration file securely using SCP or SFTP.
129
+
130
+
## Testing your VPN
131
+
- Connect your device using an OpenVPN or WireGuard client.
132
+
- Verify that your IP has changed by visiting [whatismyip.com](https://www.whatismyip.com/)
133
+
- Check if ads are blocked
161
134
162
135
## Conclusion
136
+
You now have a secure, ad-blocking VPN setup using Pi-hole and OpenVPN/WireGuard. This setup ensures privacy, security, and a better browsing experience across all your devices.
137
+
138
+
For further optimizations, consider adding a DNS-over-HTTPS setup or custom blocklists for Pi-hole.
163
139
164
-
You now have configured a secure and filtered OpenVPN connection to the internet. Pi-hole automatically filters unwanted advertising and helps to save bandwidth on metered plans. The web interface allows you to view detailed statistics about the DNS requests made, and you can white or blacklist additional entries.
Copy file name to clipboardExpand all lines: tutorials/traefik-v2-cert-manager/index.mdx
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,7 +12,7 @@ categories:
12
12
- domains-and-dns
13
13
- load-balancer
14
14
dates:
15
-
validation: 2024-07-31
15
+
validation: 2025-01-30
16
16
posted: 2020-07-01
17
17
---
18
18
Traefik (pronounced traffic) is a modern HTTP reverse proxy and Load Balancer designed to make the deployment of microservices easy. Traefik integrates with any HTTP and TCP-based applications and every major cluster technology.
0 commit comments