A lot of my stuff is ad-hoc from my personal exploration and experience on Linux.
In regards to the wireguard specific stuff, this isn't a bad guide.
https://mikkel.hoegh.org/2019/11/01/home-vpn-server-wireguar...
The harder part with the VPN stuff is the following.
1) Setting up a clear route of forwarding traffic to the pihole. To do so, you would need to setup netplan/systemd-networkd so your pi gets a static private IP. (Not that easy if you are doing a full ipv6 route too.)
2) Setup a DDNS mechanism (as you most likely are getting a dynamic IP). My suggestion for this was to get a domain name (8 quid a year) and use cloudflare as a DDNS host. You also need to punch a UDP port through your router to forward to your pi.
3) Then setup the rest of the wireguard stuff.
4) Setup the pihole and ensure all interfaces are covered so your VPN has a DNS server.
Part 2 is the hardest bit as I kind of needed some custom scripting to ensure cloudflare had working routes to my networks. e.g. https://gist.github.com/Kedstar99/2d8ab0e9bec3a5629562b4ab01...
The above script obviously running as a systemd service that restarts automatically.
Obviously you can use something else like noip or some other DDNS solution.
https://www.freedesktop.org/software/systemd/man/systemd.net...
Then choose your firewall of choice to setup NAT and forwarding. I used firewalld, but not sure I'd recommend it. It's just the first solution I got working.
Once you have the base OS ready to go, it will take you less than 30 minutes if you know how to muck with your DHCP/firewall settings in your router.
https://github.com/pi-hole/pi-hole/#one-step-automated-insta...
Install Pi-Hole, then edit your DHCP server to hand out the Pi-Hole as the DNS server.
After installing Pi-hole, install this. Choose Wireguard, not OpenVPN. port-forward the Wireguard UDP port to your VPN server. use the "pivpn" command to create client configs and the "qr" subcommand to scan the config into your phone.
The community around WG has gotten much easier for noobs to get into, and the porcelain around the tool itself has made it quite easy to use, IMO.
By specifying the namespace in a systemd service file, I can let a service use a specific VPN.
Pihole pretty much installs itself (it even has a pre-made image). WireGuard will take reading, testing and failing.
I recommend doing these things one thing at a time, and doing the Pihole first.
If you're using PiHole, you can just use cloudflared to do DoH. https://docs.pi-hole.net/guides/dns/cloudflared/
On a different note, biggest reason I've never installed a VPN at home is because I just prefer a deny-everything home network and worry I'll misconfigure something and cause a security issue.
It also picks from 140 or so anonymous DoH relays, with specifics for nologs and dnscrypt support.
Why would I go for just 1 arbitrary provider rather than the lowest latency choice out of 140?
I also think the latter point is a bit overblown. So long as you keep your kernel updated and you only expose a single high UDP port, it should all be fine. I have ufw enabled on each pi, along with various logging mechanisms in place to see if things seem reasonable. That and 2fa for actual ssh access.
Because a ISP that can compromise any one of those 140 different single points of failure can now make that one have the lowest latency and give you malicious DNS results just like you never secured anything.
This is the same problem as allowing 140 different CAs to issue certificates for subdomains of com, rather than forcing the fucking registry to do it when you get a domain name in the first place.
>minisign_key is a public key, used to verify that the content is legitimate. Lists can thus be served from any location, even from an untrusted ISP: dnscrypt-proxy will immediately detect and reject something that has been tampered with.
>https://dnscrypt.info/stamps-specifications/ >https://dnscrypt.info/faq
An ISP will not be able to spoof the sources or these stamps. They wouldn't put the effort in. Even if they did, it is factored and thought about.
More harmful would be a malicious DoH relay but I trust the devs.That I think is fixed by mandating the use of DNSSec too for my relays.
OTOH, I'm beginning to migrate to pfsense and pfblockerng at home. So, it is possible that I may retire my pi-hole at some point. Currently I'm running both as I transition and test.
The added benefit is that I can force all devices to use PiHole while connected to Tailscale and have DNS-adblocking on the go!
I find it super useful!
Even if just for remoting into various boxes; the kids for instance often tether their PCs off their phones or I'm tethered and want to remote to my LAN.
(I have terrible internet)
I run pihole with 256MB version(which is $1 less) for two years fanlessly, and this includes enclosure too, load the software and hook it to my wireless router's ethernet port and just forgot about it.
What I've heard is a crashing Pi is usually due to sagging voltage on an inadequate power supply, and that's probably even more an issue on the more demanding/powerful Pi4. On my cameras I just use the wall warts adafruit sells for the Pi, and haven't had any power problems.
As far as the SD card goes you can boot off an external hard drive or SSD via USB and that should guarantee longevity.
My biggest problem with headless Pis was that they would randomly disconnect from the wifi network and disappear, turning off power saving on wifi didn't solve it. In the end the real solution ended up being to just create a 2.4ghz-only network and connect them to that. Somehow they just don't play well with networks that have the same SSID for 2.4 and 5ghz on my Ubiquiti gear.
This is anecdata from my part, but I’ve got eight or 10 Pis running (Flightaware/ADSBexchange, PiHole/Influx/Grafana/Wireguard, a couple of Octoprint, Home Assistant - with a relay HAT for triggering dampers, Showmewebcam, and a handful of other things). Once I switched to good power supplies and good SDHC cards, my problems went away. My most heavily loaded machine is the PiHole machine which also has influx running and writing to the SDHC card - it’s probably a ticking time bomb, but it’ll celebrate it’s fourth birthday on the same card in two months.
My Pi 4 running 2 instances of Octoprint kept crashing until I switched to their official power supply. On previous models I always got away with whatever power supply I had around but the 4 doesn't play around when it comes to power consumption.
Pihole -> Great use for a network wide adblocker/DHCP server.
Wireguard VPN -> In combination with a DDNS setup and some port forwarding enables the use of a global private VPN. I think it's a prerequisite for a decent home-automation setup.
DNSCryptProxy -> Great for ensuring all DNS requests on the network via DNS over HTTPS. Kind of useful because frankly ISPs are sniffing DNS traffic. Also useful for bypassing DNS based ISP filters.
The above basically enabled me to create a 5 country wide private VPN by giving VPNs to family members. It enables me to print/scan things from abroad, access CPU resources/servers/GPUs/Webcams/automation and obviously browse as if I am in another place.
My family when they are abroad, can now work as if they aren't.
It also saves power (reducing analytics traffic), improves privacy and takes about a weekend to setup.
They also make great personal gifts too.