“Wi-Fi Pineapple” is a silly name for a real threat to your cybersecurity. These devices trick you into connecting to fake Wi-Fi networks to intercept data and compromise your privacy. Here’s how to protect against Pineapples and Wi-Fi attacks.

What Is a Wi-Fi Pineapple?

A Wi-Fi Pineapple is a device ostensibly sold for Wi-Fi security auditing, that can also be used to perform real attacks on your devices.

It’s not literally a pineapple (though I’m sure some enterprising hacker out there has at least attempted to house a Raspberry Pi in an actual pineapple fruit), but named because early devices resembled pineapples, with antennas sticking out at all angles much like pineapple leaves.

“Wi-Fi Pineapple” referred to a specific commercial device that automates man-in-the-middle attacks, but these attacks can also be performed with readily available off-the-shelf hardware, including laptops and single board computers.

How Do Wi-Fi Attacks Work?

There are two main types of attacks that use Wi-Fi networks: “evil twin” attacks impersonate known Wi-Fi networks, and trick your device into connecting to them, intercepting data and potentially giving remote access to your device. “Rogue AP (access point)” attacks advertise open networks in the hope that naive or internet-desperate users will connect, with the same outcomes.

Malicious Wi-Fi hotspots are set up in coffee shops, airports, and hotels in an attempt to get you to connect without any technical trickery. Often, simply naming the network something legitimate-sounding (like the name of the hotel) is enough to fool people into thinking it’s the real deal.

For individuals, the primary threat of joining a malicious Wi-Fi network is the interception and recording of the data that is transmitted: emails, social network logins, and other sensitive information (including what websites you visit) can be recorded, and even if encrypted, there’s still the possibility that they can be exploited. Devices with improperly configured firewalls may also be remotely accessed via a compromised network, putting all the data on your device at risk.

For businesses, there is an additional threat: Wi-Fi Pineapples and other malicious devices can be inserted into networks (either using an unguarded Ethernet socket, or by capturing legitimate Wi-Fi credentials and cracking them), granting the attacker unfettered access to internal company infrastructure.

How To Protect Yourself From Pineapples

The best way to protect yourself from a pineapple is to stay out of its way. Avoid public Wi-Fi if you can by tethering to your mobile phone to get online. If you do have to use public Wi-Fi, use a reputable VPN and set it up so that all internet traffic must go through it (known as a “kill switch” in some VPN interfaces). Travel routers are also great for this, allowing you to tether multiple devices or put multiple devices behind a VPN.

While an actual Wi-Fi Pineapple device may be difficult to detect, there are additional measures you can take to protect yourself from fake hotspots and man-in-the-middle attacks in general. Before you connect to a network, check for duplicates or suspicious network names, and avoid scanning QR codes to connect unless they’re in a position they’re unlikely to have been tampered with. You can also disable auto-connect for public networks you’ve joined previously so that you don’t mistakenly reconnect to an impostor.

At home, make sure you change the default Wi-Fi network and administrator passwords and set up a guest network for visitors to use. A separate IoT network for your “smart” devices can also prevent them becoming a vector for network intruders. If you notice similar network names appearing in your neighborhood, consider changing the name of your own network so you don’t accidentally connect to someone else’s.

Generally, you should always heed SSL certificate warnings and unexpected redirects that may indicate your connection has been compromised. Never log into a website or app if you see one of these warnings. If you’re on public Wi-Fi, disconnect, and if you’re at home, start taking steps to diagnose and fix the issue(or call your local tech support). If a website login screen looks different to what you’re used to, you should also be suspicious that your traffic may be being re-routed to a fake site intended to steal your details.

How Businesses Can Prevent Pineapple Attacks

If you run a business that provides Wi-Fi to staff or the public, it’s your responsibility to keep it secure. Give your IT team the time and resources they need to deploy, secure, and maintain infrastructure properly, or risk it falling out of date and being vulnerable to new attacks.

Your network should be regularly scanned for unauthorized devices and rogue Wi-Fi networks that may have been set up to trap employees or customers. If something suspicious is found, hunt down the rogue device (it might be hiding in a dusty corner under a couch in a café, for example) and remove it. Use enterprise-grade Wi-Fi hardware like Unifi that provides client isolation, management tools, and additional security features to make sure your network is under your control.

Tips for Staying Safe in a Dangerous Digital World

Antivirus and personal firewalls also play a key part in staying safe when connecting to public networks. If your device is compromised, they can help detect and block malicious software and activity so that you can secure your accounts and get your device fixed.

There’s also a laundry list of security tips and best practices you should follow to help prevent yourself becoming a victim of cybercrime. Following security advice can be inconvenient (especially when you really need to get online and you’re out of phone reception), but it’s worth it in the long run. source

WIFI Pineapple : DIY WIFI Pineapple Setup Guide

I was just poking around for new projects and stumbled upon something cool. I’ve always had my eye on the Hak5 Wi-Fi Pineapple to build up my red teaming toolkit, but I needed to stick to a budget. The Hak5 Wifi Pineapple is a powerful and versatile wireless penetration testing. It allows users to create rogue Wi-Fi networks, enabling them to intercept and analyze network traffic for security testing purposes. It could perform Evil Portal, MITM, DNS poisoning and many wireless attacks using web interface.

After some initial research, I found that the Wifi Pineapple runs on OpenWrt. Also, I found this GitHub project by Xchwarze which talks about cloning the Wifi Pineapple.

Here’s the outline of this project:

• Install OpenWrt firmware.
• Install the Pineapple firmware upgrade file.
• Set up Wifi Pineapple.

You’ll need the following essentials for this project:

1. Any compatible router with OpenWRT (I’ll be using Tp-Link Archer C7).
2. A USB drive for installing modules.
3. OpenWrt 19.07.7.
4. Wi-Fi Pineapple firmware.

With these in hand, we’re ready to proceed with the setup process! So, let’s jump right into it!

Install OpenWrt firmware:

Download the OpenWrt firmware 19.07.7 using this link. Then, navigate to your default router login page and upgrade the firmware by simply uploading the OpenWrt router firmware file.

It will take a few minutes for the router to reboot. Do not restart or power off your router during this process, as it may brick your device. Once it’s flashed with OpenWrt, it’s time to upgrade to the Pineapple firmware.

Install the Pineapple firmware upgrade file:

First, we need to download the Pineapple firmware upgrade file. Choose the appropriate router and download the firmware file from the Github repo. For my setup, I will be using the Archer C7 v4 universal file.

Connect your device using an Ethernet port and open 192.168.1.1 in your browser. Navigate to the System tab and click on the Flash Image option. Choose the Flash Image and upload the Pineapple firmware sysupgrade file you recently downloaded. Uncheck the “Keep settings and retain the current configuration” box, then click continue. Again, this process should take a couple of minutes. Just a reminder: do not restart or power off your router during this time to avoid any interruptions in the firmware upgrade.

Setup Wifi Pineapple:

Once the router restarts, connect it to the internet and browse to 172.16.42.1:1471 to setup your WIFI Pineapple. Congratulations, enjoy your newly configured Wifi Pineapple!”

Now that the Wifi Pineapple is set up, let’s proceed with installing modules to make it fully functional.

Plug the USB drive into the router and format it using the provided tool under Advanced > USB & Storage > Format SD Card. This step ensures your USB drive is ready to install the necessary modules for your Wifi Pineapple.

Simply click the Get Modules button and then click Install for the modules you would like to use. Be sure to install dependencies for each module once they are installed.

Conclusion

This is just a proof of concept to show that we can build a Wifi Pineapple on a budget, achieving similar functionality as the official one. Of course, I’d still suggest buying the Hak5 WIFI Pineapple to support the creators. I had a blast experimenting with my homemade version.

I’m thinking of getting a compatible router like Gl.iNet, which is pocket-sized and can be powered by a power bank. This could come in handy, especially when traveling with a gigantic router is a hassle. Big thanks to Xchwarze for sharing this project with the community. source

Hardware Differences: None

	Nano	AR150
CPU	Atheros9331, 400MHz SoC	Atheros9331, 400MHz SoC
Memory	DDR2 64MB	DDR2 64MB
Storage	Flash 16MB	Flash 16MB
Wireless 1	Atheros AR9331 (IEEE 802.11 b/g/n)	Atheros AR9331 (IEEE 802.11 b/g/n)
Wireless 2	Atheros AR9271 (IEEE 802.11 b/g/n)	RT5370 USB WiFi Adapter (IEEE 802.11 b/g/n)
Price	$100	$35

 

Materials Needed

Basic (Total $35):

 

• AR150 – $26 (https://www.amazon.com/dp/B01FJ4S9JK)
• RT5370 Wifi adapter – $6 (https://www.ebay.com/itm/282647848601)
• Flash Drive (1gb and up)
• USB 2.0 Hub (NOT 3.0)
• Power adapter or external battery (CURRENT)

 

Advanced Materials:

 

• USB Hub – $4 (https://www.ebay.com/itm/173995917456)
• Soldering Iron with fine “I” tip (https://www.amazon.com/dp/B07GTGGLXN)
• Helping Hand (https://www.amazon.com/dp/B000P42O3C)
• 3D Printed Case Extension
  • Print: https://github.com/LinuxOperator/AR150-Case-Extension
  • Buy:

 

 

Flash Pineapple Firmware

Step 1:

Download the WiFi Pineapple firmware that was modified for the AR150: gl-ar150-nano-<version>-optimized.bin

Step 2:

Power on AR150 and connect a computer to the device’s LAN by one of the following:

• Connect an Ethernet cable to your computer from the “LAN” port
• Connect to its WiFi network “GL-AR150-xxx” using the password “goodlife”

Step 3:

Navigate to http://192.168.1.1 in a web browser and perform initial setup:

• Set Password (Note: this password will only be used once)

Step 4:

• From the admin panel click on “More Settings” then click “Advanced”

Step 5:

• Login with username “root” and your password created in step #2

Step 6:

• Click on “System” then on “Backup / Flash Firmware”

Step 7:

• Flash the optimized .bin file:
  • Under “Flash new firmware image” uncheck “Keep settings”
  • Choose File and select the .bin you downloaded in step 1
  • Click “Flash image”

Step 8:

• Click “Proceed”

Step 9:

• Wait about 5min for the flash to complete.
• Join the new network:
  • The device will now have a different Wifi SSID and IP address range.
  • Follow the guide bellow to connect to the pineapple over Wifi or LAN…

Step 10:

If on WiFi

• Search for a network with “pineapple” in the name, connect to it
• Change your computer’s IP address to “172.16.42.42”
• Navigate to https://172.16.42.1:1471 in your web browser
• When you see the prompt for “Secure Setup”, proceed by holding the reset button for ~5 seconds

If on Ethernet LAN

• Change your computer’s IP address to “172.16.42.42”
• Navigate to https://172.16.42.1:1471 in your web browser
• When you see the prompt for “Secure Setup”, proceed by quickly pressing the reset button (don’t hold it)

Step 11:

• Pineapple Configuration:
  • Root Password
  • Time Zone
  • other

 

Hardware Modifications

 

Step 1:

• Remove the back cover

---

Step 2:

• Dissasemble the USB Hub (A screwdriver and some prying should do the trick, don’t damage the female usb ports)

---

Step 3:

• Note the order of the wires, the wires should go in this order onto the AR150 board

---

Step 4:

• Solder the wires with a fine soldering tip (“I” is recommended)

---

Step 5:

• 3D print the case extender using the following settings (or Buy: )
• Plastic: PLA or PETG (ABS may shrink and cause model to not fit)
• Layer Height:
• Density: %

---

Step 6:

• Insert the USB hub and hot glue it in place for added support

---

Step 7:

• Snap the pieces together making sure it is correctly aligned source

HOW TO USE YOUR WIFI PINEAPPLE

if you need a full sevice PCB manufacturer go here PCBWay

GitHub/ wifi-pineapple-cloner

by xchwarze

learn how to defend yourself below 

What is a Wi-Fi Pineapple? How to Protect Yourself From Pineapple Attacks

WiFi Pineapple Definition & Pineapple Router Uses

A WiFi Pineapple is a small piece of equipment with a silly name and a lot of power. Some people use this tool for a legitimate security purpose. Others use it for hacking.

Whether you work in security or are concerned about the safety of your own data, it pays to know what a Pineapple router is. Chances are, you’ll encounter it at least once during your lifetime.

What Is a WiFi Pineapple?

The size and shape of this device give the WiFi Pineapple its name. It’s a small, black device with several spikes. Developers thought it looked a bit like tropical fruit, so they named it accordingly.

The WiFi Pineapple was developed by Hak5, a private company. For about $100opens in a new tab, you can purchase one for yourself or your company. And you’re not required to disclose what you’d like to use it for.

Hak5 is known for creating testing tools. When the WiFi Pineapple was released in 2008opens in a new tab, most people assumed testers would find it useful and everyone else would ignore it. The reality is a bit different.

How a WiFi Pineapple Works

< Open a WiFi channel on your computer, and the device will make a connection to an available router. A WiFi Pineapple is positioned between the device and the router, and with the proper programming, it can inspect all the data as it moves from one location to another.

Setting up a WiFi Pineapple isn’t always easy. Bloggers who detail their work create posts that take up dozens of screensopens in a new tab. But when the work is done, you’ll be able to look over all the traffic moving to and from a device and a WiFi router.

The device makes use of the underlying technology in any WiFi system. When you connect to a WiFi, your device remembers the service set identifier (SSI) of that router. When you’re in the same location, your device seeks out a router with the right SSI.

A WiFi Pineapple imitates the proper SSI, and that means anyone preprogrammed to connect will link with the Pineapple router instead.

Legitimate Uses of a Pineapple Router

Computer security experts must understand how their systems work, where they are breaking, and why they might be vulnerable to an attack. A Pineapple WiFi router makes that work much easier.

During a penetration test (or pentest), experts attempt to hack a system, and they document their work for fixes and corrections. Typically, a pentest requires specialized software and operating systemsopens in a new tab. But a WiFi Pineapple makes it really easy.

A security analyst might set up a Pineapple WiFi and then:

• Look for hookups. Do people from your company attach to it automatically rather than using your authorized WiFi?
• Watch for disclosures. During a man-in-the-middle attack, a hacker watches all the data that passes between a device and a server. A WiFi Pineapple mimics this approach. How much would an attacker see?
• Seek out access. Can a hacker who sets up a man-in-the-middle attack gain further access to your system?
• Watch for alarms. Do your automated systems catch the intruder? How long does it take?

WiFi Pineapple softwareopens in a new tab makes monitoring easy. You’ll get email alerts throughout the simulated attack, and you can even tag interesting devices and follow them after they’ve been tapped by the program.

Someone using a WiFi Pineapple emerges with a significant amount of data about how the system works and what should be fixed.

Hackers Use Pineapple WiFi Too

Just as security experts can launch man-in-the-middle attacks, so can hackers. The technology works in the same way.

A hacker might take over the SSI of a well-known WiFi router, such as one located inside of a college campus. An attack might look like this:

• Select victims. Anyone who has attached to the server before is a target.
• Set up the attack. Using the WiFi Pineapple, the hacker spoofs the SSI of the intended server.
• Connect. A student comes within range of the spoofed router and connects.
• Attack. The hacker can now see everything that moves from the device to the server and back.

A quick search brings up plenty of step-by-step instructionsopens in a new tab hackers can follow to craft code. All they need are willing victims.

Unfortunately, many people are willing to connect with WiFi resources that seem free and readily available. They may push past security warnings and decline commonsense steps so they can hop online and complete their tasks.

A hacker even launched an attack like this at a conference for hackersopens in a new tab, proving that it’s almost irresistible for some people.

But some devices now come with sophisticated warning systems, and some don’t allow connections with devices that don’t seem secure or legitimate. Some hackers believe the WiFi Pineapple heyday is overopens in a new tab, as taking control is more difficult now than it once was.

But if a hacker can execute an attack like this, they can gain access to critical information, such as these:

• Social Security numbers
• Photographs
• Bank account numbers
• Passwords

Protecting Against Wireless Pineapple Attacks

Hackers are clever, and they use all sorts of tips and tricks to gain access into assets they have no business touching.

Commonsense protection steps involve:

• Avoiding public WiFi. Don’t connect to any device you don’t own. Rely on your cell service instead.
• Turning off WiFi when you leave your house. Don’t allow your device to scan for SSIDs as you move from location to location. Snap off the functionality when you’re on the go.
• Leaning on a VPN. Virtual private networksopens in a new tab (or VPNs) encrypt your data as it moves through the internet. Even if you’re connected via a WiFi Pineapple, your data will be protected.

We can help too. Contact us to learn how Okta can help keep your data and users safe from network attacks and vulnerabilities.  source

in case the youtube videos are deleted here they are

How to Install Node-Red to Home Assistant – Using Node-Red for Complex Home Automations

Node-RED is a flow-based, low-code development tool for visual programming, originally developed by IBM for wiring together hardware devices, APIs and online services as part of the Internet of things. Node-RED provides a web browser-based flow editor, which can be used to create JavaScript functions.

This guide will show you how to install Node-Red to Home Assistant and take you through a basic flow.

Node-Red is a low-code development tool for building simple to complex automation flows. The software runs within a web browser and works great within Home Assistant. The software is relatively easy to learn and allows easy viewing of complex logic flows.

Using Node-Red gives you an excellent visual overview of automation flows, making it much easier to understand, edit, and create. You can build flows that control automatic gates, lights, water pumps, and more.

If you haven’t already, we reco

This tutorial will explain how to install Node-Red to Home Assistant. We also go through the basics of setting up an automation flow. Both of these topics give you a decent insight into how you can get the most out of the software.

Installing Node-Red

Node-RED: Low-code programming for event-driven applications

The installation of Node Red is very straightforward, but there are a few requirements for a smooth installation process.

To install Node-Red within Home Assistant, you must run a version that supports add-ons such as supervised or the operating system. Alternatively, you can set up Node-Red as a separate docker and connect it to Home Assistant.

1. Within the Home Assistant web interface, click on the settings tab and then click on add-ons.

2. Click on add-store in the bottom right corner of the screen.

3. Using the search box, search for Node Red. Alternatively, you can scroll through the page until you find the Node-Red add-on.

4. The page you should now see will contain all the details about the add-on. You can check through all the details if you want to know what you are about to install. Once you are ready to install, click Install.

5. Now, navigate to the configuration tab. In this tab, locate the credential_secret field and enter a strong password. Make sure you save this password, as you may need it in the future. I use 1Password for storing passwords, but other software such as Bitwarden or Nordpass (Affiliate Link) would also be solid choices.

You will also need to disable SSL if it is not enabled on your Home Assistant installation. To disable SSL, click the SSL button so it is greyed out. If you leave it on and Home Assistant does not support SSL, Node-Red will fail to start.

Once you are done, click on save.

6. After you have saved the credential secret and disabled SSL, return to the info tab. On this page, click on “Start“. Node-Red should start without issue. If it is not starting, navigate to the log tab and look through the logs for errors.

7. If you click on Node-Red in the sidebar or “Open Web UI” on the add-on page, it will take you to the Node-Red application. You can now start writing your flows to automate your Home Assistant setup.

Creating your First Node-Red Flow

Node-Red can be a little daunting at first, but once you understand the basics, it is a powerful tool that allows you to handle complex and simple automations.

In this short tutorial, we will go through the basics of creating a flow that uses a Home Assistant node.

The following steps will take you through how to send a notification whenever the temperature of our weather station exceeds 15°C.

1. The first node we will use is the “Events: State” node. Drag this node onto the grid

Next, double-click on the node to open the options available. Fill in each of the relevant properties. Below is what I filled in.

• Name: Check Temperature
• Server: Home Assistant
• Entity: Outdoor Temperature
• If State: >= 15 (Greater or equal to 15)
• For: 1 Minute
• State type: Number

I also do not have any checkboxes ticked for “Ignore State Change Event When“.

2. Next, drag and drop a debug node. These nodes will output data that can help diagnose and fix issues with your flows.

On each node, there are dots. These dots represent different functions. For example, our Check Temperature node has two dots. One is for when our logic is false, and the other for when it is true.

We click and drag our true node and connect it to the debug node.

The flow will run when you click deploy in the top right-hand corner.

In this example, if the temperature exceeds 15°C, the debug node will output after 1 minute. If it is not higher than 15°C, nothing will output.

3. Next, we will want to notify our users that the temperature is too high. To do this, drag a “Call Service” node onto the grid. Connect the true output to the input on the “Call Service” Node.

Now, double-click on the call service node to edit it. Fill in each of the relevant properties. Below is what I filled in.

• Name: Enter the name that you want the node to be referred to.
• Server: You shouldn’t need to update this as it should be Home Assistant.
• Domain: You will need to set this to notify.
• Service: Choose a device that you wish to notify. Choosing the notify option will notify all possible users.
• Data: This is where you need to specify the notification details. At the bottom of the properties is an example. Clicking “Load Example Data” will pre-populate the data field, which you can easily edit.

Below is an example of my entry into the data field.

{
   "message":"Temperature is too High!",
   "title":"The temperature is higher than 15°C."	
}Copy

4. To avoid too many notifications, you may want to place a delay node. This node will allow a single notification to be sent for a specified time. To do this, drag and drop a delay node in between our check temperature and notify gus nodes.

Double-click on the delay node and update the settings to the following.

• Action: Rate Limit and All Messages.
• Rate: 1 msg(s) per 15 minutes.
• Change Queue Intermediate Messages to Drop Intermediate Messages
• Name: Rate Limit

These properties will allow a single message every fifteen minutes. Any messages that try to be sent in the meantime will be dropped.

5. You should now have a basic flow that will notify users whenever the temperature goes above 15°C for over a minute. Feel free to change and alter this flow for other purposes.

You can remove the debug node if you are finished debugging. Alternatively, you can click the green square next to the node to deactivate it.

Conclusion

I hope you now have Node-Red installed and configured on your Home Assistant installation. Our basic flow introduced some basics of using the software to run automations. Once you understand the basics, you can create some cool automations using the data from some of the sensors and devices in your home.

We are constantly working on more Home Assistant tutorials, so if there is anything that you would like to see, please let us know. I recommend checking out some of the other tutorials for great ideas on what you can do with this amazing software.

If you encounter any problems or have any suggestions, please do not hesitate to leave a comment down below. source

Node-RED, the visual programming tool for Internet of Things

 

From the beginning of programming, one of the industry’s main challenges has been to facilitate the applications development to simplify the integration between the hardware devices, the software and us, the humans. Thanks to Node-RED we are much closer of this goal. Programming, without programming.

What is Node-RED and what is it for?

Node-RED is an open-source development tool based on visual programming that was created by IBM to connect hardware devices, APIs and online services.

Node-RED is a solid tool, easy to learn, and it does not require any programming knowledge. It has been consolidated as one of the main applications for real-time data management and transformation for IoT and Industry 4.0 solutions.

Node-RED allows to graphically connect predefined blocks, called nodes, to develop a concrete task. The nodes connection, usually a combination of input nodes, processing nodes and output nodes, when wired together, make up a flow.

Among all the available nodes we can find standard protocols as MQTT, REST, Modbus, OPC-UA, Bacnet, Websocket; and third party API integrations as Microsoft Azure, Amazon Web Services, Twitter, Facebook and many more.

 

 

Where can I install Node-RED?

Node-RED is built on Node.js, taking full advantage of its power and assuring scalability, liability and low hardware requirements. These features allow to run Node-RED in personal computers, cloud servers and low-cost embedded hardware.

If you want to take your first steps in Node-RED you just need to click here to access to all the documentation. Follow step by step how to install the tool on your computer, your cloud services regular provider or your embedded device eManager.

 

Nodes library

The nature of the tool, being open source, and the facility to develop new nodes, come together into a nodes library which grows each day with new community contributions.

Nowadays we can find more than 2500 available nodes in the Node-RED official library, including Smart Home integrations, converters between IoT protocols, geolocation functions, OAuth2 authentication and many more.

 

Hello world in Node-RED

To conclude this article there is no better way than taking your first steps on Node-RED generating the classic Hello world. Below, we show step by step the process to achieve it:

Message creation with Inject node

1. If you are running Node-RED on your computer, you can access http://127.0.0.1:1880 or whatever address or hostname you’re using
2. If it is our first time in Node-RED, we will see a flow named Flow 1
3. On the node palette on the left side of the Node-RED, we will select the Inject node and will drag it onto our flow
4. In order to edit the node we will double click on it. After that, we will select string on the Payload field and we will write Hello world!
5. Once we finish the previous steps, we click Done

Printing our message

1. In order to add a destination for our message we will select the Debug node. We will click and drag it onto our flow. It’s very important to place it on the right-hand side of the Inject node
2. To connect both nodes we just need to click the Inject node’s output and drag it to the Debug node’s input. A wire that links both nodes will be created
3. Debug node will automatically print the message to the console window as we will see in the next step

Deployment

1. In order to start our application you must click on Deploy button
2. Now click the Debug tab in the right-hand side of the editor window
3. Finally, to launch our message you will click on the blue button coming out from the left-hand side of the Inject node
4. “Hello world” will appear on the Debug screen. Welcome to Node-RED!

 

As PickData, we firmly believe in solutions like Node-RED, because those allow you to focus on what really matters, bring our added value to the solutions and skip losing time between ins and outs of the usual programming. source

 

Node-RED has replaced my complex Home Assistant automations, and it does them so much better

The self-hosting ecosystem is rife with cool and quirky apps designed to automate every facet of your life. There’s the holy Terraform and Ansible combo for home lab enthusiasts who love watching VMs come to life without pressing a single button, while n8n can handle all software-based automations. On the smart home side, you’ll often find Home Assistant as the most recommended utility for creating schematics to control your IoT gadgets. And well, HASS can serve you well with its trigger-action workflows.

For YAML experts, you can even design long scripts to automate your smart home. But once you get into complicated workflows involving multiple sensors, actuators, and if-else statements, HASS starts to become rather unintuitive. While I still rely on Home Assistant for quick automations, Node-RED is my preferred platform for creating extended automation workflows spanning several smart devices in my living space.

There’s nothing you can’t pull off with Home Assistant blueprints

It pairs well with my Home Assistant devices

But HASS isn’t the only data server for my Node-RED instance

I consider Home Assistant the centerpiece of my rat’s nest of an apartment and have mapped most smart devices, IoT gadgets, and even home lab equipment (via HACS integrations) to my HASS hub. As such, it acts as a data-gathering terminal in addition to its role as a control center.

Since my Node-RED instance is connected to my HASS server, it can directly grab statistics from my devices and push any message payloads I define in my custom workflows. I use a standalone Node-RED container instead of running it on top of Home Assistant, so I don’t have to rely on just HASS for my smart home automation.

On that subject, I’ve already connected my Node-RED server to a Raspberry Pi-based MQTT broker, so I can automate MQTT communication with just these services. Heck, it even integrates with external APIs and webhooks, making it perfect for the times when I want to use the VMs and containers from my Proxmox server for my home automation projects.

Amazing for automation chains

The node-based workflow makes everything easier

Upon first glance, a Node-RED canvas filled to the brim with node chains, functions, and variables can seem intimidating. However, the ability to represent every device as a node makes it easy to organize everything, and I can import multiple IoT products inside a single workflow.

On Home Assistant, I’d have to cycle between the Entities, Helpers, Scripts, and Events tabs every time I want to create a multi-device automation chain. Besides the added advantage of accessing my smart devices from a single page, Node-RED lets me reuse the function nodes as many times as I want, which is a godsend for projects requiring complex if-else logic with branching instructions.

No more YAML shenanigans

Although YAML syntax is nowhere near as complex as a mainstream programming language’s coding rules, it’s a pain to design complicated workflows with it. Home Assistant makes YAML scripting somewhat easy with the Developer Tools tab, but it’s far from the most intuitive option, especially since I can just use Node-RED.

That’s because Node-RED has a minimal coding approach, as even the most complicated automation can be arranged in a node-based workflow. This visual aspect makes it easier to add nested logic, chains of loops, and long branches in a Node-RED canvas. As if that’s not enough, I can install custom modules and libraries for most communication protocols and external APIs in Node-RED.

Solid troubleshooting provisions

Finally, Node-RED makes finding errors in my workflow a cinch. It’s a lot easier to detect errors in a Node-RED-based flow than a huge YAML file, where I can have several indentation errors because of accidentally pressing the Spacebar or Enter keys. In contrast, my mistakes are infinitely easier to catch on Node-RED’s canvas, as I can see how the different gadgets affect each other.

That said, HASS is better for simple automation projects

So far, I’ve only discussed why Node-RED suits my smart home projects. But I’d be biased if I didn’t talk about its drawbacks. Despite providing easier methods for automating complex projects, Node-RED has a steeper learning curve than Home Assistant. Plus, community-created blueprints are a neat utility in Home Assistant for casual users who want to quick put together motion-controlled lights.

However, if you’re looking to build something as convoluted as a surveillance system that automatically turns on the lights and sets the right thermostat temperature when it detects your presence, it’s a good idea to go with Node-RED as your automation platform. source

Home Assistant with Node-Red

/root/config/custom_components/nodered/__init__.py
/root/config/custom_components/nodered/__pycache__
/root/config/custom_components/nodered/binary_sensor.py
/root/config/custom_components/nodered/config_flow.py
/root/config/custom_components/nodered/const.py
/root/config/custom_components/nodered/discovery.py
/root/config/custom_components/nodered/manifest.json
/root/config/custom_components/nodered/save.txt
/root/config/custom_components/nodered/sensor.py
/root/config/custom_components/nodered/services.yaml
/root/config/custom_components/nodered/switch.py
/root/config/custom_components/nodered/websocket.py

/root/config/custom_components/nodered/.translations/en.json

Access ANY Network (remotely) What is a Hacker Dropbox?

What is a Hacker Dropbox? (and why you need one….even if you aren’t a hacker)

Build your Hacker Dropbox with Twingate (it’s free): https://ntck.co/twingate_ztna
Raspberry Pi Imager: https://www.raspberrypi.com/software/
Buy a Raspberry Pi: Raspberry Pi 4: amazon.com
Raspberry Pi 5: amazon.com

• Here is a great definition from ChatGPT: a small, discreet, and often portable device designed to be covertly placed in a target network to provide remote access for a hacker or penetration tester. It typically contains hardware and software configured to exploit the network or collect sensitive information.
• If you’re a hacker…this is a no brainer. Get instant access to a remote network by dropping off a device. But….if you’re not a hacker…why do you need this?

Family HelpDesk Support

• If you’re like me, you are likely the official technical support for your family and friends. I also inherited the role of helpdesk support for my church…these kinds of things just happen by default when you are in tech and people find out about your technical skills.
• This isn’t an easy thing to do, especially when it comes to troubleshooting networks for your family. Is the network up? Why is it slow? Sometimes a FaceTime call just isn’t going to cut it.
• If I’m going to be the support for my church and family, I’m going to take my role seriously. I need FULL control of the remote network……no more playing around!!!
• With the Hacker Dropbox, I can drop off a small device, in my case it’s going to be a Raspberry Pi 4. (it can be a lot of things, as long as the device is Linux-based and is 64-bit). Instantly I get access to this remote network, enabling me to provide remote support and access any device.

This is NOT VPN

• This is not a VPN (VIrtual Private Network) solution….it’s much better.
• This is a ZTNA (Zero-Trust Network Access) solution. It’s called Twingate and I’ve been using them for a long time in my business and personal networks. I talk more about them in the video above but in short, they allow you to get and give remote access to networks in the most secure way. They are used by everyone from large enterprises to homelabbers looking to access their Plex server.
• This isn’t the first video I’ve made about them but this is the first time I’ve featured a use-case like this.
• Oh, it’s also FREE for home labbers. (And…cough….businesses that don’t have a ton of employees….like me.)

You don’t need to know ANYTHING about the network

• I wanted this to be a turnkey solution even if you don’t know anything about the remote network. All you’ll have to do is plug in an ethernet cable (or connect to wifi….but you’ll need to know the SSID and password) and you will know everything you need to know about that network…..but how?
• Twingate has a powerful API that allows us to do many things…including write python scripts that will automagically tell us the private IP address of our Hacker Dropbox (Raspberry Pi) and the Public IP address of the network, giving us instant access to this Hacker Dropbox AND the network.
• This guide will contain that script.

What do you need?

• Any Linux-based 64-bit system will do. You’ll need at least 1 CPU and 2GB RAM (recommended)…but you can go as low as 512MB of RAM.
• You can also run this as a Docker container, which is my favorite way to deploy this in my home lab.
• In this example, with the Hacker Dropbox, I’m using a Raspberry Pi 4 running Raspberry Pi OS Lite – 64-bit and installing it directly on the system (no docker container)

What other hardware options do I have?

Again, this can be many things, but here are some ideas to get the juices flowing:

• ZImaboard
• Raspberry Pi 4/5
• Raspberry Pi 400/500
• Old laptops
• NAS
• Intel NUC or other mini-pcs

The Tutorial

Step 1 – Setup Twingate

This setup is VERY easy and is all done in the cloud.

• Sign up for Twingate here: https://ntck.co/twingate_ztna
  • You’ll create a new Twingate network

!

Step 2 – Add your first remote network

You will be prompted to go through a wizard, we can skip that for now.

• Click on Remote Networks

!

• And then add a Remote Network

!

• Choose on-premise for location

!

• Once created, we’ll click on the remote network link to jump in and add more config…like adding a connector.

!

Step 2.5 – Prep your Hacker Dropbox

• This will vary based on what device you choose but this will normally involve installing a compatible OS (64-bit Linux OS) and getting access to your device via CLI.
• I demo flashing an SD-card for the Raspberry Pi 4 in the video.

Step 3 – Adding a connector for your remote network

The connector, in our case, will be the Hacker Dropbox, a linux-based device running Twingate software, aka, The Connector

• Click on Deploy Connector

!

• Good practice, run sudo apt update to make sure all your repos are up-to-date (this will different for you if you are running something that isn’t Debian-based)
• For the Raspberry Pi example, we are installing the Twingate connector directly on the OS, no container. So we’ll select Linux as our option.

!

• Now, generate your access tokens. These will automatically be added the command we’ll use to install Twingate here in a moment.

!

• Copy the provided command

!

• Paste that command in your terminal and watch the magic happen.

!

!

• We are actually….done. Check Twingate to see if your connector is up.

!

Step 4 – Add a remote WiFi Network (if not using ethernet)

• This will be Raspberry Pi specific.
• Run this command to access the NetworkManager TUI

sudo nmtui

• Edit a connection

!

• Select Add

!

• Select WiFi

!

• Add SSID and Password (you’ll need to know this for the remote network)

!

• Select Ok and then hit ESC to save and get out of there.

Step 5 – Use the Twingate API to learn about the remote network

You only need this option if this is a network you are unfamiliar with. So, for example, you might be offering remote support for your family and you will likely already know their network, 192.168.1.0/24 (for example) and you may have set the static IP address of your Hacker Dropbox and can easily, manually add this as a resource in Twingate.

• Generate an API token

!

• Our script will be provisioning resources so we’ll need to give it a good amount of access.

!

• Copy that key and put it somewhere safe.

!

Run the Python Script

• You’ll need another computer, can be anything that can run Python. (which…can be anything, Windows, Mac, Linux.)
• You’ll also need Python3 installed, refer to your OS-specific documentation to install Python.

Create the script

• Create a new python script

nano twingate.py

• paste the following script
• Replace the following variables:
  • API_URL
  • API_KEY
  • TARGET_NETWORK_NAME

from gql import gql, Client
from gql.transport.requests import RequestsHTTPTransport

# Twingate API settings
API_URL = "https://****your Twingate network here****.twingate.com/api/graphql/"  # Replace <subdomain> with your Twingate subdomain
API_KEY = "YOUR TWINGATE API KEY"
TARGET_NETWORK_NAME = "YOUR REMOTE NETWORK"  # Replace with your target network name

QUERY_REMOTE_NETWORKS = gql("""
query GetRemoteNetworkDetails {
  remoteNetworks(after: null, first: 10) {
    edges {
      node {
        id
        name
        connectors {
          edges {
            node {
              id
              name
              publicIP
              privateIPs
              remoteNetwork {
                id
                name
              }
            }
          }
        }
      }
    }
  }
}
""")

MUTATION_CREATE_RESOURCE = gql("""
mutation CreateResource($name: String!, $address: String!, $remoteNetworkId: ID!) {
  resourceCreate(
    name: $name,
    address: $address,
    remoteNetworkId: $remoteNetworkId
  ) {
    ok
    error
    entity {
      id
      name
      address {
        type
        value
      }
    }
  }
}
""")

def setup_client():
    transport = RequestsHTTPTransport(
        url=API_URL,
        headers={"X-API-KEY": API_KEY},
        use_json=True,
    )
    return Client(transport=transport, fetch_schema_from_transport=True)

def get_target_network(client):
    response = client.execute(QUERY_REMOTE_NETWORKS)
    for edge in response["remoteNetworks"]["edges"]:
        network = edge["node"]
        if network["name"] == TARGET_NETWORK_NAME:
            return network
    return None

def create_resource(client, name, address_value, remote_network_id):
    params = {
        "name": name,
        "address": address_value,
        "remoteNetworkId": remote_network_id
    }
    response = client.execute(MUTATION_CREATE_RESOURCE, variable_values=params)
    if not response["resourceCreate"]["ok"]:
        raise Exception(f"Failed to create resource: {response['resourceCreate']['error']}")
    return response["resourceCreate"]["entity"]

def automate_resource_creation():
    client = setup_client()

    print(f"Searching for target network: {TARGET_NETWORK_NAME}...")
    target_network = get_target_network(client)

    if not target_network:
        print(f"Network '{TARGET_NETWORK_NAME}' not found.")
        return

    print(f"Found network: {target_network['name']}")
    remote_network_id = target_network['id']

    for connector_edge in target_network["connectors"]["edges"]:
        connector = connector_edge["node"]
        public_ip = connector.get("publicIP")
        private_ips = connector.get("privateIPs", [])

        if public_ip:
            resource_name = f"Resource-Public-{public_ip.replace('.', '-')}"
            print(f"Creating Resource for public IP: {public_ip}...")
            resource = create_resource(client, resource_name, public_ip, remote_network_id)
            print(f"Resource created: {resource['name']} (ID: {resource['id']}, Address: {resource['address']['value']})")

        for private_ip in private_ips:
            resource_name = f"Resource-Private-{private_ip.replace('.', '-')}"
            print(f"Creating Resource for private IP: {private_ip}...")
            resource = create_resource(client, resource_name, private_ip, remote_network_id)
            print(f"Resource created: {resource['name']} (ID: {resource['id']}, Address: {resource['address']['value']})")

if __name__ == "__main__":
    try:
        automate_resource_creation()
    except Exception as e:
        print(f"Error: {e}")

• Save the file.

Now, we’ll create a python virtual environment

• This will make sure we can install packages and prerequisites without hurting your other projects. (if you have some….if you don’t…that’s okay….it’s just good practice)
• First make sure you have it installed. See below for Linux.

sudo apt install python3-venv -y

• Also make sure you install PIP

sudo apt install python3-pip

• Now create a Python virtual environment and activate it.

python3 -m venv twingatesomething

source twingatesomething/bin/activate

• Install the pre-reqs

pip install gql requests requests.toolbelt

• Type to run the script

python3 twingate.py

• Check your resources in Twingate…you should see something cool

!

WiFi “Ghost Frame”, What Is It?

A WiFi Ghost frame is a term widely used in the WiFi community lately. It is not a part of the 802.11 standard, it is just a term many uses.

Some say it is a frame the receiver don’t hear, other say the receiver don’t understand. Both are wrong.

So what is it?. I will try to explain.

 

Contraints
I am only talking about frames in the 5GHz band and non-HT, HT and VHT frame formats. HE frame formats is not considered.
I assume the reader knows something about 802.11. I don’t explain the basic stuff.
The wireless frame in this article is sent by the AP.

 

Background
An 802.11 frame consists mainly of two parts. The Preamble (also called the Physical header), and the Data field, like this

The Preamble is always sent with BPSK modulation and 1/2 coding. It has different contents depended whether the Data field is non-HT, HT or VHT frame, but the modulation and coding are always BPSK 1/2. The Data field is sent with a modulation and coding scheme decided by the transmitter. The modulation scheme can be BPSK, QPSK, 16-QAM, 64-QAM, or 256-QAM. And there are different coding schemes. BPSK 1/2 is a more robust modulation and coding scheme than the others and will therefore have a “longer” range.
This can be shown in a figure like this:

Communication between the AP and STA1 will be done with an appropriate mcs-index/data rate. STA2 will in the case hear/receive the full-frame from the AP, but it will only successfully demodulate the preamble unless the frame is a 6mbs (BPSK 1/2) frame. The data field in the frame from the AP will not be successfully demodulated by STA2 and it will not be able to extract the information in it.

A scenario with minimum basic rate set to 12mbs
So let us make a scenario where the minimum basic rate in the BSS is set to 12mbs (QPSK 1/2). This means many of the frames in the BSS is sent at 12mbs, frames like Beacon and the other management frames, and most of the control frames. Data frames are usually sent with higher rates. According to the standard, a station needs an RSSI of -79dBm to be able to receive and successfully demodulate a 12mbs frame (QPSK 1/2), while it needs -82dBm for 6mbs (BPSK 1/2). And if we have a designed network with cell edges at -67dBm, it will look like this:

In this figure I have used these parameters:
– free space path loss (FSPL)
– a 6dB degradation of RSSI for each doubling of the distance
– cell size for the APs coverage area till -67dBm (often called the “want” area)

 

In figure 3 we have STA1 inside our designed coverage cell, STA2 is inside the edge for successfully demodulating of the 12mbs frames and STA3 is in an area where it will successfully demodulate the preamble from the AP, but not the data field of the frame.

So what happens at STA3
Let us consider a frame sent from the AP at 12mbs and see what happens at STA3.
First STA3 will receive the preamble with BPSK 1/2 and later the data field with QPSK 1/2.
STA3 knows, based on the standard, that the preamble is modulated with BPSK 1/2. Since this is an 12mbs frame it is also a 802.11a frame. The Signal field in the preamble will therefore tell about the data rate for the data field (12 mbs or QPSK 1/2).
If it was a mcs frame, the preamble would have an additional field (HT/VHT preamble) which informs of the data rate for the data field

Demodulation of this frame
If we look at the constellation mapper for BPSK and QPSK from the 802.11 standards it looks like this:

During demodulation, the receiver does a Fast Fourier Transform. The FFT basically interpret the amplitude and phase of each subcarrier and the output is a complex number with this format:

d=(I+jQ) x Kmod. We will not consider the Kmod now and assume it is 1

For the preamble, the receiver knows it is BPSK and the Q value in the formula is not considered. As long it predicts each subcarrier has a phase either in the first or the fourth quadrant it gives a result d=1 and it is a bit value of “1”. If the phase for each subcarrier is in the second or the third quadrant it will give a result of d=-1 and a bit value of “0”. Like this:

Keith Parsons have a great video on modulation,

Since STA3 barely is able to demodulate the preamble correctly we can assume the result of the FFT for all subcarriers will be all over the first and fourth quadrant (red rectangle) for “1”, and likewise for “0” in the second and third quadrant (blue rectangle).

Next, during the reception of the data field, the energy in the signal is still the same, but this time each subcarrier FFT phase result must hit inside a single quadrant to give its correct bit value. For example, a hit in the first quadrant (d=1+j) will give a bit value of “11”.
But the quality of the received signal is the same as for the preamble. Since we assumed the result from the FFT will hit all around in the first and fourth quadrant for a “1” for BPSK, the result will for a phase value that should have given a bit value of “11” be like this:

This will happen for every subcarrier in a symbol. For some subcarriers, the FFT will predict the correct value of d=1+j (11). But for other subcarriers, the FFT will predict either d=-1+j (01) or d=1-j (10). The FEC (forward error correction) build into the decoder will be able to correct some of the bit values, but not all.
The reception can fail here if the receiver is not able to extract the Service field of the data field correctly.
If the receiver sends the demodulated bit values up to the MAC layer, the bit pattern is processed there. One of the things that happen in the MAC layer is to find the Type and Subtype field in the 802.11 MAC header to decide what type of frame it is, and at last the full data field will be checked with a CRC control. But since there is a lot of bit faults in the bitstream, it will fail somewhere.

Probably, the reception will fail in the de-modulator, at layer 1. But if the bit pattern is been sent to the MAC layer it will fail there, at layer 2.

To summarize this for STA3:

• The preamble (BPSK 1/2) will be successfully received, demodulated and, understood in the receiver, at layer 1
• The data field (QPSK 1/2) is received with the same power level at the receiver, at layer 1. But because the demodulation process output will have so many fault bit values it will probably fail at layer 1
• If the bit pattern is sent up till the MAC layer, at layer 2, it will fail there
• So, the full-frame is heard and received, at least at layer 1. But it will fail and will not be interpreted at layer 2 or higher.
• STA3 will therefore do at least two thing
  • Understand the preamble with the Signal field and can calculate the duration of this frame
  • It will not be able to receive the NAV-timer from the MAC header, but it will sense/hear 802.11 modulated signal patterns during the full duration of the frame. If it not going into sleep mode for this duration of time

 

What are the consequences?
First of all, this does not happen inside of the -67dBm cell coverage of our AP. It is either in another BSS or if we, in our network have two BSSs on the same channel at some distance away from each other

If STA3 is a non-AP STA (client) it will have to stay quiet during the duration of the frame
If STA3 is an AP it will have to stay quiet during the duration of the frame, and it could report at airtime utilization value based on the duration.
If STA3 is a spectrum analyzer it could visualize the energy received
If STA3 is a capturing device it would not show anything

How to mitigate this behavior?
If we let 6mbs be the minimum basic rate, both the preamble and the data field for, at least the control and management frames, will be using BPSK 1/2 modulation and coding scheme, and the Beacons/BSS will be visible in a Wlan scanner tool. And all the 6mbs frames could be captured for protocol analyses.
The BSS Coloring feature in 802.11ax would be perfect to use to mitigate this challenge. But that could be described in another article. source

The closing
I hope this is useful.
I have learned a lot.
Please, give feedback if you want

Share this:

Download Softare Below

Spooks4576/Ghost_ESP Buy here

Purchase GPS Hardware Below

GhostESP- The ESP32-C6    Buy Here

supe it up with a GPS Module

GPS/GNSS Module by Rabbit-Labs     Buy Here

Internet advertisements have become very obtrusive and more apparent over the last several years. Users conducting research from various sources on the web are often met with a vexatious experience full of distractions. Children watching YouTube videos that have inappropriate advertisement content embedded in the videos are also becoming a concern for many parents. Normally users will install ad-blocking software and extensions on their operating systems and web browsers. Most of the software installed for ad-blocking purposes ends up not being updated and extensions for web browsers often stop working when the web browser itself has been updated.

A more efficient solution is now available thanks to single board computing.  The Raspberry Pi being the most readily available single board computer. For a mere $16 anyone can have a multi-platform, network-wide ad blocker on their local network. This software plays very nice in both office and home networks. Pi-hole offers a wonderful dashboard with real time analytics if you’re someone who loves numbers.

Below is an example of a Raspberry Pi, with Pi-hole installed showing real time stats via an LCD installed on the Raspberry Pi:

So what is needed to get this project going?

• Raspberry Pi Kit – $16
• Ethernet Cable (Optional) – $6
• Screen for Raspberry Pi (Optional) -$20

After you have purchased these components it’s very simple to install Pi-hole.

You can install an Operating System image on your Raspberry Pi. Step-by-step directions are provided and the entire process takes less than 10 minutes to complete.

Installing Pi-hole:

1. Install Pi-hole on the Raspberry Pi. The program can be downloaded here or via the install “curl -sSL https://install.pi-hole.net | bash|”” command.
2. Configure your router DHCP settings to force clients in using your PI-hole as their DNS server. You can also manually configure each device but that takes much more time than blocking ads on the whole network at once. This step sounds more difficult than it actually is. The only thing that you have to change are some ports and DNS settings on your router. Most routers have this setting displaying on the main page and it can be changed within a matter of a few seconds. A straightforward guide is provided on Pi-Holes official site.
3. Completion! Your Pi-hole blocks all advertisements at a DNS level. This means your whole network is protected and any device connected will automatically block online commercials even inside Apps and programs. You have freed your laptop, iPhone, Nexus tablet and desktop PC from all online commercials! Enjoy faster loading times on all your favorite websites and apps.

If you’d like to pull up Pi-holes nifty dashboard and see how many advertisements were blocked from your entire network you’ll see a clean interface exactly like the one below :

Fun Facts About Pi-hole :

– The code is completely open, and you are able to modify it in any way you’d like. (Yay for open-source!)
– Pi-hole is very lightweight as it only handles DNS queries and returns a blank HTML file so it doesn’t need much processing power. (Yay for efficiency!)
– Pi-hole will run on most Debian-based distros and is the preferred platform for it.(Yay for compatibility!) source

Block Internet ads at home with Pi-hole

LETS DIVE DEEPER….

How does Pi-hole work?

Pi-hole blocks ads by acting as a DNS sinkhole.

To understand what a DNS sinkhole is, you need to understand what DNS is. Here are a few key terms:

IP address: unique numeric address of a web resource (e.g. 104.22.23.160)

DNS: Domain Name System, associates domain names with IP addresses

DNS server: a server that translates domain names into IP addresses

Domain Name: unique alphanumeric address of a web resource (e.g. raspberrypi.com)

When you type www.raspberrypi.com into your browser, your computer asks a DNS server where to find that domain. The DNS server responds with an IP address (e.g. 104.22.23.160). Then your computer queries that IP address for the resource you’re looking for.We use domain names because IP addresses aren’t very human-readable; it’s a lot easier to read and write “raspberrypi.com” than four bytes’ worth of numbers.Usually, your computer queries a DNS server hosted somewhere on the internet. It might be hosted by your internet provider, a website hosting company, or any company that runs a lot of servers. Your machine submits a domain, and the DNS server returns the IP address corresponding to that domain. The DNS server doesn’t care if the domain provides something you want (like the article you’re trying to read) or an ad. It just resolves domains into IP addresses.

Here’s where Pi-hole comes in. Pi-hole stands between your network and a DNS server. Consider a client device, like your smart toilet, performing a DNS lookup for a domain. The Pi-hole in your network acts like a DNS server; DNS lookups from all client devices, whether that’s your smart toilet or your phone, go to the Pi-hole.

But Pi-hole doesn’t store a perfect up-to-date mapping of all domain names to all IP addresses. Instead, Pi-hole queries a real DNS server outside of your network. However, before it queries that real DNS server, Pi-hole checks a blocklist. If the domain passes this filter, Pi-hole requests the IP address from the DNS server, and returns it to the client device on your network. If the domain doesn’t pass the filter — if it’s included on the blocklist — Pi-hole returns a non-routable address such as 0.0.0.0.

The following diagram shows a lookup via a Pi-hole for the unblocked domain raspberrypi.com:

The following diagram shows a lookup via a Pi-hole for the blocked domain raspberryads.com:

TL;DR: Pi-hole blocks requests made to ad domains from your network, before the requests ever leave your network. Your client devices can’t connect to domains that host ads, but can connect to domains that host useful content.

Overview

To install a Pi-hole in your network, you’ll need to do the following things:

1. Configure a Raspberry Pi running Raspberry Pi OS.
2. Set up Pi-hole software on your Raspberry Pi.
3. Direct DNS queries on your network to your Raspberry Pi.

Supplies

• Raspberry Pi
• suitable power supply (see the documentation for details)
• microSD card (see the documentation for details)
• adapter to connect your microSD card with your usual computer
• USB cable (check your 3D printer for details)

For the initial SD card setup, you will need:

• Another computer connected to your network. We’ll refer to this as your usual computer to distinguish it from the Raspberry Pi computer you are setting up.

Choose a Raspberry Pi

You can use any Raspberry Pi model for this. We recommend Zero 2 W if you can’t decide which model to use.

Configure your Raspberry Pi

To begin, follow the Getting Started documentation to set up your Raspberry Pi. For your operating system, choose Raspberry Pi OS Lite (32-bit) to run headless (without a mouse and keyboard).

During the OS customisation stage, edit settings as follows:

• Enter a hostname of your choice (we suggest pi-hole for this tutorial)
• Enter a username and password; you’ll need these later to authenticate
• Check the box next to Configure wireless LAN so your Pi can automatically connect to Wi-Fi
• Enter your network SSID (name) and password; you can find these in your Wi-Fi settings or on a sticker on your router
• Check the box next to Enable SSH so we can connect to the Pi without a mouse and keyboard

Connect via SSH

Open a terminal on your computer. If you use a Windows computer, you may need to install a terminal; we suggest PuTTY. Enter the following command to connect to your Raspberry Pi, replacing the <username> placeholder with your own username that you chose in Imager:

$ ssh <username>@pi-hole.local

If ssh asks you if you’re sure you want to continue connecting, reply yes. Enter the password you chose during advanced configuration when prompted.

You’ll know you’ve connected successfully when you see the following prompt with your configured username and hostname:

<username>@<hostname>:~ $

Now that you’ve connected to your Raspberry Pi, run two commands to make sure that all of your packages are up to date:

$ sudo apt update
$ sudo apt full-upgrade

Once the package update commands finish running, reboot your Raspberry Pi to allow all changes to take effect:

$ sudo reboot

Running this command will disconnect you from the Raspberry Pi SSH session. Wait a few seconds for your Raspberry Pi to reboot, and enter the ssh connection command again to reconnect to your device.

tip

On most terminals, press the Up arrow key, then the Enter key to re-run the most recent command.

Install Pi-hole

Run the following single-line command to run the Pi-hole setup script:

$ curl -sSL https://install.pi-hole.net | bash

The setup script is relatively self-explanatory, but follow these tips if you aren’t sure how to proceed:

• When warned about needing a static IP address, click Continue to proceed; we’ll deal with this later
• When prompted to select an interface, select wlan0 to use your Raspberry Pi’s Wi-Fi connection
• When prompted to choose an upstream DNS provider, choose OpenDNS
• Include StevenBlack’s Unified Hosts List
• Install the Admin Web Interface
• Install lighttpd and the required PHP modules to run the Admin Web Interface
• Enable query logging
• When prompted to choose a privacy level, choose Anonymous mode

When you see “Installation complete!”, the setup is complete. This screen shows the IP address of your Pi-hole, a link to the admin interface, and your administrator password.

• Save this password somewhere safe, like a password manager — you’ll need it to work with your Pi-hole in the future
• Save the IP address — you’ll need it to configure a static IP address shortly

Pi-hole only provides a single administrator account, so there’s no username. Press the Control key (Command on macOS) and click the link to the admin interface that uses an IP address. It’ll look something like http://192.168.1.24/admin. Don’t use the pi.hole domain link yet; until we configure the Pi-hole as our DNS provider, it won’t work. The link should open in your browser. You can also copy and paste the link into a browser if control + click doesn’t work in your terminal. Use the admin password from the setup script output to authenticate. You can now see your Pi-hole admin console! We recommend bookmarking this console for future maintenance.

Configure your network to use your Pi-hole

warning

The tasks below require you to change global settings in your wireless network. You might break your internet connection (for a little while). Proceed with caution!

To complete these tasks, visit the admin interface for your router. You can usually access the admin interface through your router’s IP address. Here are a couple of common ways to find that interface:

• Run the following command on your Raspberry Pi to output your router’s IP address:

  $ nmcli -f IP4.GATEWAY device show wlan0

• Check for a sticker on your router — look for a value called “admin URL” or similar

Once you’ve found the IP address, log in to your router’s admin interface by typing the address (sometimes with the suffix /admin) into your browser. Enter your username and password (if you don’t know these, you may be able to find them on a sticker on your router). Now that you’ve got your Pi-hole configured, you have three choices to use it to block ads. All of them involve getting Pi-hole between your network and the internet:

• configure Pi-hole as the DNS server for your network
• configure Pi-hole as the DHCP provider for your network
• manually point devices at Pi-hole for DNS

It’s easiest to use your Pi-hole as a DNS server. However, some routers don’t provide a setting to control the default DNS server. If you can’t set a DNS server, try configuring Pi-hole as your DHCP provider. And if you can’t do that either, you can always manually point devices at the Pi-hole for DNS — it’s not as good as full-network ad blocking, but it’s a lot better than nothing.

Configure Pi-hole as your network’s DNS server

This is the most common way of configuring a Pi-hole. For this method, you’ll first assign your Raspberry Pi a static IP address from your router’s interface, then point your router’s DNS server settings to the Pi-hole’s static IP address. With this setup, your router controls IP reservations across your network, but devices on the network send DNS queries to your Pi-hole instead of to a DNS server on the internet.

Assign your Raspberry Pi a static IP address

IP addresses are unique numeric codes that allow you to directly interact with devices on your network. For instance, many routers automatically assign themselves the first address in the IP block they are using, such as 192.168.1.1. Most networks use Dynamic Host Configuration Protocol (DHCP) to assign IP addresses to devices automatically. These IP addresses are known as dynamic IP addresses, because they can change at any time.

To run a Pi-hole on your network, we recommend assigning your Pi-hole a static IP address. A static IP address never changes. This allows devices on your network always to find the Pi-hole at the same address.

To start, run the following command on your Raspberry Pi:

$ hostname -I

You should see output similar to the following:

$ 192.168.1.24

This value is the current (dynamic) IP address of your Raspberry Pi on the network.

To assign a static IP address, you also need the MAC address of your Raspberry Pi. A device’s MAC address is a hardware identifier that your router uses to uniquely identify it. Run the following command to find the MAC address of your Raspberry Pi:

$ nmcli -f GENERAL.HWADDR device show wlan0

You should see output similar to the following:

GENERAL.HWADDR:                         A8:42:EA:58:E0:1C

The value on the right is the MAC address of your Raspberry Pi. Now that we know your Raspberry Pi’s MAC address and IP address, we can configure your router so it always associates the Raspberry Pi’s MAC address with its current IP address. Effectively, we’re turning the current dynamic address into a static one using the MAC address. In your router’s admin interface, configure a static IP address for your Raspberry Pi. There are several ways to accomplish this, depending on your router:

• You might be able to find this setting in the “Advanced” section of the router admin interface. Look for a list called “DHCP Reservations”, and enter your Raspberry Pi’s IP address and MAC address.
• Look for a list of connected devices and find your Raspberry Pi’s IP address or MAC address. Select the option to “Always use this IP address” to make the IP address reservation static.
• Check the documentation for your router model for specific instructions.

Set Pi-hole as your network’s default DNS server

Once you’ve assigned your Raspberry Pi a static IP address, you can configure individual devices to use Pi-hole as a DNS server in their network settings. But this process is tedious, and some devices don’t provide an easily accessible DNS server setting. However, there is an easier way: most routers automatically suggest a DNS server for devices connected to your network. All you have to do is change the suggested server in your router’s settings, and your entire network should start using your Pi-hole for DNS.

Look for a setting called DNS in your router’s admin interface. You may be able to find the setting in a section called “Internet”, “DHCP”, “Internet Connection”, or “DDNS”.

Enter your Pi-hole’s IP address in the DNS (or similarly named) field.

If your router provides multiple custom DNS fields, add your Pi-hole address in each field.

important

Whatever you do, don’t add any separate DNS entries after the Pi-hole entries — this can break Pi-hole’s ad blocking functionality. When your Pi-hole blocks a domain, it returns a non-routable address such as 0.0.0.0, and some devices will query the secondary DNS server when the first server returns such a non-routable address. If your secondary DNS server isn’t a Pi-hole, every single request blocked by Pi-hole will succeed on the secondary server, and ads will load as if you weren’t running an ad blocker at all.

Configure Pi-hole as your network’s DHCP provider

If your router doesn’t support configuration for static IP addresses or DNS servers, you may still be able to use your Pi-hole automatically across your network. First, check whether you can change the network DHCP server in your router settings. If you can, you can use your Pi-hole both as a DNS server and as the DHCP server that handles IP address reservations across your network.

First, navigate to the Pi-hole admin console. If you type your Raspberry Pi’s IP address into your browser, it should redirect you there.

In the left side menu, select the “Settings” page.

In the DHCP tab, in the “DHCP Settings” block, check the “DHCP server enabled” box.

Pi-hole should pre-populate the IP address range with the IP block that your router currently uses, and the router IP address with the router’s current IP address. You can leave these values as they are. Click the Save button in the bottom left to start hosting a DHCP server from Pi-hole.

Finally, visit your router’s admin interface, and set your Pi-hole’s IP address as the DHCP provider for your network. When your Pi-hole is functioning as the DHCP provider, your router delegates all IP-related tasks to it. This includes DNS server configuration, so your Pi-hole can suggest itself as the default DNS server for all devices on your network. Check the documentation for your router model for specific instructions.

Manually point devices at Pi-hole for DNS

On many devices, you can configure DNS settings in Wi-Fi preferences. Look in the “Advanced” section of your Wi-Fi or wired connection preferences for a DNS server setting. Put your Raspberry Pi’s IP address in this field. Your device should immediately start issuing DNS queries to the Pi-hole.

Unless you’ve configured a static IP address for your Raspberry Pi, this IP address can change at any time without warning. Follow the instructions under “Assign your Raspberry Pi a static IP address” in the DNS section above to configure a static IP address — this will prevent your device from losing its connection to the Pi-hole (and most of the internet!) when your Pi-hole’s dynamic IP address changes.

Is my Pi-hole working?

With a Pi-hole acting as the DNS server for your network, many pages will load without ads at all. Most privacy-invading trackers won’t work either. You’ll still see cookie and app install banners, because those can’t be blocked at the DNS level. To check to see if your Pi-hole is working correctly:

• Check out Adblock Tester. Without Pi-hole, many browsers score near 0; with Pi-hole, you should see a score at or near 100.
• Try visiting http://pi.hole/admin/login.php. Pi-hole always routes the pi.hole domain to your Raspberry Pi when you use Pi-hole as your DNS server.
• Visit any site where you normally see ads and visually confirm that ads are no longer there.
• Check the proportion of “queries blocked” on the Pi-hole dashboard. Many networks see between 10% and 50% of queries blocked!
• Check the DNS server used by other computers in your network. You should be able to find this information in “Details” or “Advanced” Wi-Fi settings. If you see your Raspberry Pi’s IP address, your configuration worked!

If you’ve completed all of the setup steps but you’re still seeing ads (or, worse, DNS queries don’t resolve), try the trusty solution of turning your router off and on again. This should disconnect all devices from your network and renew all DHCP leases, putting your new settings into effect for every device. Congratulations! Your home network is now protected from ads. Put a slice of bread in your smart toaster, watch a movie on your smart TV, and flush your smart toilet in the comfort of privacy and security. source

 

1. Install a supported operating system

You can run Pi-hole in a container, or deploy it directly to a supported operating system via our automated installer.

Docker install

Supported operating systems

2. Install Pi-hole

Our intelligent, automated installer asks you a few questions and then sets everything up for you.  Once complete, move onto step 3.

Install Pi-hole

3. Use Pi-hole as your DNS server

Configure your router’s DHCP options to force clients to use Pi-hole as their DNS server, or manually configure each device​ to use the Pi-hole as their DNS server.

Use Pi-hole as your DNS server

4. Block ads everywhere, even on the go

By pairing your Pi-hole with a VPN, you can have ad blocking on your cellular devices, helping with limited bandwidth data plans.

Pi-hole + VPN

Network-wide protection

Instead of browser plugins or other software on each computer, install Pi-hole in one place and your entire network is protected.

Block in-app advertisements

Network-level blocking allows you to block ads in non-traditional places such as mobile apps and smart TVs, regardless of hardware or OS.

Improve network performance

Since advertisements are blocked before they are downloaded, network performance is improved and will feel faster.

Monitor statistics

Our Web interface offers control of your Pi-hole and a central place to view statistics.  We also include an API for extending these stats.

Web Interface

In addition to blocking advertisements, Pi-hole has an informative Web interface that shows stats on all the domains being queried on your network.

Built-in DHCP Server

Pi-hole works fine with an existing DHCP server, but you can use Pi-hole’s to keep your network management in one place.

Manage White And Black Lists

Fine-tune your experience by blacklisting or whitelisting domains.  Extend this capability with powerful regex statements.

Query Log

See all the domains being queried on your network, where they originated, and more.

Long Term Statistics

Queries are stored in a database and can be queried at any time.  Learn about what’s happening on your network over time.

Audit Log

Keep track of the most queried domains and add them to a white or blacklist from a central page.

Privacy Modes

Choose from four different privacy modes that works for your environment.

Other Settings

Control and configure other settings from the Web interface.

source

 

 

 

 

 

 

 

 

 

Starting out with any new operating system can be frustrating, because the simplest operations don’t work in the way you’re used to. Learning these differences between Windows and Linux can cure headaches.

That fish out of water feeling is awful, when the most basic operations throw you for a loop. It’s natural to worry that everything else is going to be a struggle too. Getting nowhere fast leads to people giving up entirely. When dabbling in the shallows is so discouraging, the idea of taking the plunge becomes unappealing.

As is often the case, it’s the little things that matter most. So here’s our list of little things that have a big impact on your first few days as a Windows user exploring the Linux command line.

Case Sensitivity

On Linux, file and directory names are case-sensitive. On Windows they’re not.

Linux lets you have files in the same directory that are called the same thing, as long as they’re written differently.

Let’s create a few files to illustrate this. If you read these filenames out loud they all sound the same. But, because they use a different mix of characters, on Linux they’re actually different names.

touchunique-file.txt

touchUnique-file.txt

touchUnique-File.txt

touchUNIQUE-file.txt

ls

The touch command creates the files and ls confirms they happily reside in the same directory. On Windows, file.txt and FILE.TXT refer to the same file.

The case sensitivity of Linux applies to directory names, too.

mkdir sub1

mkdir Sub1

mkdir SUB1

ls -l

All of these subdirectories exist within the same parent directory.

Paths and Directories Separators

Windows uses a backslash \ as the directory path separator, but Linux uses /, the forward slash. You’re going to need to concentrate to overcome the muscle memory of typing \.

pwd

\ dates back to the release of MS-DOS in 1981, but / was born in 1971 with the first version of Unix. If MS-DOS had used / as well, this issue wouldn’t exist.

File Extensions

On Windows, file extensions tell the operating system which application to launch when you double-click a file. On Linux, the operating system determines the file type by examining its header bytes.

You can do this yourself using the file command.

file mystery-file

File extensions on Linux tell you, the user, what type of file something is. Linux already knows.

Nor do you need to use a specific extension on binary executable files. There’s no Linux equivalent to the COM and EXE extensions of the Windows world. A Linux executable can have any extension, or no extension.

do-some-work

and-you.too

Hidden Files and Directories

On Linux, if a file or directory has a period ‘.’ as the first character of its name, it’ll be hidden. To hide a file on Windows, you right-click the file, click Properties, click the Hidden checkbox so that it is selected, then click OK.

Adding the -a (all) option to the ls command lists includes hidden files and directories in the listing.

touch new-file.txt

touch.new-hidden-file.txt

ls

ls -a

Most file browsers, such as GNOME’s Files, support toggling back and forth between showing and hiding your hidden files, by hitting Ctrl+H. In the Windows 11 file explorer, from the toolbar select View > Show > Hidden Items to do the same thing.

In GNOME Files, without showing hidden files, we see a single file.

Hitting Ctrl+H reveals the hidden file.

Command Differences

Terminal commands are very different on Linux from their Windows counterparts, and often come with short names. The ultimate has to be a single period. On Linux, ‘.’ tells the shell to source or read a file.

Some Linux command names are at least suggestive of their use, like cp for copy and mv for move. Others are more opaque. Windows users are familiar with using dir at the command prompt to list files and directories, while Linux users type ls, which is short for list.

Windows PowerShell users might use cat to list files, but cat on Linux concatenates files or dumps their contents to the terminal window, in an action similar to the Windows type command. The Linux type command describes commands and parameters, but not in the way a user guide might. For that, you use the man command, short for manual.

To change directories, you use cd on both platforms, but on Linux you don’t have drive identifiers. Everything, including mounted drives, is just a directory branch off the root / directory.

To distinguish command options from parameters, Linux uses – or — but Windows uses /.

Another difference is that typically, Linux commands are silent on success. Adopting the “no news is good news” stance, you’ll only see output if something goes wrong. If you’re not alerted to an issue, assume what you just did worked.

rmunwanted-file.txt

The file is removed, silently. Also, there’s no Recycle Bin with rm. Your file’s gone. Period.

We shouldn’t be surprised at these differences. Different platforms are bound to have different command sets. Our only answer is to embrace the change, and learn the commands.

Use sudo Instead of Run as Administrator

Window users might be familiar with the Run as Administrator option found in an executable’s right-click context menu. This runs the program with elevated permissions.

The equivalent on Linux is the sudo command. Preceding a command with sudo runs that command with elevated permissions. Only users who are specifically granted permission are able to invoke superuser mode.

If we try to add a user with sudo, we’re refused. But if we’re in the sudoers list and we precede the command with sudo, Linux allows us to add the user.

There’s a learning curve associated with moving to any new operating system, and whichever way you slice it, you’ve got to climb that curve. But if you don’t get the basics sorted out, you’ll never make it up that slope. source