I do not want to be vilified for saying this, so I will echo what everyone else seems to be suggesting of DDG being a good degoogled search engine.

When I started to degoogle, personally do not remember what I was using DDG and ecosia probably. I hear ecosia has jumped into the AI game which I think is icky for what they are trying to do.

I later started getting into home labbing. I am in no way suggesting that you should jump into that right now, this is a rather expensive lifestyle, it starts with one project and you think oh fun what can I replace next? So the search engine I use now is searXNG, which I have set to pull from Bing, wikiepedia, and a bunch of smaller engines. I am just trying to say there are options for you to look into in the future. Not right now you are just getting out of the Google ecosystem

I understand that CIRA is Canadian. I wanted to make sure it was not going to big tech if Unbound could not do its thing. I live here in Canada, with three static IP addresses so they know about me just as much as they already know about anyone who has a domain (or two) ending in .ca!

After you mentioned ODoH I looked it up, I read about it and was going to see if unbound supported it and at this point in time it does not appear that they do. I was not going to admit defeat so I looked up DoH, no dice unbound does not support it but they do support DoT, I spent the last few hours learning about and deploying DoT from unbound to CIRA.

When CIRA changes there retention standards I may look for something else.

I want to thank you for enlightening me on my journey for more privacy.

A better way to block the tracking pixel is do not use Gmail.

Bridge mode would be something you would have to talk to your ISP about more than likely. The router from your ISP is also the modem so the ethernet reaching out to the WAN needs to go to the ISP modem, than the ethernet coming out of the modem going to your LAN needs to go to your firewall.

When I went searching out options like you I found many things and I was sure I was going to want to use OPNsense, it was what I felt the most used by youtube people and I thought it was a fork of a proprietary pfsense. When I did a little more research I found out why OPNsense was used by so many Youtubers, OPNsense is proprietary-ish software for certain firewalls. The next thing I found was openWRT, once I found it I went searching for the best hardware for it and found the Flint 2. After I got that I flashed it with a vanialla install of openWRT.

My original plan was to self-host an email server, so I had gotten 2 static IP addresses. They were free so why not I thought. Turns out hosting your own email server is not that easy, so I went to the company hosting my domain. This is all besides the point.

After getting my static IPs and my Flint 2 setup (I did it backwards you should really have a firewall before the static IP it was not to far apart but it would have been easier to do it the right way), I could do things I could only dream of in the past. I could have a VPN into my LAN (using wireguard) so when I was out and about I can still use my pihole setup to block trackers, ads, and some spying eyes. I have vLANs galore and if it does not need to be attached to the internet it is not, or it is in my IoT vLAN that does not have WAN access.

In short do not think it is simple, it is not. The ISP router does so much more than routing it is also a sad excuse of a firewall and it is a modem.

I do use unbound with CIRA.

Pihole was my first venture into privacy, and it was years ago. Of course I did not realize that is what it was at the time, I thought it was just ad blocking. I still have a google account for youtube, and I hate that I am using it but that is where the creaters are. I currently do not have anything strong enough to do the whole YouTube without the google thing yet, I hope to be getting a new to me Mac mini that I will install Debian on next week where I will try invedious but right now I have a pi 5 running librewolf with adguard and sponser block. Do not get me wrong it hurts me knowing I am taking money away from creators doing this but it makes me feel better knowing that the Google is not selling me.

I have my own domain that hosts emails I have a wildcard email address so I can give out random emails to people so that I could stop using Apple’s hide my email as I was slowly moving away from Apple already. When Trump got in for his second term and the boycott the US movement started I started self hosting a lot of services.

I in no way meant to implement everything at once, it has taken me years to get where I am. The pihole was just my gateway drug into doing stuff.

I personally prefer the security of my LAN, it has a Flint 2 running vanilla OpenWRT with lots of vLANs. As much as I believe do not trust your ISP to have your back I have 2 static IP addresses, one was going to host my email and the other would be my internet stuff. I than use wireguard to VPN into my LAN when I am out and about. I have not come across a VPN blocked website, but I have a very finally tuned pihole setup.

I am also not out and about much that I actually see any site that may have a VPN blocking site, but again my pihole is very finally tuned, some times I see the please turn off your ad blocker popup so I find the article published elsewhere, or if it is arstechnica (I think) I still have 98 years or something like that until I can read an article from them.

I also self host a lot of things so it is not like I am worried to much. I read up on my cities transit app and found out how horrible it actually is so I built my own (sorta) it tells me what buses I need to take to get places and it tells me where every operational bus is in the city. I realize it is vibe coded so it needs work, work I will be giving it when I get a new phone as I get out of the Apple Garden.

So does my pihole. You should never trust your ISPs firewall/modem/router, never ever. You should have a hardware firewall/router and than you can set up a VPN into your LAN.

I realize this is Russia spicific but Canada is moving that same way. I luckily am slowly climbing out of the Apple walled garden, my next phone is going to be a pixel so I can install GeapheneOS and use F-Droid as the store, or whatever it is called, so that I can keep my wireguard setup.

This is a privacy Lemmy group, why are people using a third party DNS server? There is Adgaurd Home, I do not use it I tried it but did not like it more than the alternative but I hear people like it. There is also Pi-Hole, I do use this and I have finally tuned it. I actually have pihole’s one for primary DNS and one for secondary DNS.

*edit: I should appologize I should really have noticed the pihole was my gateway service into self hosting and privacy. It took years for me to notice how additing the simple ad blocking was and than some movements for me to start moving more services to self hosted. I just realized it has only been months that I have set up my firewall, and now I just cannot believe I have ever lived without it.

I will hopefully be adding a new to me computer next week, my lab is put together with a bunch of things it would nice to try this out.

Thanks but this girl has nice new flooring and a new hobby/way of life! I would disagree with you on passwordless log in, do it where ever you can but use ssh-keys and change ports away from 22.

I really do not like using ports in the 8080 range either but I think that is because of my 22 issue.

I do not entirely understand how the sshole works either, but yes I believe it does have something to do with some old thing where the attacker would just have to put in some stupid long password and some ssh protocol would let it in. Most of my homelab uses openssh, I do not believe this had that issue I have keys with password auth turned off so you need my keys to get in, OpenWRT uses DropBear and that did not have the issue.

From what I understand the sshole was a big nothing burger.

I had breifly heard that the CEO was pro-Trump when Trump was re-elected, so I had cancelled then and than searched out Canadian hosts that do not look through my mail. I was first with HostHero, because I could move my blog onto there servers they however charge an arm and a leg for unlimited emails with no wildcard option. I got tired of their angry support people when I was having issues so I went looking for a better solution and found easyDNS, who now hosts my domain, a VPS, and an email with a wildcard option.

I am a dumb ass with a BA in the social sciences not computer science, but I was able to get a vanilla OpenWRT installed on a Flint 2 firewall. Sure I did a lot of reading, youtubing, and got a little AI help. The Flint 2 comes with OpenWRT installed on it but everything I read suggested putting a clean install.

I had a slow start to home labbing I started with one pihole than moved to two, than I thought about getting a VPN running but that did not really work I believe I even tried using duckDNS for that but than I did the dumbest thing anyone can do I opened port 22 in my firewall so that I could SSH in. When my internet mystiralisly stopped working correctly I called up my ISP and wow did I ever learn that opening port 22 was a bad idea for how I had it set up at the time. So that stopped me exploring homelabbing for a while, sure after I had new pi installs set up it was never project after project but I never used port 22 again (until recently now that I have crowdsec running) and never used passwordless login. But earlier this year my place flooded and I was out of my home more frequently so I needed to find a way that I could access my pihole and smb (I had given up on using nextcloud at that point but I think I am coming back around to it), so came the Flint 2. With OpenWRT the 3 or 4 projects turned into an infinite number of possibilities.

ISP routers are also a security issue, when that PHP thing happened I had to go through all my stuff and find what was vulnerable and either update it or replace it, luckily nothing on my firewall was affected. When sshole was the big scare I went and looked everything up on it to make sure I was not in trouble, I wasn’t I use keys with password authentication turned off, but that got me thinking I should see if there are any updates for my firewall. Turns out there were a few, I had never thought of updating a firewall before because the only times my ISP firewall would have been updated is when I broke something and the IT people would just decide to do their thing and break all of my configs, there may have been updates with that.

This is just my story and how I have done/am considering looking at doing it. I to have a OpenWRT firewall, I to have lived in the Apple ecosystem my whole life, but I am slowly climbing out of it.

I have a Samsung laser printer of some sort, before I got into the whole home labbing and privacy thing I just had a raspberry pi of some sort (it rotated a few times because I was attempting the adblocking with pihole off and on). When I decided privacy was the better option and I had my pihole figured out I installed CUPS on a pi zero 2, I so rarely used the thing that it was not a thought for me to look up and install SANE I just used the app and the wifi from the printer. A day came a long when I had to do the wifi suffle to do the scanning when I thought there must be a better way and installed SANE. Fun side note; I have a perimant disability and see a physio, the insurance I have wants some paper work (that so rarely changes) every three months so I just have a script that looks at my calendar so the day of my physio treatments and counts the number of times I have seen them and prints out the documents if it is time to send them! So number 2 is my suggestion for sure if you are just beginning.

I have a vLAN (10.0.69.0/24) that my homelab sits on so my printer is attached to it that way with the pi I am using for CUPS and SANE, my HAOS pi is also on that vLAN and I see HA has something it can do with the printer I have considered looking at that once or twice. Now that you have mentioned this I may just read up on it because I have issues with SANE, not sure if it is configured correctly or my printer just really does not like it but if HA can do the things I may set it up and attach it to my IoT wifi vLAN (10.66.6.0/24) which does not access the outside world but HA and my 2 personal vLANs (10.42.0.0/24 for wifi and 10.4.20.0/24 for my VPN) can do things in it. I got into numbering my vLANs with fun combos when one day I was out and about when I could not connect to my VPN because it used the same IP range or something like that.

I use static IPs for everything within their own vLAN but I do not think it would be worth my time to set up firewall rules just for it when I have other options. If it does not need to phone home for anything other than data harvasting it is either not attached to the internet like my “smartTV” or it goes onto my IoT wifi that HA can do the stuff with.

Why pay for some company to watch over you and your searchs? If you want real private searching it comes down to searXNG!

I went from the Google to Ecosia and then searXNG. I guess I left ecosia before they went on the big AI trip.