🛠 Pi-hole : serveur DNS filtrant sur le NanoPi R5S

Objectives

Install a filtering DNS server on the NanoPi R5S already acting as a router: either Pi-hole (via DietPi or Docker) or dnsmasq in list-filtering mode. The R5S is ideal for this role: always on, low power consumption, wired Ethernet, and DietPi lists it among supported software titles since v8.20. You will learn how to configure the upstream DNS, redirect port 53 from the LAN, and verify that blocking works.

Hardware

• NanoPi R5S running Debian/Ubuntu (FriendlyElec), Armbian, or DietPi ≥ v8.20
• The R5S must be the router (or the DNS server announced via DHCP) for the LAN — see the Linux router tutorial
• Minimum 8 GB eMMC; prefer a microSD card or NVMe M.2 drive to reduce wear

Complete code

#!/bin/bash
# Installation Pi-hole : sur DietPi, dietpi-software installe le paquet
# proprement ; sur Debian, l'installeur officiel (à examiner avant d'exécuter).
sudo apt update && sudo apt install -y pihole   # paquet dispo sur DietPi

# Sur Debian classique, installeur officiel (à examiner avant d'exécuter) :
curl -sSL https://install.pi-hole.net | bash
#   → interface amont : 1.1.1.1 ou le DNS de la box
#   → interface d'écoute : br-lan

# Détourner le DNS du LAN (clients qui ignorent le DHCP) :
sudo iptables -t nat -A PREROUTING -i br-lan -p udp --dport 53 \
    -j DNAT --to-destination 192.168.69.1:53

# Vérifier l'écoute et le filtrage
ss -lunp | grep ':53'
nslookup doubleclick.net 127.0.0.1        # doit répondre 0.0.0.0
nslookup example.com 127.0.0.1            # doit résoudre normalement

# Statistiques / console d'admin
curl -s http://127.0.0.1/admin | head -n 5

Expected verification

ss -lunp shows pihole-FTL listening on port 53. A query for nslookup doubleclick.net returns 0.0.0.0 (blocked), while an allowed domain resolves normally. The admin console at http://192.168.69.1/admin displays LAN queries. DHCP clients point to 192.168.69.1. The RK3568B2 easily handles domestic DNS traffic (several thousand queries/s).

Common errors

• Port 53 conflict: systemd-resolved or dnsmasq already listening; disable them (systemctl disable --now systemd-resolved) before installing Pi-hole.
• 8 GB eMMC saturated by logs: limit log retention in the admin interface, or move the database to NVMe/microSD.
• DNS loop if the upstream DNS is 127.0.0.1: choose an external resolver.
• Android/Chrome clients bypassing the filter via DNS-over-HTTPS: plan for DoH blocking rules on egress or use a network profile.
• Forgetting the PREROUTING rule: clients with static DNS (8.8.8.8) are not filtered.