{"id":15148304,"url":"https://github.com/harrypnyce/raspbian10-buster","last_synced_at":"2025-06-26T09:39:07.470Z","repository":{"id":201877352,"uuid":"194031464","full_name":"harrypnyce/raspbian10-buster","owner":"harrypnyce","description":"Raspbian 10 (Buster) Lite Setup: with Wireguard, Pi-hole, Unbound","archived":false,"fork":false,"pushed_at":"2021-06-17T17:29:20.000Z","size":41,"stargazers_count":57,"open_issues_count":0,"forks_count":5,"subscribers_count":5,"default_branch":"master","last_synced_at":"2025-04-06T21:42:38.182Z","etag":null,"topics":["adblocking","buster","debian","dns","linux","pihole","raspbian","unbound","wireguard","wireguard-vpn"],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/harrypnyce.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2019-06-27T05:55:27.000Z","updated_at":"2025-03-14T04:51:52.000Z","dependencies_parsed_at":null,"dependency_job_id":"77d7f7ac-ed21-4c29-9f6c-6e8e017a1917","html_url":"https://github.com/harrypnyce/raspbian10-buster","commit_stats":null,"previous_names":["harrypnyce/raspbian10-buster"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/harrypnyce/raspbian10-buster","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/harrypnyce%2Fraspbian10-buster","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/harrypnyce%2Fraspbian10-buster/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/harrypnyce%2Fraspbian10-buster/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/harrypnyce%2Fraspbian10-buster/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/harrypnyce","download_url":"https://codeload.github.com/harrypnyce/raspbian10-buster/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/harrypnyce%2Fraspbian10-buster/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":262039937,"owners_count":23249303,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["adblocking","buster","debian","dns","linux","pihole","raspbian","unbound","wireguard","wireguard-vpn"],"created_at":"2024-09-26T13:02:34.117Z","updated_at":"2025-06-26T09:39:07.447Z","avatar_url":"https://github.com/harrypnyce.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"[Raspbian GNU/Linux 10 (buster) Lite](https://downloads.raspberrypi.org/raspbian_lite_latest.torrent) setup: (Wireguard, Pi-hole \u0026 Unbound) running on a Raspberry Pi 3 B+\n\n\u003e ~~Linux pihole2 4.19.56-v7+ #1242 SMP Wed Jun 26 17:31:47 BST 2019 armv7l GNU/Linux~~ (updated for new kernel)\n\u003e Linux pihole2 4.19.75-v7+ #1271 SMP Mon Sep 30 13:49:02 BST 2019 armv7l GNU/Linux\n\nRaspbian Buster Lite initial install.\t\t\n[Change default username](https://unix.stackexchange.com/questions/98461/proper-way-of-changing-username-in-ubuntu-or-any-linux) \u0026 password (pi/raspberry).\n\n    passwd\n    usermod -aG sudo user\n    groupadd user\n    usermod -d /home/user -m -g user -l user pi \n~~sudo rpi-update~~ [latest bleeding-edge firmware and kernel no longer needed for these use-case(s)] https://github.com/Hexxeh/rpi-update\n\n[Use console based raspi-config](https://www.raspberrypi.org/documentation/configuration/raspi-config.md) application to make configuration changes.\n\n    sudo raspi-config\n    \n[Generate SSH key pairs](https://www.ssh.com/ssh/keygen/).\n\n    ssh-keygen -t rsa -b 4096\n\n[Optional]\n\n    ssh-copy-id -i ~/.ssh/id_rsa user@host/ip\n\n[Optional] Take some time to [configure and harden your SSH server](https://infosec.mozilla.org/guidelines/openssh.html).\n\n    nano /etc/ssh/sshd_config\n    sudo apt update \u0026\u0026 sudo apt-get upgrade -y\n\n[Optional] [Add real-time clock DS3231](https://sigmdel.ca/michel/ha/rpi/rtc_en.html) to RPi3 B+ (for DNSSEC accuracy, as the Raspberry Pi devices lack a proper hardware clock).\n\nhttps://cdn-learn.adafruit.com/downloads/pdf/adding-a-real-time-clock-to-raspberry-pi.pdf\n\n    apt-get purge fake-hwclock\n    sudo apt-get install python-smbus i2c-tools\n    sudo nano /etc/modules\n\t\trtc-ds1307\n    sudo i2cdetect -y 1\n    sudo nano /etc/rc.local\n\t\techo ds1307 0x68 \u003e /sys/class/i2c-adapter/i2c-1/new_device\n    \t\thwclock -s\n    sudo reboot\n    date\n    sudo date -s \"Thu 27 Jun 2019 01:41:20\"\n    sudo hwclock -w\n    date; sudo hwclock -r\n\n[Wireguard installation](https://pivpn.io/) (Notes for previous build based off of this great script --\u003e https://github.com/adrianmihalko/raspberrypiwireguard).\n\n    curl -L https://install.pivpn.io | bash\nThe above Wireguard installer handles EVERYTHING -- once finished, please reboot and skip down to the \"Install Pi-hole\" section and proceed normally.\n\n\u003e If you prefer to build this all yourself, please by all means continue, _HOWEVER_ i urge you to consider utilizing the superb aforementioned installer from the team at https://pivpn.io/ as it allows for customization of VPN port, encryption strength, DNS server, etc.  It's extremely powerful, even for experts -- also allows option of using OpenVPN server installation if you're not yet ready to try [Wireguard](https://www.wireguard.com/).\n\n---\n\n    sudo apt-get install hostapd dnsmasq libmnl-dev linux-headers-rpi build-essential git dnsutils bc raspberrypi-kernel-headers iptables-persistent -y\n    echo \"deb http://deb.debian.org/debian/ unstable main\" \u003e /etc/apt/sources.list.d/unstable-wireguard.list\n    sudo su\n    printf 'Package: *\\nPin: release a=unstable\\nPin-Priority: 90\\n' \u003e /etc/apt/preferences.d/limit-unstable\n    sudo apt-key adv --keyserver   keyserver.ubuntu.com --recv-keys 04EE7237B7D453EC\n    \n~~sudo apt-key adv --keyserver   keyserver.ubuntu.com --recv-keys 04EE7237B7D453EC~~ (_only the first pubkey was necessary_)\n\n    sudo apt update\n    sudo apt-get install wireguard -y\n    sudo reboot\t\t\n\nEnable IPv4 forwarding (reboot required to activate forwarding).\n\n    sudo perl -pi -e 's/#{1,}?net.ipv4.ip_forward ?= ?(0|1)/net.ipv4.ip_forward = 1/g' /etc/sysctl.conf\n    sudo reboot\n\nConfirm previous changes.\n\n    sysctl net.ipv4.ip_forward\t\t\n\t\t\n[Configure WireGuard](https://github.com/adrianmihalko/raspberrypiwireguard)\n\n    mkdir wgkeys\t\t\n    cd wgkeys\t\t\n\nPLEASE protect your private keys!\n\n    wg genkey \u003e server_private.key\t\t\n    wg pubkey \u003e server_public.key \u003c server_private.key\t\t\n    wg genkey \u003e client1_private.key\t\t\n    wg pubkey \u003e client1_public.key \u003c client1_private.key\t\t\n    ls -la\t\t\n    cat server_private.key\t\t\n    cat client1_public.key\n\nSetup Wireguard VPN server network interface, using server PRIVATE key \u0026 client PUBLIC key.\n\n    sudo nano /etc/wireguard/wg0.conf\t\t\n\n\n    [Interface]\n    Address = 192.168.99.1/24\n    ListenPort = 51820\n\n    PrivateKey = \u003cserver_private.key\u003e\n    PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE\n    PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE\n\n    [Peer]\n    #Client1\n    PublicKey = \u003cclient1_public.key\u003e\n    AllowedIPs = 192.168.99.2/32\n\nStart Wireguard VPN server\n\n    sudo wg-quick up wg0\t\t\n    sudo wg\t\t\n\nAutomatically launch Wireguard at system startup.\t\t\n\n    sudo systemctl enable wg-quick@wg0\n    sudo apt install qrencode\n\t\t\n---\n\nInstall [Pi-hole then Unbound](https://docs.pi-hole.net/guides/unbound/).\n\n    sudo curl -sSL https://install.pi-hole.net | bash\n\nSetting up Pi-hole as a recursive DNS server.\n\n\tsudo apt install unbound\n\t\nDownload current root hints file.\n\n\twget -O root.hints https://www.internic.net/domain/named.root\n\tsudo mv root.hints /var/lib/unbound/\n\t\nConfigure unbound\n\n\tsudo nano /etc/unbound/unbound.conf.d/pi-hole.conf\n\t\n    server:\n    # If no logfile is specified, syslog is used\n    # logfile: \"/var/log/unbound/unbound.log\"\n    verbosity: 2\n\n    port: 5353\n    do-ip4: yes\n    do-udp: yes\n    do-tcp: yes\n\n    # May be set to yes if you have IPv6 connectivity\n    do-ip6: no\n\n    # Use this only when you downloaded the list of primary root servers!\n    root-hints: \"/var/lib/unbound/root.hints\"\n\n    # Trust glue only if it is within the servers authority\n    harden-glue: yes\n\n    # Require DNSSEC data for trust-anchored zones, if such data is absent, the zone becomes BOGUS\n    harden-dnssec-stripped: yes\n\n    # Don't use Capitalization randomization as it known to cause DNSSEC issues sometimes\n    # see https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378 for further details\n    use-caps-for-id: no\n\n    # Reduce EDNS reassembly buffer size.\n    # Suggested by the unbound man page to reduce fragmentation reassembly problems\n    edns-buffer-size: 1472\n\n    # Perform prefetching of close to expired message cache entries\n    # This only applies to domains that have been frequently queried\n    prefetch: yes\n    \n    # This attempts to reduce latency by serving the outdated record before\n    # updating it instead of the other way around. Alternative is to increase\n    # cache-min-ttl to e.g. 3600.\n    cache-min-ttl: 0\n    serve-expired: yes\n    # serve-expired-ttl: 3600 # 0 or not set means unlimited (I think)\n\n    # Use about 2x more for rrset cache, total memory use is about 2-2.5x\n    # total cache size. Current setting is way overkill for a small network.\n    # Judging from my used cache size you can get away with 8/16 and still\n    # have lots of room, but I've got the ram and I'm not using it on anything else.\n    # Default is 4m/4m\n    msg-cache-size: 128m\n    rrset-cache-size: 256m\n\n    # One thread should be sufficient, can be increased on beefy machines. In reality for most users running on small networks or on a single machine it should be unnecessary to seek performance enhancement by increasing num-threads above 1.\n    num-threads: 1\n\n    # Ensure kernel buffer is large enough to not lose messages in traffic spikes\n    so-rcvbuf: 1m\n\n    # Ensure privacy of local IP ranges\n    private-address: 192.168.0.0/16\n    private-address: 169.254.0.0/16\n    private-address: 172.16.0.0/12\n    private-address: 10.0.0.0/8\n    private-address: fd00::/8\n    private-address: fe80::/10\n    \nStart your local recursive DNS server (and test).\n\n\tsudo service unbound start\n\tdig pi-hole.net @127.0.0.1 -p 5353\n\n~~Create symbolic link to fix potential lighttpd breakage~~ [issues with Pi-hole on Debian Buster](https://github.com/pi-hole/pi-hole/issues/2557).\n*** This can be skipped, as it should now be resolved in the Latest Pi-hole v4.3.1 update. (Saturday, June 29, 2019) ***\n\n*[SKIP THIS PORTION (regarding lighttpd)]*\n\t\n\tcd /usr/share/lighttpd/\n\tsudo ln -s create-mime.conf.pl create-mime.assign.pl\n\nWireguard Routing, NAT and Firewall\n\n\tsudo iptables -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT\n\tsudo iptables -A INPUT -i eth0 -p tcp --dport 53 -j ACCEPT\n\tsudo iptables -A INPUT -i eth0 -p udp --dport 53 -j ACCEPT\n\tsudo iptables -A INPUT -i eth0 -p udp --dport 67 -j ACCEPT\n\tsudo iptables -A INPUT -i eth0 -p udp --dport 68 -j ACCEPT\n\tsudo netfilter-persistent save\n\tsudo netfilter-persistent reload\n\nEnable NAT\n\n\tsudo iptables -t nat -A POSTROUTING -o wg0 -j MASQUERADE\n\t\nAllow any traffic from eth0 (internal) to go over wg0 (point to point tunnel)\n\n\tsudo iptables -A FORWARD -i eth0 -o wg0 -j ACCEPT\n\nAllow RELATED, ESTABLISHED wg0 (point to point tunnel) traffic to (internal) eth0 network\n\n\tsudo iptables -A FORWARD -i wg0 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT\n\n\tsudo iptables -A INPUT -i lo -j ACCEPT\n\n\tsudo iptables -A INPUT -i eth0 -p icmp -j ACCEPT\n\n\tsudo iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT\n\n\tsudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT\n\n\tsudo iptables -P FORWARD DROP\n\tsudo iptables -P INPUT DROP\n\tsudo iptables -L\n\n\tsudo systemctl enable netfilter-persistent\n\tsudo netfilter-persistent reload\n\t\n[Convert IPtables to nftables](https://wiki.nftables.org/wiki-nftables/index.php/Moving_from_iptables_to_nftables) (v0.9.0-2)\n\t\n\tsudo apt install nftables\n\nAny untranslated rule(s) will be prefixed by a hash sign (#), as shown in the following example:\n\n\tiptables-translate -A INPUT -j CHECKSUM --checksum-fill\nnft # -A INPUT -j CHECKSUM --checksum-fill\n\n\tiptables-save \u003e rules.iptables\n\tiptables-restore-translate -f rules.iptables \u003e rules.nft\n\tnft -f rules.nft\n\tnft list ruleset\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fharrypnyce%2Fraspbian10-buster","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fharrypnyce%2Fraspbian10-buster","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fharrypnyce%2Fraspbian10-buster/lists"}