Open-source Cisco Umbrella alternatives

Pi-hole is a DNS sinkhole that blocks unwanted content, mainly ads, for every device on your network without installing client-side software. You run it on your own Linux hardware, such as a Raspberry Pi, and point your network's DNS at it. The project is written mostly in shell script, and GitHub lists its license as 'Other'.

Because blocking happens at the DNS level, it also covers non-browser locations such as ad-heavy mobile apps and smart TVs, and it speeds up everyday browsing by caching DNS queries. It includes a command-line interface and a responsive web dashboard for viewing and controlling the instance, can optionally act as a DHCP server so all devices are protected automatically, and blocks over both IPv4 and IPv6.

An automated installer walks through setup in under ten minutes, and alternative methods allow reviewing the code first: cloning the repository, downloading the installer manually, or using the official Docker images. Pi-hole runs on modest hardware and, on server-grade machines, can handle very large query volumes. It suits home networks and small offices that want central ad and tracker blocking.

AdGuard Home is network-wide software for blocking ads and tracking. Once it is set up, it covers all devices on your home network without any client-side software. It works as a DNS server that redirects tracking and advertising domains to a black hole, so devices never connect to those servers. It is free and open source under the GPL-3.0 license.

The server is written mainly in Go with a TypeScript web interface, and it shares a lot of code with the public AdGuard DNS service. Encrypted DNS protocols are supported, including DNS-over-HTTPS, DNS-over-TLS, DNS-over-QUIC and DNSCrypt. Installation is done with an automated script for Linux, Unix, macOS, FreeBSD and OpenBSD, or manually following the wiki, and there is an HTTP API. The project documents how it differs from Pi-hole and from browser-based ad blockers.

Technitium DNS Server is an open-source DNS server that can act as both an authoritative and a recursive resolver. People host it themselves for privacy and security, and it works out of the box with little or no configuration. A friendly web console is reachable from any modern browser.

It can block ads and malware at the DNS level for an entire network. By forwarding queries over DNS-over-TLS, DNS-over-HTTPS or DNS-over-QUIC, it limits what an internet provider can see or tamper with. A local DNS server also gives logs and statistics for understanding network activity, serves many queries from cache, and allows network-wide domain blocking. Repository topics also mention DHCP server functions and DNS-over-Tor.

The server is written in C# on .NET and runs on Windows, Linux, macOS and Raspberry Pi, with Docker support. It is released under the GPL-3.0 license, and the project site at technitium.com provides downloads and documentation. It is suited to home networks and organizations that want more control over name resolution.

Blocky is a Go program that acts as a DNS proxy and ad blocker for local networks. It answers DNS queries for devices on the network and blocks unwanted domains using external lists for ads and malware, along with allowlists. It is a self-hosted alternative in the same space as Pi-hole.

Blocking rules can differ per client group, such as kids or smart home devices, and lists reload periodically. Blocky can inspect CNAME responses and IP addresses as well as request domains, and supports regular expressions. Beyond blocking it offers custom DNS resolution for chosen names, conditional forwarding, per-group upstream resolvers, caching with prefetching of frequent queries, DNS over HTTPS, TLS, QUIC and HTTP/3, DNSSEC validation, Prometheus metrics and Grafana dashboards.

Blocky is licensed under Apache-2.0. According to its README it collects no user data, telemetry or statistics, and it uses a low memory footprint, which makes it practical to run on small home servers.

OPNsense is an open-source firewall project, and this repository contains its web GUI, API and systems backend. Its topics point to a broad feature set that includes a firewall, intrusion prevention, proxy, VPN, traffic shaping, a captive portal and routing, built on a BSD base.

The project invites developers to contribute and has designed its build process so that anyone can build and write code. Build tools are freely available in a separate tools repository, an architecture overview is on docs.opnsense.org, and the repository offers Makefile targets such as make package for assembling a package from the current state of the code. The team aims to evolve toward a new codebase gradually rather than in one big switch.

OPNsense is written mostly in PHP and is committed to staying available under the 2-clause BSD license, with every contribution required to carry the same terms. Contributions can be as simple as testing functionality, filing bug reports or sending pull requests.

pfSense is a network firewall distribution built on the FreeBSD operating system. It uses a custom kernel and bundles third-party free software to cover routing and security tasks. The project began in 2004 as a fork of the m0n0wall project and has since diverged significantly.

All components are configured through a web interface, so the project says no UNIX knowledge or command-line work is needed and rule sets never have to be edited by hand. A package system adds functionality, and the project states that with packages it can match or exceed the functionality of common commercial firewalls, without artificial limits. It lists products from Check Point, Cisco, Juniper, Sonicwall, Netgear and Watchguard among those it has replaced.

pfSense is copyright Rubicon Communications (Netgate) and published under an open source license, listed as Apache-2.0 on GitHub. Netgate sells bundled hardware appliances and commercial support, which is the main way the team funds development. Administrators used to commercial firewalls may find the interface familiar, though others face a learning curve.