Unifi Pi-hole
Get the Pi-hole project working on my Unifi Security Gateway. Inspired by the blacklist project.
Installing
SSH into your USG and run these commands:
configure
delete service dns forwarding blacklist
set service dns forwarding blacklist dns-redirect-ip 0.0.0.0
edit service dns forwarding blacklist domains source unifi-pi-hole
set url https://github.com/ndfred/unifi-pi-hole/releases/download/v0.1.0/domains.txt
set description "Consolidated domains list from https://github.com/ndfred/unifi-pi-hole"
set prefix 0.0.0.0
top
edit service dns forwarding blacklist hosts source unifi-pi-hole
set url https://github.com/ndfred/unifi-pi-hole/releases/download/v0.1.0/hosts.txt
set description "Consolidated hosts list from https://github.com/ndfred/unifi-pi-hole"
set prefix 0.0.0.0
top
commit; save; exit
I have yet to work on refreshing the list automatically, but this should get you started.
Building the hosts list
Clone the repo and run the build_rules.py script to download and parse the rules files, and generate the hosts.txt and domains.txt files:
$ python build_rules.py
Parsing https://hosts-file.net/grm.txt
Parsing https://reddestdream.github.io/Projects/MinimalHosts/etc/MinimalHostsBlocker/minimalhosts
Parsing https://raw.githubusercontent.com/StevenBlack/hosts/master/data/KADhosts/hosts
[...]
Parsing https://zerodot1.gitlab.io/CoinBlockerLists/hosts
Wrote 735586 host names in hosts.txt and domains.txt
You can then publish the files on a web server or copy them directly to your Unifi Security Gateway.
The lists come from the Firebog website, which backs the Pi-hole setup script, and aggregates all the safe lists. I might support more advances lists with whitelisting in the future.
Testing 
Just run the test script:
$ python test_build_rules.py
...........
----------------------------------------------------------------------
Ran 11 tests in 0.186s
OK
Configuration reference
I SSH-ed into my USG, put myself in configuration mode, and queried completion suggestions to get to the documentation:
# set service dns forwarding blacklist
Possible completions:
disabled Option to disable blacklisting
dns-redirect-ip
Global redirect IP address for hosts and domains (zones)
domains Configure DNS forwarding blacklist DOMAINS
exclude domains to GLOBALLY EXCLUDE from DNS forwarding domains and hosts blacklist
hosts Configure DNS forwarding blacklist hosts (must be fully qualified domain names)
# set service dns forwarding blacklist domains
Possible completions:
dns-redirect-ip
Blackhole IP address for domains
exclude Domains to EXCLUDE from DNS forwarding blacklist
include Domains to INCLUDE in the DNS forwarding blacklist
source Blacklisted domains source name
# set service dns forwarding blacklist hosts
Possible completions:
dns-redirect-ip
Blackhole IP address for hosts - overrides global blackhole IP
exclude Hosts to EXCLUDE from DNS forwarding blacklist
include Hosts to INCLUDE in the DNS forwarding blacklist
source Blacklisted hosts source name
# set service dns forwarding blacklist domains source unifi-pi-hole
Possible completions:
description Blacklist domain source description
dns-redirect-ip
Blackhole IP address for a domain source - overrides global blackhole IP
file A path and filename that provides a list of domains to blacklist, e.g. /config/user-data/hacked_domains.txt
prefix Prefix string must include all text before the domain name
url A blacklist source url that provides a list of domain names to block
# set service dns forwarding blacklist exclude
Possible completions:
<text> domains to GLOBALLY EXCLUDE from DNS forwarding domains and hosts blacklist