[{"data":1,"prerenderedAt":1346},["ShallowReactive",2],{"post-how-to-configure-pi-hole-and-mullvad-on-a-raspberry-pi-es":3,"related-posts-how-to-configure-pi-hole-and-mullvad-on-a-raspberry-pi-es":1344,"related-categories-how-to-configure-pi-hole-and-mullvad-on-a-raspberry-pi-es":1345},{"id":4,"title":5,"author":6,"authorImageUrl":7,"authorUrl":8,"body":9,"categorySlug":1308,"categoryText":1309,"dateModified":1310,"datePublished":1310,"description":1311,"extension":1312,"faqs":1313,"image":1335,"language":1336,"meta":1337,"navigation":1338,"path":1339,"seo":1340,"sitemap":1341,"stem":1342,"__hash__":1343},"blog\u002Fes\u002Fblog\u002Fhow-to-configure-pi-hole-and-mullvad-on-a-raspberry-pi.md","Cómo usar Pi-hole y Mullvad VPN en una Raspberry Pi","Bruma","\u002Fimages\u002Fauthors\u002Fbruma.jpg","https:\u002F\u002Fbrumaombra.com",{"type":10,"value":11,"toc":1270},"minimark",[12,17,21,24,27,44,47,51,54,59,67,76,84,88,95,101,104,107,109,113,116,119,121,125,128,137,141,167,175,178,182,185,198,202,205,249,253,273,277,280,296,304,307,309,313,317,320,358,366,370,373,396,402,405,411,420,426,433,439,450,458,462,465,480,488,497,499,503,506,513,515,519,534,538,563,571,575,586,604,608,626,647,654,672,680,683,699,703,706,710,713,728,740,744,759,767,778,798,801,834,837,849,857,861,931,962,965,983,991,997,1012,1020,1024,1027,1030,1034,1037,1050,1057,1069,1072,1085,1088,1091,1104,1112,1115,1126,1134,1136,1140,1149,1157,1161,1164,1168,1183,1187,1190,1194,1201,1204,1211,1222,1226,1229,1234,1237,1241,1244,1248,1251,1254,1256,1260,1263,1266],[13,14,16],"h2",{"id":15},"introducción","Introducción",[18,19,20],"p",{},"¿Te preocupa que tu proveedor de Internet pueda espiarte y leer todo el tráfico de tu red doméstica? ¿Estás cansado de ver anuncios por todas partes? ¿O simplemente no te gusta que una empresa cualquiera pueda ver y rastrear cada movimiento del ratón y cada pulsación mientras navegas?",[18,22,23],{},"Si esas son algunas de tus preocupaciones, estás en el lugar adecuado.",[18,25,26],{},"En esta guía práctica y sencilla configuraremos un bloqueador de anuncios y rastreadores para toda la red, creando una especie de escudo digital entre tú, tu proveedor y las empresas de analítica.",[18,28,29,30,37,38,43],{},"Usaremos ",[31,32,36],"a",{"href":33,"rel":34},"https:\u002F\u002Fpi-hole.net\u002F",[35],"nofollow","Pi-hole"," (un sistema de filtrado DNS muy popular) para bloquear anuncios y rastreadores, y ",[31,39,42],{"href":40,"rel":41},"https:\u002F\u002Fmullvad.net\u002F",[35],"Mullvad VPN"," (un proveedor VPN muy respetuoso con la privacidad) para ocultar tu tráfico web al proveedor.",[45,46],"hr",{},[13,48,50],{"id":49},"qué-necesitamos","Qué necesitamos",[18,52,53],{},"Empecemos enumerando lo necesario para hacer nuestra red doméstica o de oficina más segura y privada.",[55,56,58],"h3",{"id":57},"raspberry-pi","Raspberry Pi",[18,60,61,62,66],{},"El elemento principal es la ",[31,63,58],{"href":64,"rel":65},"https:\u002F\u002Fwww.raspberrypi.com\u002F",[35],", un pequeño ordenador muy conocido que permite probar proyectos en casa sin un servidor caro. Su CPU ARM y su memoria son suficientes para nuestro escudo de red.",[18,68,69],{},[70,71],"img",{"alt":72,"height":73,"src":74,"width":75},"Descripción general de Raspberry Pi",941,"\u002Fimages\u002Fblog\u002Fpi-hole-and-mullvad\u002Fraspberry-pi-description.png",1672,[18,77,29,78,83],{},[31,79,82],{"href":80,"rel":81},"https:\u002F\u002Fwww.raspberrypi.com\u002Fsoftware\u002F",[35],"Raspberry Pi OS",", en concreto la versión Lite sin interfaz gráfica. Recomiendo la variante de 4 GB u 8 GB, aunque la instalación utilizará mucho menos. También conviene conocer lo básico del terminal y de las conexiones SSH.",[55,85,87],{"id":86},"mullvad","Mullvad",[18,89,90,91,94],{},"Necesitaremos una cuenta de ",[92,93,87],"strong",{},". Es un proveedor VPN popular y centrado en la privacidad, y ni siquiera exige una dirección de correo: al registrarte recibes un número de cuenta aleatorio. Tampoco necesitas contraseña.",[18,96,97],{},[70,98],{"alt":99,"height":73,"src":100,"width":75},"Descripción general de Mullvad VPN","\u002Fimages\u002Fblog\u002Fpi-hole-and-mullvad\u002Fmullvad-vpn-description.png",[18,102,103],{},"Mullvad aplica una política estricta de no guardar registros: no conserva historial de tráfico, consultas DNS, horas de conexión, direcciones IP ni uso de ancho de banda. Es una excelente opción para mantener el tráfico lejos del proveedor y evitar otro registro detallado de tu actividad.",[18,105,106],{},"Elegí Mullvad por esto y por su compromiso con la libertad de expresión y una Internet abierta.",[45,108],{},[13,110,112],{"id":111},"_1-preparar-la-raspberry-pi","1. Preparar la Raspberry Pi",[18,114,115],{},"No explicaremos cómo instalar y grabar el sistema operativo; iremos directamente a la configuración de red. Hay muchas guías detalladas disponibles en Internet.",[18,117,118],{},"Empecemos configurando la dirección IP de la Pi.",[45,120],{},[13,122,124],{"id":123},"_2-establecer-una-ip-estática","2. Establecer una IP estática",[18,126,127],{},"Para usar la Raspberry Pi como servidor DNS (Pi-hole) y puerta de enlace (Mullvad), necesitamos una IP estática. Normalmente el router asigna una dirección mediante DHCP, pero esa dirección puede cambiar y hacer que los demás dispositivos pierdan la Pi.",[18,129,130,131,136],{},"Por eso fijaremos una dirección permanente. Para cambiar la red usaremos ",[31,132,135],{"href":133,"rel":134},"https:\u002F\u002Fnetworkmanager.dev\u002F",[35],"NetworkManager",".",[55,138,140],{"id":139},"enumerar-las-interfaces-de-red","Enumerar las interfaces de red",[142,143,148],"pre",{"className":144,"code":145,"language":146,"meta":147,"style":147},"language-bash shiki shiki-themes github-light github-dark","nmcli con show\n","bash","",[149,150,151],"code",{"__ignoreMap":147},[152,153,156,160,164],"span",{"class":154,"line":155},"line",1,[152,157,159],{"class":158},"sScJk","nmcli",[152,161,163],{"class":162},"sZZnC"," con",[152,165,166],{"class":162}," show\n",[18,168,169],{},[70,170],{"alt":171,"height":172,"src":173,"width":174},"Lista de conexiones de NetworkManager",418,"\u002Fimages\u002Fblog\u002Fpi-hole-and-mullvad\u002Fcheck-networks.png",1024,[18,176,177],{},"En mi caso, la conexión se llama netplan-eth0 y el dispositivo eth0.",[55,179,181],{"id":180},"configurarla-con-la-interfaz-de-texto","Configurarla con la interfaz de texto",[18,183,184],{},"Puedes usar la interfaz sencilla o la línea de comandos. Para abrir la interfaz:",[142,186,188],{"className":144,"code":187,"language":146,"meta":147,"style":147},"sudo nmtui\n",[149,189,190],{"__ignoreMap":147},[152,191,192,195],{"class":154,"line":155},[152,193,194],{"class":158},"sudo",[152,196,197],{"class":162}," nmtui\n",[55,199,201],{"id":200},"o-configurarla-desde-la-línea-de-comandos","O configurarla desde la línea de comandos",[18,203,204],{},"Recomiendo este método porque es más rápido. Sustituye los nombres y direcciones por los de tu red.",[142,206,208],{"className":144,"code":207,"language":146,"meta":147,"style":147},"sudo nmcli con mod netplan-eth0 ipv4.addresses \"192.168.21.82\u002F24\" ipv4.gateway \"192.168.21.1\" ipv4.dns \"192.168.21.1,1.1.1.1\" ipv4.method manual\n",[149,209,210],{"__ignoreMap":147},[152,211,212,214,217,219,222,225,228,231,234,237,240,243,246],{"class":154,"line":155},[152,213,194],{"class":158},[152,215,216],{"class":162}," nmcli",[152,218,163],{"class":162},[152,220,221],{"class":162}," mod",[152,223,224],{"class":162}," netplan-eth0",[152,226,227],{"class":162}," ipv4.addresses",[152,229,230],{"class":162}," \"192.168.21.82\u002F24\"",[152,232,233],{"class":162}," ipv4.gateway",[152,235,236],{"class":162}," \"192.168.21.1\"",[152,238,239],{"class":162}," ipv4.dns",[152,241,242],{"class":162}," \"192.168.21.1,1.1.1.1\"",[152,244,245],{"class":162}," ipv4.method",[152,247,248],{"class":162}," manual\n",[55,250,252],{"id":251},"aplicar-los-cambios","Aplicar los cambios",[142,254,256],{"className":144,"code":255,"language":146,"meta":147,"style":147},"sudo nmcli device reapply eth0\n",[149,257,258],{"__ignoreMap":147},[152,259,260,262,264,267,270],{"class":154,"line":155},[152,261,194],{"class":158},[152,263,216],{"class":162},[152,265,266],{"class":162}," device",[152,268,269],{"class":162}," reapply",[152,271,272],{"class":162}," eth0\n",[55,274,276],{"id":275},"verificar-la-interfaz","Verificar la interfaz",[18,278,279],{},"Comprueba que dirección, puerta de enlace y DNS coinciden con los valores configurados.",[142,281,283],{"className":144,"code":282,"language":146,"meta":147,"style":147},"nmcli device show eth0\n",[149,284,285],{"__ignoreMap":147},[152,286,287,289,291,294],{"class":154,"line":155},[152,288,159],{"class":158},[152,290,266],{"class":162},[152,292,293],{"class":162}," show",[152,295,272],{"class":162},[18,297,298],{},[70,299],{"alt":300,"height":301,"src":302,"width":303},"Detalles de la interfaz de NetworkManager",483,"\u002Fimages\u002Fblog\u002Fpi-hole-and-mullvad\u002Fcheck-network-info.png",1086,[18,305,306],{},"La Raspberry Pi ya tiene una IP estática. Si estás conectado por SSH, la conexión puede cortarse; vuelve a conectarte usando la nueva dirección.",[45,308],{},[13,310,312],{"id":311},"_3-instalar-pi-hole","3. Instalar Pi-hole",[55,314,316],{"id":315},"actualizar-primero-el-sistema","Actualizar primero el sistema",[18,318,319],{},"Actualiza el sistema y los paquetes para disponer de los últimos parches de seguridad y reinicia la Pi.",[142,321,323],{"className":144,"code":322,"language":146,"meta":147,"style":147},"sudo apt update && sudo apt full-upgrade -y\nsudo reboot\n",[149,324,325,350],{"__ignoreMap":147},[152,326,327,329,332,335,339,341,343,346],{"class":154,"line":155},[152,328,194],{"class":158},[152,330,331],{"class":162}," apt",[152,333,334],{"class":162}," update",[152,336,338],{"class":337},"sVt8B"," && ",[152,340,194],{"class":158},[152,342,331],{"class":162},[152,344,345],{"class":162}," full-upgrade",[152,347,349],{"class":348},"sj4cs"," -y\n",[152,351,353,355],{"class":154,"line":352},2,[152,354,194],{"class":158},[152,356,357],{"class":162}," reboot\n",[18,359,360],{},[70,361],{"alt":362,"height":363,"src":364,"width":365},"Actualización del sistema de Raspberry Pi",1197,"\u002Fimages\u002Fblog\u002Fpi-hole-and-mullvad\u002Fupdate-system.png",2371,[55,367,369],{"id":368},"instalar-pi-hole","Instalar Pi-hole",[18,371,372],{},"Usaremos el instalador oficial de un solo paso. Si quieres revisar lo que ejecutará, examina antes el script.",[142,374,376],{"className":144,"code":375,"language":146,"meta":147,"style":147},"curl -sSL https:\u002F\u002Finstall.pi-hole.net | bash\n",[149,377,378],{"__ignoreMap":147},[152,379,380,383,386,389,393],{"class":154,"line":155},[152,381,382],{"class":158},"curl",[152,384,385],{"class":348}," -sSL",[152,387,388],{"class":162}," https:\u002F\u002Finstall.pi-hole.net",[152,390,392],{"class":391},"szBVR"," |",[152,394,395],{"class":158}," bash\n",[18,397,398],{},[70,399],{"alt":400,"height":363,"src":401,"width":365},"Pantalla de bienvenida del instalador de Pi-hole","\u002Fimages\u002Fblog\u002Fpi-hole-and-mullvad\u002Fpi-hole-installer.png",[18,403,404],{},"El instalador mostrará varias pantallas. Confirma primero la IP estática y pulsa Continue.",[18,406,407],{},[70,408],{"alt":409,"height":363,"src":410,"width":365},"Selección de interfaz del instalador de Pi-hole","\u002Fimages\u002Fblog\u002Fpi-hole-and-mullvad\u002Fpi-hole-installer-2.png",[18,412,413,414,419],{},"Selecciona ",[31,415,418],{"href":416,"rel":417},"https:\u002F\u002Fwww.cloudflare.com\u002F",[35],"Cloudflare"," como DNS ascendente por ahora; lo cambiaremos cuando funcione Mullvad.",[18,421,422],{},[70,423],{"alt":424,"height":363,"src":425,"width":365},"Selección del DNS ascendente de Pi-hole","\u002Fimages\u002Fblog\u002Fpi-hole-and-mullvad\u002Fpi-hole-installer-3.png",[18,427,428,429,432],{},"Confirma la lista ",[92,430,431],{},"StevenBlack Unified Hosts",", que bloquea dominios conocidos de publicidad y seguimiento.",[18,434,435],{},[70,436],{"alt":437,"height":363,"src":438,"width":365},"Instalación de Pi-hole completada","\u002Fimages\u002Fblog\u002Fpi-hole-and-mullvad\u002Fpi-hole-installer-4.png",[18,440,441,442,445,446,136],{},"La instalación ya está completa. Guarda el enlace y la contraseña del panel: normalmente ",[92,443,444],{},"http:\u002F\u002F\u003Cpi-ip>\u002Fadmin"," o ",[31,447,448],{"href":448,"rel":449},"http:\u002F\u002Fpi.hole\u002Fadmin",[35],[18,451,452],{},[70,453],{"alt":454,"height":455,"src":456,"width":457},"Inicio de sesión de la interfaz web de Pi-hole",1438,"\u002Fimages\u002Fblog\u002Fpi-hole-and-mullvad\u002Fpi-hole-web-interface.jpg",2004,[55,459,461],{"id":460},"establecer-una-contraseña-nueva","Establecer una contraseña nueva",[18,463,464],{},"Puedes cambiar la contraseña generada automáticamente desde la terminal. Usa una contraseña segura que no reutilices en otro servicio.",[142,466,468],{"className":144,"code":467,"language":146,"meta":147,"style":147},"sudo pihole setpassword\n",[149,469,470],{"__ignoreMap":147},[152,471,472,474,477],{"class":154,"line":155},[152,473,194],{"class":158},[152,475,476],{"class":162}," pihole",[152,478,479],{"class":162}," setpassword\n",[18,481,482],{},[70,483],{"alt":484,"height":485,"src":486,"width":487},"Panel de Pi-hole",1921,"\u002Fimages\u002Fblog\u002Fpi-hole-and-mullvad\u002Fpi-hole-web-interface-2.jpg",1914,[18,489,490,491,496],{},"Ya tenemos un bloqueador de anuncios y rastreadores para toda la red. Consulta ",[31,492,495],{"href":493,"rel":494},"https:\u002F\u002Fdocs.pi-hole.net\u002Fmain\u002Fbasic-install\u002F",[35],"la documentación oficial"," para saber más.",[45,498],{},[13,500,502],{"id":501},"_4-configurar-el-dns-de-la-red","4. Configurar el DNS de la red",[18,504,505],{},"Pi-hole solo filtra las consultas DNS que recibe. Para aplicar el filtrado a toda la red, configura el DHCP del router para distribuir la IP de la Raspberry Pi como DNS principal. Renueva después la concesión o reconecta los clientes y comprueba que la Pi aparece como DNS.",[18,507,508,509,512],{},"Si el router no permite cambiar el DNS por DHCP, configúralo manualmente en cada dispositivo. También puedes configurar la Pi para usar Pi-hole mediante ",[92,510,511],{},"\u002Fetc\u002Fdhcpcd.conf"," o NetworkManager, con cuidado: una configuración incorrecta puede romper la conectividad.",[45,514],{},[13,516,518],{"id":517},"_5-instalar-wireguard-y-mullvad","5. Instalar WireGuard y Mullvad",[18,520,521,522,527,528,530,531,533],{},"Cuando Pi-hole funcione, instala ",[31,523,526],{"href":524,"rel":525},"https:\u002F\u002Fwww.wireguard.com\u002F",[35],"WireGuard",". ",[92,529,526],{}," crea un túnel VPN cifrado, ligero y rápido entre la Pi y un servidor. ",[92,532,87],{}," proporciona los archivos de configuración; WireGuard los lee, conecta con Mullvad y dirige por el túnel el tráfico de Internet de la Pi, mientras Pi-hole filtra el DNS.",[55,535,537],{"id":536},"instalar-wireguard","Instalar WireGuard",[142,539,541],{"className":144,"code":540,"language":146,"meta":147,"style":147},"sudo apt install wireguard wireguard-tools resolvconf -y\n",[149,542,543],{"__ignoreMap":147},[152,544,545,547,549,552,555,558,561],{"class":154,"line":155},[152,546,194],{"class":158},[152,548,331],{"class":162},[152,550,551],{"class":162}," install",[152,553,554],{"class":162}," wireguard",[152,556,557],{"class":162}," wireguard-tools",[152,559,560],{"class":162}," resolvconf",[152,562,349],{"class":348},[18,564,565],{},[70,566],{"alt":567,"height":568,"src":569,"width":570},"Instalación de WireGuard",976,"\u002Fimages\u002Fblog\u002Fpi-hole-and-mullvad\u002Fwireguard-installer.png",1924,[55,572,574],{"id":573},"configurar-wireguard","Configurar WireGuard",[18,576,577,578,581,582,585],{},"Descarga desde tu cuenta Mullvad una configuración para WireGuard y Linux, elige un servidor y guárdala como ",[92,579,580],{},"mullvad.conf"," en ",[92,583,584],{},"\u002Fetc\u002Fwireguard",". Protege la clave privada:",[142,587,589],{"className":144,"code":588,"language":146,"meta":147,"style":147},"sudo chmod 600 \u002Fetc\u002Fwireguard\u002Fmullvad.conf\n",[149,590,591],{"__ignoreMap":147},[152,592,593,595,598,601],{"class":154,"line":155},[152,594,194],{"class":158},[152,596,597],{"class":162}," chmod",[152,599,600],{"class":348}," 600",[152,602,603],{"class":162}," \u002Fetc\u002Fwireguard\u002Fmullvad.conf\n",[55,605,607],{"id":606},"iniciar-y-verificar-el-túnel","Iniciar y verificar el túnel",[142,609,611],{"className":144,"code":610,"language":146,"meta":147,"style":147},"sudo wg-quick up mullvad\n",[149,612,613],{"__ignoreMap":147},[152,614,615,617,620,623],{"class":154,"line":155},[152,616,194],{"class":158},[152,618,619],{"class":162}," wg-quick",[152,621,622],{"class":162}," up",[152,624,625],{"class":162}," mullvad\n",[142,627,629],{"className":144,"code":628,"language":146,"meta":147,"style":147},"sudo wg show\ncurl https:\u002F\u002Fam.i.mullvad.net\u002Fconnected\n",[149,630,631,640],{"__ignoreMap":147},[152,632,633,635,638],{"class":154,"line":155},[152,634,194],{"class":158},[152,636,637],{"class":162}," wg",[152,639,166],{"class":162},[152,641,642,644],{"class":154,"line":352},[152,643,382],{"class":158},[152,645,646],{"class":162}," https:\u002F\u002Fam.i.mullvad.net\u002Fconnected\n",[18,648,649,650,653],{},"Deberías ver ",[92,651,652],{},"\"You are connected to Mullvad\"",", el servidor y su IP pública. Activa el inicio automático:",[142,655,657],{"className":144,"code":656,"language":146,"meta":147,"style":147},"sudo systemctl enable wg-quick@mullvad\n",[149,658,659],{"__ignoreMap":147},[152,660,661,663,666,669],{"class":154,"line":155},[152,662,194],{"class":158},[152,664,665],{"class":162}," systemctl",[152,667,668],{"class":162}," enable",[152,670,671],{"class":162}," wg-quick@mullvad\n",[18,673,674],{},[70,675],{"alt":676,"height":677,"src":678,"width":679},"Servicio WireGuard activado",318,"\u002Fimages\u002Fblog\u002Fpi-hole-and-mullvad\u002Fwireguard-installer-2.png",1605,[18,681,682],{},"Para detenerlo durante las pruebas:",[142,684,686],{"className":144,"code":685,"language":146,"meta":147,"style":147},"sudo wg-quick down mullvad\n",[149,687,688],{"__ignoreMap":147},[152,689,690,692,694,697],{"class":154,"line":155},[152,691,194],{"class":158},[152,693,619],{"class":162},[152,695,696],{"class":162}," down",[152,698,625],{"class":162},[55,700,702],{"id":701},"dirigir-el-tráfico-por-mullvad","Dirigir el tráfico por Mullvad",[18,704,705],{},"La Pi ya usa Mullvad, pero para otros dispositivos debe reenviar y enmascarar el tráfico. Supondremos que:",[707,708],"blog-list",{":items":709},"[\"La interfaz LAN es eth0.\",\"La interfaz WireGuard de Mullvad es mullvad porque el archivo se llama mullvad.conf.\",\"La dirección LAN de la Raspberry Pi es 192.168.21.82.\"]",[18,711,712],{},"Sustituye los valores de ejemplo por los tuyos. Comprueba los nombres con:",[142,714,716],{"className":144,"code":715,"language":146,"meta":147,"style":147},"ip link show\n",[149,717,718],{"__ignoreMap":147},[152,719,720,723,726],{"class":154,"line":155},[152,721,722],{"class":158},"ip",[152,724,725],{"class":162}," link",[152,727,166],{"class":162},[18,729,730,731,734,735,737,738,136],{},"Si la interfaz se llama ",[92,732,733],{},"wg0",", sustituye ",[92,736,86],{}," por ",[92,739,733],{},[55,741,743],{"id":742},"activar-el-reenvío-ipv4","Activar el reenvío IPv4",[142,745,747],{"className":144,"code":746,"language":146,"meta":147,"style":147},"sudo sysctl net.ipv4.ip_forward\n",[149,748,749],{"__ignoreMap":147},[152,750,751,753,756],{"class":154,"line":155},[152,752,194],{"class":158},[152,754,755],{"class":162}," sysctl",[152,757,758],{"class":162}," net.ipv4.ip_forward\n",[18,760,761],{},[70,762],{"alt":763,"height":764,"src":765,"width":766},"Reenvío IPv4 desactivado",201,"\u002Fimages\u002Fblog\u002Fpi-hole-and-mullvad\u002Fwireguard-installer-3.png",789,[18,768,769,770,773,774,777],{},"El valor debe ser ",[92,771,772],{},"1",". Si es ",[92,775,776],{},"0",", actívalo:",[142,779,781],{"className":144,"code":780,"language":146,"meta":147,"style":147},"sudo sysctl -w net.ipv4.ip_forward=1\n",[149,782,783],{"__ignoreMap":147},[152,784,785,787,789,792,795],{"class":154,"line":155},[152,786,194],{"class":158},[152,788,755],{"class":162},[152,790,791],{"class":348}," -w",[152,793,794],{"class":162}," net.ipv4.ip_forward=",[152,796,797],{"class":348},"1\n",[18,799,800],{},"Hazlo permanente:",[142,802,804],{"className":144,"code":803,"language":146,"meta":147,"style":147},"echo 'net.ipv4.ip_forward=1' | sudo tee \u002Fetc\u002Fsysctl.d\u002F99-router.conf\nsudo sysctl --system\n",[149,805,806,825],{"__ignoreMap":147},[152,807,808,811,814,816,819,822],{"class":154,"line":155},[152,809,810],{"class":348},"echo",[152,812,813],{"class":162}," 'net.ipv4.ip_forward=1'",[152,815,392],{"class":391},[152,817,818],{"class":158}," sudo",[152,820,821],{"class":162}," tee",[152,823,824],{"class":162}," \u002Fetc\u002Fsysctl.d\u002F99-router.conf\n",[152,826,827,829,831],{"class":154,"line":352},[152,828,194],{"class":158},[152,830,755],{"class":162},[152,832,833],{"class":348}," --system\n",[18,835,836],{},"Comprueba de nuevo:",[142,838,839],{"className":144,"code":746,"language":146,"meta":147,"style":147},[149,840,841],{"__ignoreMap":147},[152,842,843,845,847],{"class":154,"line":155},[152,844,194],{"class":158},[152,846,755],{"class":162},[152,848,758],{"class":162},[18,850,851],{},[70,852],{"alt":853,"height":854,"src":855,"width":856},"Reenvío IPv4 activado",243,"\u002Fimages\u002Fblog\u002Fpi-hole-and-mullvad\u002Fwireguard-installer-4.png",747,[55,858,860],{"id":859},"permitir-el-reenvío-y-añadir-nat","Permitir el reenvío y añadir NAT",[142,862,864],{"className":144,"code":863,"language":146,"meta":147,"style":147},"sudo iptables -A FORWARD -i eth0 -o mullvad -j ACCEPT\nsudo iptables -A FORWARD -i mullvad -o eth0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT\n",[149,865,866,897],{"__ignoreMap":147},[152,867,868,870,873,876,879,882,885,888,891,894],{"class":154,"line":155},[152,869,194],{"class":158},[152,871,872],{"class":162}," iptables",[152,874,875],{"class":348}," -A",[152,877,878],{"class":162}," FORWARD",[152,880,881],{"class":348}," -i",[152,883,884],{"class":162}," eth0",[152,886,887],{"class":348}," -o",[152,889,890],{"class":162}," mullvad",[152,892,893],{"class":348}," -j",[152,895,896],{"class":162}," ACCEPT\n",[152,898,899,901,903,905,907,909,911,913,915,918,921,924,927,929],{"class":154,"line":352},[152,900,194],{"class":158},[152,902,872],{"class":162},[152,904,875],{"class":348},[152,906,878],{"class":162},[152,908,881],{"class":348},[152,910,890],{"class":162},[152,912,887],{"class":348},[152,914,884],{"class":162},[152,916,917],{"class":348}," -m",[152,919,920],{"class":162}," conntrack",[152,922,923],{"class":348}," --ctstate",[152,925,926],{"class":162}," ESTABLISHED,RELATED",[152,928,893],{"class":348},[152,930,896],{"class":162},[142,932,934],{"className":144,"code":933,"language":146,"meta":147,"style":147},"sudo iptables -t nat -A POSTROUTING -o mullvad -j MASQUERADE\n",[149,935,936],{"__ignoreMap":147},[152,937,938,940,942,945,948,950,953,955,957,959],{"class":154,"line":155},[152,939,194],{"class":158},[152,941,872],{"class":162},[152,943,944],{"class":348}," -t",[152,946,947],{"class":162}," nat",[152,949,875],{"class":348},[152,951,952],{"class":162}," POSTROUTING",[152,954,887],{"class":348},[152,956,890],{"class":162},[152,958,893],{"class":348},[152,960,961],{"class":162}," MASQUERADE\n",[18,963,964],{},"Guarda las reglas para que sobrevivan al reinicio:",[142,966,968],{"className":144,"code":967,"language":146,"meta":147,"style":147},"sudo apt install iptables-persistent -y\n",[149,969,970],{"__ignoreMap":147},[152,971,972,974,976,978,981],{"class":154,"line":155},[152,973,194],{"class":158},[152,975,331],{"class":162},[152,977,551],{"class":162},[152,979,980],{"class":162}," iptables-persistent",[152,982,349],{"class":348},[18,984,985],{},[70,986],{"alt":987,"height":988,"src":989,"width":990},"Configuración IPv4 guardada",841,"\u002Fimages\u002Fblog\u002Fpi-hole-and-mullvad\u002Fwireguard-installer-5.png",1719,[18,992,993],{},[70,994],{"alt":995,"height":988,"src":996,"width":990},"Configuración IPv6 guardada","\u002Fimages\u002Fblog\u002Fpi-hole-and-mullvad\u002Fwireguard-installer-6.png",[142,998,1000],{"className":144,"code":999,"language":146,"meta":147,"style":147},"sudo netfilter-persistent save\n",[149,1001,1002],{"__ignoreMap":147},[152,1003,1004,1006,1009],{"class":154,"line":155},[152,1005,194],{"class":158},[152,1007,1008],{"class":162}," netfilter-persistent",[152,1010,1011],{"class":162}," save\n",[18,1013,1014],{},[70,1015],{"alt":1016,"height":1017,"src":1018,"width":1019},"Reglas de firewall persistentes",594,"\u002Fimages\u002Fblog\u002Fpi-hole-and-mullvad\u002Fwireguard-installer-7.png",1272,[55,1021,1023],{"id":1022},"configurar-los-dispositivos-de-red","Configurar los dispositivos de red",[18,1025,1026],{},"Configura todos los dispositivos con estos valores:",[707,1028],{":items":1029},"[\"Una IP en la misma LAN que la Raspberry Pi.\",\"La IP de la Raspberry Pi como puerta de enlace predeterminada.\",\"La IP de la Raspberry Pi como servidor DNS.\"]",[55,1031,1033],{"id":1032},"probar-la-ruta-por-etapas","Probar la ruta por etapas",[18,1035,1036],{},"Comprueba primero la Pi:",[142,1038,1040],{"className":144,"code":1039,"language":146,"meta":147,"style":147},"ping 192.168.21.82\n",[149,1041,1042],{"__ignoreMap":147},[152,1043,1044,1047],{"class":154,"line":155},[152,1045,1046],{"class":158},"ping",[152,1048,1049],{"class":348}," 192.168.21.82\n",[18,1051,1052,1053,1056],{},"Después prueba el servidor DNS de Cloudflare ",[92,1054,1055],{},"1.1.1.1",":",[142,1058,1060],{"className":144,"code":1059,"language":146,"meta":147,"style":147},"ping 1.1.1.1\n",[149,1061,1062],{"__ignoreMap":147},[152,1063,1064,1066],{"class":154,"line":155},[152,1065,1046],{"class":158},[152,1067,1068],{"class":348}," 1.1.1.1\n",[18,1070,1071],{},"Y finalmente una resolución DNS:",[142,1073,1075],{"className":144,"code":1074,"language":146,"meta":147,"style":147},"nslookup example.com\n",[149,1076,1077],{"__ignoreMap":147},[152,1078,1079,1082],{"class":154,"line":155},[152,1080,1081],{"class":158},"nslookup",[152,1083,1084],{"class":162}," example.com\n",[18,1086,1087],{},"Si falla algo:",[707,1089],{":items":1090},"[\"Si falla la primera prueba, revisa la red y la puerta de enlace del PC.\",\"Si la primera funciona pero falla 1.1.1.1, revisa el reenvío IPv4, NAT y el firewall de Mullvad.\",\"Si funciona la IP pública pero falla DNS, comprueba que Pi-hole escucha en la LAN y que el PC lo usa como DNS.\"]",[142,1092,1094],{"className":144,"code":1093,"language":146,"meta":147,"style":147},"sudo wg show\n",[149,1095,1096],{"__ignoreMap":147},[152,1097,1098,1100,1102],{"class":154,"line":155},[152,1099,194],{"class":158},[152,1101,637],{"class":162},[152,1103,166],{"class":162},[18,1105,1106],{},[70,1107],{"alt":1108,"height":1109,"src":1110,"width":1111},"Comprobación del tráfico de Mullvad",690,"\u002Fimages\u002Fblog\u002Fpi-hole-and-mullvad\u002Fraspberry-mullvad-traffic.png",1288,[18,1113,1114],{},"Los contadores deben aumentar. Comprueba la dirección pública desde el PC:",[142,1116,1118],{"className":144,"code":1117,"language":146,"meta":147,"style":147},"curl https:\u002F\u002Fam.i.mullvad.net\u002Fconnected\n",[149,1119,1120],{"__ignoreMap":147},[152,1121,1122,1124],{"class":154,"line":155},[152,1123,382],{"class":158},[152,1125,646],{"class":162},[18,1127,1128],{},[70,1129],{"alt":1130,"height":1131,"src":1132,"width":1133},"Salida del comando de conexión de Mullvad",588,"\u002Fimages\u002Fblog\u002Fpi-hole-and-mullvad\u002Fcmd-mullvad-check.png",1357,[45,1135],{},[13,1137,1139],{"id":1138},"_6-comprobar-si-estamos-realmente-protegidos","6. Comprobar si estamos realmente protegidos",[18,1141,1142,1143,1148],{},"Abre la ",[31,1144,1147],{"href":1145,"rel":1146},"https:\u002F\u002Fmullvad.net\u002Fcheck",[35],"comprobación de conexión de Mullvad"," y revisa la IP de salida y los resolvedores DNS.",[18,1150,1151],{},[70,1152],{"alt":1153,"height":1154,"src":1155,"width":1156},"Comprobación de conexión de Mullvad",1317,"\u002Fimages\u002Fblog\u002Fpi-hole-and-mullvad\u002Fmullvad-check.jpg",2383,[55,1158,1160],{"id":1159},"qué-significa-el-resultado","Qué significa el resultado",[18,1162,1163],{},"Si todo está verde, está bien; las secciones rojas indican un problema.",[707,1165],{":items":1166,"variant":1167},"[\"Si la IP de salida pertenece a Mullvad, como **it-mil-wg-001** en Milán, el tráfico pasa correctamente por Mullvad.\",\"Si los resolvedores son direcciones de Cloudflare como **172.70.x.x**, **1.1.1.1** o su IPv6 equivalente, Pi-hole reenvía el DNS a Cloudflare.\"]","circle",[18,1169,1170,1171,1174,1175,1178,1179,1182],{},"Normalmente ",[92,1172,1173],{},"Using Mullvad VPN"," y ",[92,1176,1177],{},"No WebRTC leaks"," aparecen en verde, pero ",[92,1180,1181],{},"No DNS leaks"," en rojo porque usamos Cloudflare. Mullvad solo marca esta sección como correcta cuando los resolvedores pertenecen a Mullvad.",[55,1184,1186],{"id":1185},"poner-en-verde-la-comprobación-dns","Poner en verde la comprobación DNS",[18,1188,1189],{},"Cambia el DNS ascendente de Pi-hole por uno de Mullvad:",[707,1191],{":items":1192,"variant":1193},"[\"DNS interno de Mullvad: 10.64.0.1. Solo funciona con el túnel WireGuard activo.\",\"DNS público de Mullvad sin filtrado: 194.242.2.2. Sigue funcionando si el túnel cae brevemente.\",\"DNS público de Mullvad con bloqueo de anuncios, rastreadores y malware: 194.242.2.4.\",\"DNS público de Mullvad solo con bloqueo de anuncios: 194.242.2.3.\"]","numbered",[18,1195,1196,1197,1056],{},"En el ",[31,1198,1200],{"href":448,"rel":1199},[35],"panel de Pi-hole",[707,1202],{":items":1203,"variant":1193},"[\"Abre la interfaz de administración de Pi-hole.\",\"Ve a Settings y después a DNS.\",\"En Upstream DNS Servers, desmarca Cloudflare y los demás proveedores.\",\"Selecciona Custom e introduce una dirección DNS de Mullvad. Puedes añadir resolvers IPv4 e IPv6.\",\"Pulsa Save al final de la página.\"]",[18,1205,1206],{},[70,1207],{"alt":1208,"height":485,"src":1209,"width":1210},"Configuración DNS de Pi-hole","\u002Fimages\u002Fblog\u002Fpi-hole-and-mullvad\u002Fpi-hole-web-interface-3.jpg",1900,[18,1212,1213,1214,1218,1219,1221],{},"Espera unos segundos y repite la prueba en ",[31,1215,1217],{"href":1145,"rel":1216},[35],"mullvad.net\u002Fcheck",". Debería aparecer ",[92,1220,1181],{}," en verde.",[55,1223,1225],{"id":1224},"si-la-comprobación-sigue-mostrando-una-fuga-dns","Si la comprobación sigue mostrando una fuga DNS",[18,1227,1228],{},"La causa más común es que el navegador use su propio DNS over HTTPS y omita la configuración del sistema y de Pi-hole. Desactiva el DNS seguro.",[1230,1231,1233],"h4",{"id":1232},"firefox","Firefox",[707,1235],{":items":1236,"variant":1193},"[\"Abre Settings y Privacy & Security.\",\"Desplázate hasta DNS over HTTPS.\",\"Selecciona Off.\",\"Reinicia Firefox y repite la comprobación.\"]",[1230,1238,1240],{"id":1239},"chrome","Chrome",[707,1242],{":items":1243,"variant":1193},"[\"Abre chrome:\u002F\u002Fsettings\u002Fsecurity.\",\"En Use secure DNS, desactiva la opción.\",\"Reinicia Chrome y repite la comprobación.\"]",[1230,1245,1247],{"id":1246},"edge","Edge",[707,1249],{":items":1250,"variant":1193},"[\"Abre edge:\u002F\u002Fsettings\u002Fprivacy.\",\"Busca Use secure DNS y desactívalo.\",\"Reinicia Edge y repite la comprobación.\"]",[18,1252,1253],{},"Si no cambia, prueba una ventana privada o un navegador diferente para confirmar si el navegador es la causa.",[45,1255],{},[13,1257,1259],{"id":1258},"conclusión","Conclusión",[18,1261,1262],{},"Tu Raspberry Pi ya funciona como bloqueador de anuncios y rastreadores para toda la red y dirige el tráfico por Mullvad VPN. Mantén Raspberry Pi OS, Pi-hole, WireGuard y la configuración de Mullvad actualizados para recibir los últimos parches y conservar la fiabilidad.",[18,1264,1265],{},"¡Eso es todo por hoy! Espero que te haya gustado la guía y nos vemos pronto.",[1267,1268,1269],"style",{},"html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}",{"title":147,"searchDepth":352,"depth":352,"links":1271},[1272,1273,1278,1279,1286,1291,1292,1302,1307],{"id":15,"depth":352,"text":16},{"id":49,"depth":352,"text":50,"children":1274},[1275,1277],{"id":57,"depth":1276,"text":58},3,{"id":86,"depth":1276,"text":87},{"id":111,"depth":352,"text":112},{"id":123,"depth":352,"text":124,"children":1280},[1281,1282,1283,1284,1285],{"id":139,"depth":1276,"text":140},{"id":180,"depth":1276,"text":181},{"id":200,"depth":1276,"text":201},{"id":251,"depth":1276,"text":252},{"id":275,"depth":1276,"text":276},{"id":311,"depth":352,"text":312,"children":1287},[1288,1289,1290],{"id":315,"depth":1276,"text":316},{"id":368,"depth":1276,"text":369},{"id":460,"depth":1276,"text":461},{"id":501,"depth":352,"text":502},{"id":517,"depth":352,"text":518,"children":1293},[1294,1295,1296,1297,1298,1299,1300,1301],{"id":536,"depth":1276,"text":537},{"id":573,"depth":1276,"text":574},{"id":606,"depth":1276,"text":607},{"id":701,"depth":1276,"text":702},{"id":742,"depth":1276,"text":743},{"id":859,"depth":1276,"text":860},{"id":1022,"depth":1276,"text":1023},{"id":1032,"depth":1276,"text":1033},{"id":1138,"depth":352,"text":1139,"children":1303},[1304,1305,1306],{"id":1159,"depth":1276,"text":1160},{"id":1185,"depth":1276,"text":1186},{"id":1224,"depth":1276,"text":1225},{"id":1258,"depth":352,"text":1259},"guides","Guías","2026-08-03","Guía práctica para instalar Pi-hole y configurar una Raspberry Pi como puerta de enlace Mullvad WireGuard, incluyendo DNS, reenvío, NAT y solución de fugas.","md",[1314,1317,1320,1323,1326,1329,1332],{"question":1315,"answer":1316},"¿Para qué sirve usar Pi-hole con Mullvad en una Raspberry Pi?","Pi-hole bloquea anuncios y rastreadores a nivel DNS, mientras Mullvad dirige el tráfico de Internet por un túnel VPN cifrado. Juntos ofrecen filtrado DNS para toda la red y protección VPN a los dispositivos que usan la Raspberry Pi como servidor DNS y puerta de enlace.",{"question":1318,"answer":1319},"¿Puede una Raspberry Pi ejecutar Pi-hole y Mullvad WireGuard al mismo tiempo?","Sí. Puede ejecutar Pi-hole como servidor DNS de la red y WireGuard como cliente VPN de Mullvad. Con el reenvío IPv4 y NAT configurados, también puede dirigir por el túnel el tráfico de otros dispositivos.",{"question":1321,"answer":1322},"¿Por qué necesita la Raspberry Pi una dirección IP estática?","Necesita una dirección estable para que los demás dispositivos siempre puedan encontrarla como servidor DNS y puerta de enlace. Una dirección DHCP cambiante podría interrumpir el filtrado DNS e impedir el acceso a la puerta de enlace VPN.",{"question":1324,"answer":1325},"¿Cómo dirijo el tráfico de mi red doméstica a través de Mullvad?","Activa el reenvío IPv4, permite el reenvío entre las interfaces LAN y WireGuard, añade una regla de masquerade para la interfaz VPN y configura cada dispositivo para usar la Pi como puerta de enlace y servidor DNS.",{"question":1327,"answer":1328},"¿Qué servidor DNS de Mullvad debo usar con Pi-hole?","Usa el DNS interno de Mullvad, 10.64.0.1, con el túnel WireGuard activo. Para el DNS público de Mullvad, usa 194.242.2.2 sin filtrado, 194.242.2.4 con bloqueo de anuncios y rastreadores o 194.242.2.3 solo con bloqueo de anuncios.",{"question":1330,"answer":1331},"¿Por qué la comprobación de Mullvad muestra una fuga DNS con Cloudflare?","Cloudflare no es operado por Mullvad, por lo que su comprobación puede informar de una fuga aunque el túnel funcione correctamente. Para mostrar No DNS leaks, configura Pi-hole con un resolvedor DNS de Mullvad en lugar de Cloudflare.",{"question":1333,"answer":1334},"¿Cómo soluciono una fuga DNS causada por el navegador?","Desactiva DNS over HTTPS o DNS seguro en el navegador y vuelve a ejecutar la comprobación de Mullvad. Si el resultado no cambia, prueba una ventana privada u otro navegador para comprobar si está evitando Pi-hole.","\u002Fimages\u002Fblog\u002Fpi-hole-and-mullvad\u002Fraspberry-pi-network.png","es",{},true,"\u002Fes\u002Fblog\u002Fhow-to-configure-pi-hole-and-mullvad-on-a-raspberry-pi",{"title":5,"description":1311},{"loc":1339},"es\u002Fblog\u002Fhow-to-configure-pi-hole-and-mullvad-on-a-raspberry-pi","bfgr9_kheJACHAHUL_EOHnA-pzbd3oPcnhoKjYAzXUc",[],[],1786183716018]