Pihole DNS

[bennor]

While you could set pihole in wan dns 1 and wan dns 2 , for this use case you wouldn't want to since we are expecting pihole to use the router for custom dns traffic, since safesearch is setup via custom scripts on the router itself.

Yes, what I posted was just a basic general setup, people will have to customize it for their own setup/configurations. Pi-Hole documentation doesn't recommend using Pi-Hole in the WAN DNS fields anyway. Yet we still see (as evidenced in other threads) some people wanting to input Pi-Hole into the WAN DNS fields. So I included the WAN info and the general warning about using conditional forwarding for those few who decide to input the Pi-Hole into the WAN DNS fields.

 

[SomeWhereOverTheRainBow]

Yes, what I posted was just a basic general setup, people will have to customize it for their own setup/configurations. Pi-Hole documentation doesn't recommend using Pi-Hole in the WAN DNS fields anyway. Yet we still see (as evidenced in other threads) some people wanting to input Pi-Hole into the WAN DNS fields. So I included the WAN info and the general warning about using conditional forwarding for those few who decide to input the Pi-Hole into the WAN DNS fields.

I have my pihole set in WAN DNS 1,
I have

pc_append "add-mac" $CONFIG

pc_append "add-subnet=32,128" $CONFIG

pc_append "local=/168.192.in-addr.arpa/" $CONFIG

pc_append "proxy-dnssec" $CONFIG

set in dnsmasq.postconf

and I set conditional forwarding up on my pihole to point at the router.

and my pihole uses a local unbound server.

DNSfilter client options has pihole set to no filter

DNSfilter global is set to ROUTER

LAN DNS 1 is set to routers IP.

 

[bennor]

I have my pihole set in WAN DNS 1,

I used to have Pi-Holes set in WAN DNS fields and conditional forwarding enabled too until I ran into the loopback flood issue, not once but twice. It crippled my local network each time. There is some discussion of this loopback flood issue here and here. I no longer use the Pi-Holes in the WAN DNS fields. YMMV and all that.

 

[SomeWhereOverTheRainBow]

I used to have Pi-Holes set in WAN DNS fields and conditional forwarding enabled too until I ran into the loopback flood issue, not once but twice. It crippled my local network each time. There is some discussion of this loopback flood issue here and here. I no longer use the Pi-Holes in the WAN DNS fields. YMMV and all that.

I have used additional options to mitigate such issues, but otherwise I'd advise against conditional forwarding, but the results of doing such may leave pihole unable to identify some devices.

 

[bennor]

I have used additional options to mitigate such issues, but otherwise I'd advise against conditional forwarding, but the results of doing such may leave pihole unable to identify some devices.

Yeah the inability to identify some devices was an issue I ran into when not using conditional forwarding. Solved it (in my use) by creating host file of sorts for the Pi-Hole to use. Detailed it here. Worked fine for the most part but from what I remember it has it's draw backs when not using static IP's; ended up going back to using conditional forwarding and not having the Pi-Hole's in the WAN DNS's. Shrugs.

 

[dave14305]

Dave, the user asking about the issue with pihole not showing the device's names.. I wonder why he didn't just enabled "Use Conditional Forwarding" in Pihole?
That did the trick for me and all my devices names started showing instead of the IPs after I enabled. that.

If using DNSFilter, the source IP for Pihole queries will appear to come from the router LAN IP instead of the original LAN device. That linked post was intended to get the best of both worlds.

 

[macster2075]

If using DNSFilter, the source IP for Pihole queries will appear to come from the router LAN IP instead of the original LAN device. That linked post was intended to get the best of both worlds.

Do you recommend I set pihole as the main DHCP server or keep using the router?
Also, is there a way to force devices to use Pihole dns, meaning prevent them from using another dns server.

Right now, since I am using DNSfilter and enabled the global setting to Router. I believe I was told that doing this will force devices to use the router's dns by intercepting port 53.
Can I do the same if I choose to use Pihole as the main DHCP and DNS server?

EDIT:
I wanted to add that I am running Pihole on a dedicated machine running Ubuntu.
Specs are

AMD FX-6300 6 core CPU
8 gb ram
240gb ssd

 

[dave14305]

Do you recommend I set pihole as the main DHCP server or keep using the router?

If it ain’t broke, don’t fix it. There’s probably more benefit to having the router as the DHCP server than moving it to the PiHole.

Also, is there a way to force devices to use Pihole dns, meaning prevent them from using another dns server.

Only with a firewall-based solution like DNSFilter.

Can I do the same if I choose to use Pihole as the main DHCP and DNS server?

Yes, but you would put the PiHole IP as Custom 1 in DNSFilter instead of Router mode.

 

[macster2075]

If it ain’t broke, don’t fix it. There’s probably more benefit to having the router as the DHCP server than moving it to the PiHole.

Only with a firewall-based solution like DNSFilter.

Yes, but you would put the PiHole IP as Custom 1 in DNSFilter instead of Router mode.

I thought since the machine running pihole is beefier than than the asus router, it would be beneficial for it to handle DHCP.

 

[dave14305]

I thought since the machine running pihole is beefier than than the asus router, it would be beneficial for it to handle DHCP.

The workload of DHCP is trivial for a home router, but that doesn’t mean you can’t try it your way.

I came across this post yesterday that shows the lengths you can go to with your home network:

How I re-over-engineered my home network for privacy and security

How I used Docker Compose, Ansible, and Caddy to re-over-engineer my UniFi Dream Machine, PiHole/AdGuard Home, and Cloudflare-based home network for ease of setup, maintenance, and management.

ben.balter.com

 

[macster2075]

Yes, but you would put the PiHole IP as Custom 1 in DNSFilter instead of Router mode.

I tried that.. putting pihole IP as custome 1 in DNSfilter hit apply... lost internet completely.
I cleared cache and renew ip..still no internet, I had to put it back to Router.

 

[dave14305]

I tried that.. putting pihole IP as custome 1 in DNSfilter hit apply... lost internet completely.
I cleared cache and renew ip..still no internet, I had to put it back to Router.

That is unusual because if the PiHole IP is already in LAN DNS 1 field, and it matches the IP you used in Custom 1, then the actual DNS Filter rules would be the same (both redirecting to the PiHole IP).

Have you set a DNSFilter rule for your PiHole MAC as No Filtering? If not, this could cause a loop with Conditional Forwarding and regular lookups.

 

[macster2075]

That is unusual because if the PiHole IP is already in LAN DNS 1 field, and it matches the IP you used in Custom 1, then the actual DNS Filter rules would be the same (both redirecting to the PiHole IP).

Have you set a DNSFilter rule for your PiHole MAC as No Filtering? If not, this could cause a loop with Conditional Forwarding and regular lookups.

so just to make sure... "Advertise router's IP in addition to user-specified DNS" is set to disable right?

 

[dave14305]

so just to make sure... "Advertise router's IP in addition to user-specified DNS" is set to disable right?

It depends on what guide you’re following. In general, you want it disabled so DHCP clients only get informed about the PiHole as the DNS Server.

 

[macster2075]

It depends on what guide you’re following. In general, you want it disabled so DHCP clients only get informed about the PiHole as the DNS Server.

yeah, it was set to "no" and I don't know why the internet breaks when in "Global mode" I go from Router to Custom 1 which is the pihole IP.

 

[macster2075]

I do have OpenDns set on the WAN DNS side... could that be the issue?

 

[dave14305]

I do have OpenDns set on the WAN DNS side... could that be the issue?

No. Plus you didn’t answer my question about DNS Filter exception for the PiHole MAC.

Post screenshots of the DNS Filter page, LAN DHCP page, and the Pi-Hole dns settings page, showing PiHole’s upstream DNS servers and conditional forwarding.

 

[macster2075]

No. Plus you didn’t answer my question about DNS Filter exception for the PiHole MAC.

Post screenshots of the DNS Filter page, LAN DHCP page, and the Pi-Hole dns settings page, showing PiHole’s upstream DNS servers and conditional forwarding.

"DNS Filter exception for the PiHole MAC" - where can I see that or where do I enter that exception?

 

[macster2075]

This is pihole

 

[dave14305]

View attachment 36193

You need a client rule beneath this section to let your PiHole send DNS requests without being filtered back to…wait for it,,,the PiHole IP. You would end up with a devastating DNS loop.