1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Setting up Pi-hole

Discussion in 'Linux & Open Source' started by NoNameNoNumber, Nov 5, 2016.

  1. BigT

    Mobster

    Joined: Oct 18, 2002

    Posts: 2,936

    Location: UK

    In your router just set the upstream DNS to be your piHole’s internal IP address instead of the default and in your PiHole ensure DHCP is turned off and its upstream DNS to be Google, your ISP’s DNS or whatever you prefer. Job done and your router is doing the DHCP
     
  2. Biz.Kid09

    Sgarrista

    Joined: Oct 14, 2009

    Posts: 8,262

    Location: UK

    Ok cheers, it seemed like it was asking for one that had already been set.

    No can do on the SH3.

    I have to manually set the DNS for each device.
     
  3. the-evaluator

    Wise Guy

    Joined: Sep 24, 2015

    Posts: 1,408

    Conditional forwarding is nothing to do with DHCP, it's a DNS settings that tells Pi-Hole to forward DNS requests for a given domain name to a specified DNS server.

    So why not disable DHCP on the SH and let the Pi-Hole do it? No need to statically set DNS servers one each device then.
     
  4. Biz.Kid09

    Sgarrista

    Joined: Oct 14, 2009

    Posts: 8,262

    Location: UK

    Yeah I know, its used to pull down the names of the connected devices rather than just seeing the IP?

    I had weird issues when I let the Pi do DHCP and its used a test bed really for random stuff so I am always formatting it etc.
     
  5. the-evaluator

    Wise Guy

    Joined: Sep 24, 2015

    Posts: 1,408

    Ah, so you want to use conditional forwarding to pick the reverse DNS entries for your home subnet. It's been a while I used an SH but I'm sure mine didn't register PTR records.
     
  6. Biz.Kid09

    Sgarrista

    Joined: Oct 14, 2009

    Posts: 8,262

    Location: UK

    Yeah, its not a huge deal I just thought I would enable it if its there.

    I will be switching to a Ubiquiti setup soon anyway so SH3 will be out of the way to be fair.
     
  7. BigBoy

    Soldato

    Joined: Oct 19, 2002

    Posts: 5,516

    Location: Bath

    get that superhub into modem mode and let the pi do the hard work, you will however need a router between the pi and the SH, I detest the SH3 right lump of junk from the start!
     
  8. Biz.Kid09

    Sgarrista

    Joined: Oct 14, 2009

    Posts: 8,262

    Location: UK

    Yeah definitely, I have an EdgeRouter already but I need to pick up an AP for wireless. Once I have that I will be doing it the proper way, with the EdgeRouter just dishing out the PiHole as DNS.
     
  9. BigBoy

    Soldato

    Joined: Oct 19, 2002

    Posts: 5,516

    Location: Bath

    Anyone else experianceing a really low block rate on their pihole at the moment? its gone from a good 30-40% blocked to only 7-10%
    [​IMG]

    These are the lists I use does anyone have some better ones?
    [​IMG]
     
  10. the-evaluator

    Wise Guy

    Joined: Sep 24, 2015

    Posts: 1,408

    Mine is even worse but I do know why:

    [​IMG]

    The reason mine looks quite so bad is that I've got conditional forwarding for PTR records at my home subnet setup so there's a *HUGE* amount of queries being sent to my Unifi USG, something in the region of 1.2m of those 1.3m queries. I need to see if I can exclude those lookups from the statistics.

    For now though I'll disable the conditional forwarding and see what sort of blocking percentage I end up with.
     
  11. Feek

    Commissario

    Joined: Oct 17, 2002

    Posts: 26,048

    Location: In the radio shack

    That never worked for me.
     
  12. the-evaluator

    Wise Guy

    Joined: Sep 24, 2015

    Posts: 1,408

    It's working for me but as you can see it skews the statistics.

    For it to work your router needs to register DHCP hosts in DNS. Some do, some don't.
     
  13. Rainmaker

    Sgarrista

    Joined: Aug 18, 2007

    Posts: 8,045

    Location: Liverpool

    EDIT: I actually may have cracked this, as a VM just automatically connected using DHCP. So please don't yet read this huge post and start helping troubleshoot (i.e. wasting your time). I'll update either with more info or else a working guide once I've sussed it out.

    Pi-Hole works great, but it's designed primarily to be a standalone server on an existing LAN. For example, if it gets an IP of 192.168.1.76 from your router it will then listen for requests on the same NIC from that over-arching LAN (192.168.1.0/24), in order to serve the other LAN clients with DNS and DHCP as required. I need it to work backwards to that, and have it installed on my x86 router to provide DNS and DHCP.

    In other words, contrary to its usual MO it needs to take its upstream WAN connection for DNS resolving only (this will be plugged into my VM SH3), and listen for/serve to clients on the machine's other physical interfaces. I've gotten it mostly working, but a more experienced eye would be helpful atm, if anyone can chip in?

    I currently have a Dell Optiplex 7010 (i7 3700, 8GB RAM, Intel Pro 1000VT quad port server NIC) running Arch Linux with dnscrypt-proxy, dhcpd4 and Shorewall acting as our router and firewall. It runs three physical interfaces - WAN, LAN and DMZ (servers, CCTV and IoT). For obvious reasons, my Shorewall policy denies traffic going from DMZ > LAN, although LAN clients can still access the servers in the DMZ. The box itself is connected to an external WireGuard VPN provider, and shares this connection to the clients on the LAN interface only. Servers/devices on DMZ go out through the clearnet Virgin connection. Because of the convoluted setup, I didn't use wg-quick for this; I wrote some custom wg-up and wg-down shell scripts and a systemd unit to regulate the routing tables and ip link connections.

    As I said above, I want to (ideally) replace this Arch install with something else so I can just use ufw and wg-quick to simplify things. OS doesn't matter but it'd be easier if it was Debian, Ubuntu or similar. I will keep the same subnet setup (WAN, LAN, DMZ) and already have a functional config for this using netplan (Ubuntu) or iface configs (Debian). Importantly though, and hence posting here, I want to replace dnscrypt-proxy and dhcpd4 with Pi-Hole on the router. In other words, replace multiple standalone tools (DNS over HTTPS, DHCP, blocking) with the one tool - Pi-Hole. This is somewhat anathema to its usual setup, in that it will have to ignore the WAN connection (the one it usually serves dhcp to/from as part of a wider LAN). I need to have it instead listen/act on the two LAN interfaces.

    I have read the Arch Wiki, Pi-Hole docs etc and gotten this partially working in a VM. With Ubuntu server installed and netplan configured (ens33, ens34 and ens35 being WAN, LAN and DMZ respectively - the latter two being accomplished in the VM with LAN segments) I installed Pi-Hole using the usual install script. I set it to use Cloudflare upstream for now (normally I'd also install cloudflared and use DoH, but wanted to keep this simple to minimise variables). I made two new config files in /etc/dnsmasq.d/ as suggested by the Pi-Hole docs, and set them to listen on ens34 and ens35 respectively, to serve DHCP and DNS requests:

    Code:
    ## This is /etc/dnsmasq.d/lan.conf and I also have ./dmz.conf with the interface name and DHCP range changed accordingly.
    
    # Only listen to routers' LAN NIC.  Doing so opens up tcp/udp port 53 to
    # localhost and udp port 67 to world:
    interface=ens34
    
    # dnsmasq will open tcp/udp port 53 and udp port 67 to world to help with
    # dynamic interfaces (assigning dynamic ips). Dnsmasq will discard world
    # requests to them, but the paranoid might like to close them and let the
    # kernel handle them:
    bind-interfaces
    
    # Optionally set a domain name
    #domain=example.com
    
    # Set default gateway
    dhcp-option=3,0.0.0.0
    
    # Set DNS servers to announce
    dhcp-option=6,0.0.0.0
    
    # If your dnsmasq server is also doing the routing for your network,
    # you can use option 121 to push a static route out.
    # x.x.x.x is the destination LAN, yy is the CIDR notation (usually /24),
    # and z.z.z.z is the host which will do the routing.
    dhcp-option=121,10.10.10.0/24,10.10.10.1
    
    # Dynamic range of IPs to make available to LAN PC and the lease time.
    # Ideally set the lease time to 5m only at first to test everything works okay before you set long-lasting records.
    dhcp-range=10.10.10.11,10.10.10.254,12h
    
    # If you’d like to have dnsmasq assign static IPs to some clients, bind the LAN computers
    # NIC MAC addresses:
    #dhcp-host=aa:bb:cc:dd:ee:ff,192.168.111.50

    I have enabled IP4 forwarding in UFW, and set the default policy to allow for testing so it doesn't add confounding variables while I get things working.

    After rebooting the machine, I fired up some other client VMs (i.e. NICs set to use LAN segments pointing to the Pi-Hole router). DHCP just times out, and so no internet connection is established. If I manually set the network in those clients (eg assign a static IP of 10.10.10.20/24, dns 10.10.10.1, gateway 10.10.10.1) then the internet works perfectly. I can then access pi.hole/admin and when browsing random sites all ads are blocked.

    So Pi-Hole is working but it seems either there's a conflict with dnsmasq in Pi-Hole thanks to my having static conf files *and* having 'enable DHCP' ticked in the Dashboard's settings, or something else along those lines. There's no actual dnsmasq service on the machine, as Pi-Hole handles it itself, so my config options are more limited. Can anyone see where I might have gone wrong, or offer any solutions? Last step after getting DHCP working is to enable WireGuard for LAN (not DMZ), but that's easier. TIA for any suggestions.
     
    Last edited: Mar 22, 2019
  14. maj

    Wise Guy

    Joined: Jul 19, 2010

    Posts: 2,256

    Location: Newcastle

    Rather than having to manually set DNS on each device, I thought I would set pi-hole to be the DHCP server (with gateway setting in pi-hole set to router and DHCP off on router) so that any device that connected to my router would automatically be assigned an IP and also pi-hole as the DNS. However since doing this pi-hole doesn't seem to be blocking anything.

    Do I need to do anything on the Settings -> DNS page? My plusnet router doesn't allow you to change the DNS settings which is why I'm having to do it this way.
     
  15. Armageus

    Don

    Joined: May 19, 2012

    Posts: 9,635

    Location: Spalding, Lincolnshire

    Could just be a case that your devices are still using a router DHCP lease (and consequently not the Pihole for dns).

    On a windows PC you can use
    ipconfig /renew
    ipconfig /flushdns

    to try and renew the DHCP lease and clear existing DNS cache
     
  16. maj

    Wise Guy

    Joined: Jul 19, 2010

    Posts: 2,256

    Location: Newcastle

    Got it sorted now and I was being an idiot. I had my VPN browser extension connected which was bypassing pi-hole. Turned it off and all seems to be working as normal...
     
  17. maj

    Wise Guy

    Joined: Jul 19, 2010

    Posts: 2,256

    Location: Newcastle

    Has anyone had any joy with the delight that is Channel 4/4OD? It seems it doesn't like me blocking 2a7e9.v.fwmrm.net which is a custom blacklist entry I came across on reddit. Their ads are so controlling that if you click on another tab for instance the ad stops till you open the tab again. Some of the ones during the catch up can be a few minutes long each. I'm using the default block lists plus a few custom blacklist entries.
     
  18. Armageus

    Don

    Joined: May 19, 2012

    Posts: 9,635

    Location: Spalding, Lincolnshire

    Deployed PiHole at work this morning - pretty happy with the result so far (~4 hours):

    [​IMG]
     
  19. bledd

    Don

    Joined: Oct 21, 2002

    Posts: 46,118

    Location: Parts Unknown


    Let us know how you get on regarding websites that need to be whitelisted..
     
  20. Armageus

    Don

    Joined: May 19, 2012

    Posts: 9,635

    Location: Spalding, Lincolnshire