Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Pi-hole with pfSense

    Scheduled Pinned Locked Moved DHCP and DNS
    20 Posts 7 Posters 15.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • keyserK
      keyser Rebel Alliance @CloudNode
      last edited by

      @iptvcld While your setup should be able to work, I would highly recommend against a setup like that.

      Not only does your pfsense have to forward all DNS requests to Pi-hole, but in Pi-hole you will get no info on which clients asked what/was blocked.

      you should disable the DNS forwarder as well, and simply input the Pi-hole IP address in you DHCP server settings (under DNS) so your clients use it directly.

      Love the no fuss of using the official appliances :-)

      C 1 Reply Last reply Reply Quote 0
      • C
        CloudNode @keyser
        last edited by

        @keyser Thanks for the reply; if I disable my DNS forwarder and Resolver how can I get my local DNS names i have set in Host overrides? I am using that in connection with HAProxy.

        Also if i set one DNS server under DHCP, i am worried if that Pi ever goes down or reboots (as its installed on a LXC container via Proxmox) then all my clients will loose DNS. I tired adding that Pi-hole DNS in that section already but I also added 8.8.8.8 as DNS2 and my clients did not like that as some were using 8.8.8.8 and some were using my pi. I guess I am trying to say, can can i add redundancy? Would I need 2xPi-holes and then put both PI DNS IP's under DNS1 and DNS2?

        Thank you,

        1 Reply Last reply Reply Quote 0
        • AndyRHA
          AndyRH
          last edited by AndyRH

          Mine is setup somewhat differently than you propose.
          pfSense is pointed at Cloudflare. pfSense can always get to a DNS server.
          PiHole is using unbound, but could as easily be pointed at Google, functionally it does not matter.
          PiHole is pointed to pfSense for local queries. *.home.arpa
          DHCP gives out only PiHole DNS. I have more than one for redundancy.

          I also force all DNS queries to PiHole through a small series of rules. Should all the PiHoles die at one time I just need to change 1 alias on pfSense and then all queries could be forced to pfSense.
          https://forum.netgate.com/topic/156453/pfsense-dns-redirect-to-local-dns-server?_=1663853296484

          o||||o
          7100-1u

          C 1 Reply Last reply Reply Quote 0
          • C
            CloudNode @AndyRH
            last edited by

            @AndyRH is unbound on Pi-hole something that needs to be installed extra? So a DNS request from Client1 goes directly to Pi-hole first then Pi-hole upstreams to pfsense and gets a response from Cloudflare?

            the otherT AndyRHA 2 Replies Last reply Reply Quote 0
            • the otherT
              the other @CloudNode
              last edited by the other

              @iptvcld last time i used it, yes...needs to be installed extra.
              You could also set pihole in pfsense dhcp as dns, make some rule all clients are only allowed to use that IP (pihole) for dns.
              In pihole forward to pfsense.
              Have unbound run on pfsense to resolve.
              Use pfblocker to add geoIP blocking.
              I had that running and it worked well in my little home network.
              Now i only use pfblocker and unbound, all running on pfsense. Save some energy, less complicated, same effect... :)

              the other

              pure amateur home user, no business or professional background
              please excuse poor english skills and typpoz :)

              C 1 Reply Last reply Reply Quote 0
              • C
                CloudNode @the other
                last edited by

                @the-other Thank you, just want to confirm - on pfSense did you have any DNS servers under System\General? If Pi-hole is upstreaming back to pfSense and pfSense is the resolver, where does pfSense get the response from?

                the otherT 1 Reply Last reply Reply Quote 0
                • AndyRHA
                  AndyRH @CloudNode
                  last edited by

                  @iptvcld Yes, unbound is an extra step. It is popular, but it is not required.

                  o||||o
                  7100-1u

                  1 Reply Last reply Reply Quote 0
                  • the otherT
                    the other @CloudNode
                    last edited by the other

                    @iptvcld hey there,
                    No, i do not have anything under general > dns servers...
                    Unbound does what it...well does. Asking those top level domain servers and caching those commen ones.
                    No need to enter a specific dns.

                    the other

                    pure amateur home user, no business or professional background
                    please excuse poor english skills and typpoz :)

                    1 Reply Last reply Reply Quote 0
                    • C
                      CloudNode
                      last edited by

                      Now.. what if I dump Pi-hole and go with installing AdGuard Home directly on pfSense and then just use the resolver within pfSense?

                      AndyRHA 1 Reply Last reply Reply Quote 0
                      • AndyRHA
                        AndyRH @CloudNode
                        last edited by

                        @iptvcld Why not go with pfBlocker?

                        o||||o
                        7100-1u

                        C 1 Reply Last reply Reply Quote 0
                        • C
                          CloudNode @AndyRH
                          last edited by

                          @AndyRH I had pfBlock going on for a while now but I find it hard to navigate and also want something new to tinker with

                          1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator @CloudNode
                            last edited by johnpoz

                            @iptvcld said in Pi-hole with pfSense:

                            Would someone be able to let me know if my setup is correct?

                            That is not how I use pihole, nor would I ever do it that way ;) not a fan of forwarding to external dns..

                            But forwarding is for sure a viable option.. I am just not a fan..

                            How I use pihole is pihole is set to forward to unbound on pfsense. My clients point to pihole.. pfsense has zero need to ask pihole for anything.. Really the only thing pfsense ever needs to lookup is for updates and packages, or if you click an IP in your firewall log for example. So it just uses itself (unbound in resolver mode)

                            Pfsense is what holds all the dns records for all my local devices, etc. So if some client says hey pihole whats the IP of nas.home.arpa it forwards that to pfsense and gets the answer.

                            If a client says hey pihole, whats the IP of somethingblocked.com - it just gets back the blocked IP, and done. Now if client asks pihole for something not blocked, it forwards to unbound, unbound resolves it, dnssec is enabled because I am resolving.. And hands what it resolves back to pihole to hand back to the client.

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            C R 2 Replies Last reply Reply Quote 0
                            • C
                              CloudNode @johnpoz
                              last edited by

                              @johnpoz Thank you, and what resolves the website? as if what public resolver is used if pihole is using pfsense as its reslover and in pfsense, there is not public DNS IP anywhere.

                              johnpozJ 1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator @CloudNode
                                last edited by

                                @iptvcld said in Pi-hole with pfSense:

                                here is not public DNS IP anywhere.

                                huh.. Out of the box unbound resolves, any public domain via walking down from roots.. That is how a resolver works.

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                C 1 Reply Last reply Reply Quote 0
                                • C
                                  CloudNode @johnpoz
                                  last edited by

                                  @johnpoz said in Pi-hole with pfSense:

                                  any public domain via walking down from roots.. That is how a resolver works.

                                  ahh ok.. so it has its built in roots. got it

                                  1 Reply Last reply Reply Quote 0
                                  • R
                                    RacerX330 @johnpoz
                                    last edited by

                                    @johnpoz said in Pi-hole with pfSense:

                                    @iptvcld said in Pi-hole with pfSense:

                                    Would someone be able to let me know if my setup is correct?

                                    That is not how I use pihole, nor would I ever do it that way ;) not a fan of forwarding to external dns..

                                    But forwarding is for sure a viable option.. I am just not a fan..

                                    How I use pihole is pihole is set to forward to unbound on pfsense. My clients point to pihole.. pfsense has zero need to ask pihole for anything.. Really the only thing pfsense ever needs to lookup is for updates and packages, or if you click an IP in your firewall log for example. So it just uses itself (unbound in resolver mode)

                                    Pfsense is what holds all the dns records for all my local devices, etc. So if some client says hey pihole whats the IP of nas.home.arpa it forwards that to pfsense and gets the answer.

                                    If a client says hey pihole, whats the IP of somethingblocked.com - it just gets back the blocked IP, and done. Now if client asks pihole for something not blocked, it forwards to unbound, unbound resolves it, dnssec is enabled because I am resolving.. And hands what it resolves back to pihole to hand back to the client.

                                    sorry to revive old thread, would you mind sharing the DNS Resolver config that you use for pointing pihole to unbound on pfsense?

                                    johnpozJ 1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator @RacerX330
                                      last edited by

                                      @RacerX330 pretty much default out of the box..

                                      Other than I set min ttl to 3600 and serve zero, and have outgoing set to localhost only.. There is nothing special you need to do to the unbound settings, out of the box default works.

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      T 1 Reply Last reply Reply Quote 0
                                      • T
                                        tman222 @johnpoz
                                        last edited by

                                        @johnpoz said in Pi-hole with pfSense:

                                        @RacerX330 pretty much default out of the box..

                                        Other than I set min ttl to 3600 and serve zero, and have outgoing set to localhost only.. There is nothing special you need to do to the unbound settings, out of the box default works.

                                        Hi @johnpoz - curious as to why you have outgoing interfaces for Unbound set to Localhost only? Is it more secure that way? Also, great suggestion on setting the cache-min-ttl to 3600 seconds. Amazing how much that decreases the DNS chatter on the network. Thanks in advance.

                                        johnpozJ 1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator @tman222
                                          last edited by

                                          @tman222 localhost not really for security - but localhost would always be up, so unbound kind bind to it when starting - it will route out any wan interface you have and be natted to that ip

                                          Not something to worry about really or set, like I said out of the box is fine - but those were things that popped into my head that are different than default.

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          1 Reply Last reply Reply Quote 2
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.