Pi-hole with pfSense

CloudNode

Now.. what if I dump Pi-hole and go with installing AdGuard Home directly on pfSense and then just use the resolver within pfSense?

AndyRH

@iptvcld Why not go with pfBlocker?

CloudNode

@AndyRH I had pfBlock going on for a while now but I find it hard to navigate and also want something new to tinker with

johnpoz

@iptvcld said in Pi-hole with pfSense:

Would someone be able to let me know if my setup is correct?

That is not how I use pihole, nor would I ever do it that way ;) not a fan of forwarding to external dns..

But forwarding is for sure a viable option.. I am just not a fan..

How I use pihole is pihole is set to forward to unbound on pfsense. My clients point to pihole.. pfsense has zero need to ask pihole for anything.. Really the only thing pfsense ever needs to lookup is for updates and packages, or if you click an IP in your firewall log for example. So it just uses itself (unbound in resolver mode)

Pfsense is what holds all the dns records for all my local devices, etc. So if some client says hey pihole whats the IP of nas.home.arpa it forwards that to pfsense and gets the answer.

If a client says hey pihole, whats the IP of somethingblocked.com - it just gets back the blocked IP, and done. Now if client asks pihole for something not blocked, it forwards to unbound, unbound resolves it, dnssec is enabled because I am resolving.. And hands what it resolves back to pihole to hand back to the client.

CloudNode

@johnpoz Thank you, and what resolves the website? as if what public resolver is used if pihole is using pfsense as its reslover and in pfsense, there is not public DNS IP anywhere.

johnpoz

@iptvcld said in Pi-hole with pfSense:

here is not public DNS IP anywhere.

huh.. Out of the box unbound resolves, any public domain via walking down from roots.. That is how a resolver works.

CloudNode

@johnpoz said in Pi-hole with pfSense:

any public domain via walking down from roots.. That is how a resolver works.

ahh ok.. so it has its built in roots. got it

RacerX330

@johnpoz said in Pi-hole with pfSense:

@iptvcld said in Pi-hole with pfSense:

Would someone be able to let me know if my setup is correct?

That is not how I use pihole, nor would I ever do it that way ;) not a fan of forwarding to external dns..

But forwarding is for sure a viable option.. I am just not a fan..

How I use pihole is pihole is set to forward to unbound on pfsense. My clients point to pihole.. pfsense has zero need to ask pihole for anything.. Really the only thing pfsense ever needs to lookup is for updates and packages, or if you click an IP in your firewall log for example. So it just uses itself (unbound in resolver mode)

Pfsense is what holds all the dns records for all my local devices, etc. So if some client says hey pihole whats the IP of nas.home.arpa it forwards that to pfsense and gets the answer.

If a client says hey pihole, whats the IP of somethingblocked.com - it just gets back the blocked IP, and done. Now if client asks pihole for something not blocked, it forwards to unbound, unbound resolves it, dnssec is enabled because I am resolving.. And hands what it resolves back to pihole to hand back to the client.

sorry to revive old thread, would you mind sharing the DNS Resolver config that you use for pointing pihole to unbound on pfsense?

johnpoz

@RacerX330 pretty much default out of the box..

Other than I set min ttl to 3600 and serve zero, and have outgoing set to localhost only.. There is nothing special you need to do to the unbound settings, out of the box default works.

tman222

@johnpoz said in Pi-hole with pfSense:

@RacerX330 pretty much default out of the box..

Other than I set min ttl to 3600 and serve zero, and have outgoing set to localhost only.. There is nothing special you need to do to the unbound settings, out of the box default works.

Hi @johnpoz - curious as to why you have outgoing interfaces for Unbound set to Localhost only? Is it more secure that way? Also, great suggestion on setting the cache-min-ttl to 3600 seconds. Amazing how much that decreases the DNS chatter on the network. Thanks in advance.

johnpoz

@tman222 localhost not really for security - but localhost would always be up, so unbound kind bind to it when starting - it will route out any wan interface you have and be natted to that ip

Not something to worry about really or set, like I said out of the box is fine - but those were things that popped into my head that are different than default.