pihole on unraid not blocking ads with pfsense
-
Thanks. Both scenarios worked out. I will use scenario A.
-
@johnpoz said in pihole on unraid not blocking ads with pfsense:
I have been running pihole for quite some time... This is how I set it up... I have pihole running on on an actual pi In my dmz network 192.168.3/24
All clients point to pihole directly via setting dhcpd on pfsense to hand this out. pihole then forwards to pfsense.. Pfsense then "RESOLVES" using dnssec.
This allows me if I want to just ask pfsense IP directly for something if I don't want to be be blocked by piholes list. If I want a device to not use pihole, i just setup that device to use pfsense for dns.
On pihole I just set it to foward PTRs for rfc1918, ie uncheck
"Never forward reverse lookups for private IP ranges"This requires min config on both unbound and pihole. No need to setup any conditional forwards, still get to "resolve" and use dnssec per setting on unbound. And also host overrides set on unbound work, etc.
John would you one day be able to do a step by step on how you got it working like that sounds perfect with what i am wanting to do. I sometimes find pfsense quite complicated 90% of the time.
-
I kind of just did, when I told you how I have it setup.. Didn't I.. What step is missing there ;)
-
@johnpoz said in pihole on unraid not blocking ads with pfsense:
I kind of just did, when I told you how I have it setup.. Didn't I.. What step is missing there ;)
Nevermind thanks anyway.
-
Do you need a picture on how to setup dhcp to point to the pihole IP? Do you need picture on how to setup pihole to point to pfsense IP? Just a bit confused to what other info you would need?
-
@johnpoz said in pihole on unraid not blocking ads with pfsense:
Do you need a picture on how to setup dhcp to point to the pihole IP? Do you need picture on how to setup pihole to point to pfsense IP? Just a bit confused to what other info you would need?
Not really a picture tho it might help. I know you told us what you have set up I just wouldn't know how to set it up this way. I was hoping you could give a run down and the setting you did to achieve this.
-
Again - already did..
You set dhcp server in pfsense to point to pihole IP.
You set pihole to forward to pfsense IP..What else is there to know?
Clients now ask pihole, stuff that is not blocked gets forwarded to pfsense. It answers for local stuff, and resolves public stuff and answers back to pihole, which sends it back to client.
One thing I would do is let pihole do PTR.. So uncheck
"Never forward reverse lookups for private IP ranges" -
@johnpoz said in pihole on unraid not blocking ads with pfsense:
Again - already did..
You set dhcp server in pfsense to point to pihole IP.
You set pihole to forward to pfsense IP..What else is there to know?
Clients now ask pihole, stuff that is not blocked gets forwarded to pfsense. It answers for local stuff back to pihole, which sends it back to client.
One thing I would do is let pihole do PTR.. So uncheck
"Never forward reverse lookups for private IP ranges"So
SystemGeneral Setup DNS Servers 10.0.0.22 (which is my pihole)
now on pihole
Upstream DNS Servers
points to pfsense 10.0.0.1Never forward non-FQDNs
Never forward reverse lookups for private IP ranges
Use DNSSEC
All ticked?Can't seem to find PTR in the dns options unless Never forward reverse lookups for private IP ranges is it?
-
@X2LR said in pihole on unraid not blocking ads with pfsense:
SystemGeneral Setup DNS Servers 10.0.0.22 (which is my pihole)
No where did I say anything about that??
You don't do anything to unbound, or pfsense other than change the IP that gets handed to clients in the dhcp server settings.
never forward non-fqdn - checked!
never private - unchecked
use dnssec - uncheck, its POINTLESS on a forwarder.. Pointless!! Unbound will do your dnssec for you out of the box.An intelligent man is sometimes forced to be drunk to spend time with his fools
If you get confused: Listen to the Music Play
Please don't Chat/PM me for help, unless mod related
SG-4860 24.11 | Lab VMs 2.8, 24.11 -
@johnpoz said in pihole on unraid not blocking ads with pfsense:
@X2LR said in pihole on unraid not blocking ads with pfsense:
SystemGeneral Setup DNS Servers 10.0.0.22 (which is my pihole)
No where did I say anything about that??
You don't do anything to unbound, or pfsense other than change the IP that gets handed to clients in the dhcp server settings.
Sorry you are correct I miss read. Is there others correct?
-
-
Exactly..
Now was that hard ;)
See my edit on the checkboxes.. The only thing pfsense should point to for dns is itself, 127.0.0.1.. Unbound out of the box will resolve and use dnssec.
-
@johnpoz said in pihole on unraid not blocking ads with pfsense:
Exactly..
Now was that hard ;)
Thank you.
last few questions if you don't mind.
in resolver
DNSSEC is ticked
is any of the others ticked at all?
DNS Query Forwarding etc..also in General Setup do you tick or untick
DNS Server Override
Disable DNS ForwarderNow I know you never said anything about General Setup just don't wont wrong set up in here.
which dns do yuo use john? ive been using quad9
-
If unbound is resolving you have little reason to allow for dhcp of pfsense wan to set dns for pfsense..
So unchecked..
If you check disable forward/resolver - how would pfpsense resolve anything for itself? Since that just removes pointing to 127.0.0.1 for pfsense.
In unbound, no forwarding is not check.. It resolves out of the box. Yes you would leave dnssec checked if you want it checking for that. That is up to you.. As to other settings in unbound.. I personally use cache prefetch and serve ttl 0, but those have nothing to do with who is asking be it pihole or normal clients, etc. I also set min TTL of 3600.. Only because I despise these 60 second some sites use for ttl.. Have seen zero issues with doing that, but I wouldn't suggest you do anything like that unless you fully understand what it means.
-
@johnpoz said in pihole on unraid not blocking ads with pfsense:
If unbound is resolving you have little reason to allow for dhcp of pfsense wan to set dns for pfsense..
So unchecked..
If you check disable forward/resolver - how would pfpsense resolve anything for itself? Since that just removes pointing to 127.0.0.1 for pfsense.
In unbound, no forwarding is not check.. It resolves out of the box. Yes you would leave dnssec checked if you want it checking for that. That is up to you.. As to other settings in unbound.. I personally use cache prefetch and serve ttl 0, but those have nothing to do with who is asking be it pihole or normal clients, etc. I also set min TTL of 3600.. Only because I despise these 60 second some sites use for ttl.. Have seen zero issues with doing that, but I wouldn't suggest you do anything like that unless you fully understand what it means.
Thanks and yes i don't understand what that means so ill leave that be.
As for dns i want to use i add that in General Setup? I think ive had it wrongly set up for years i had it in the dhcp part
-
Also you said you can bypass pihole if i wanted to do that for 10.0.0.20 and 10.0.0.22 would that be in pfsense or pihole settings
-
You would do that on the client :) via a dig or nslookup calling out pfsense IP.
Or sure if you don't want client X using pihole, then setup dhcp reservation for them and have it just ask pfsense directly via dhcp settings. Or you could do on the client directly via static settings.
-
@X2LR said in pihole on unraid not blocking ads with pfsense:
As for dns i want to use i add that in General Setup?
No... You don't put anything in general setup on pfsense.. Pfsense only ever needs to talk ask itself.. Nothing goes in general setup on pfsense. That is the whole point of unbound resolving.
-
@johnpoz said in pihole on unraid not blocking ads with pfsense:
@X2LR said in pihole on unraid not blocking ads with pfsense:
As for dns i want to use i add that in General Setup?
No... You don't put anything in general setup on pfsense.. Pfsense only ever needs to talk ask itself.. Nothing goes in general setup on pfsense. That is the whole point of unbound resolving.
Where would you put dns? (9.9.9.9 ? im lost now.)
@johnpoz said in pihole on unraid not blocking ads with pfsense:
You would do that on the client :) via a dig or nslookup calling out pfsense IP.
Or sure if you don't want client X using pihole, then setup dhcp reservation for them and have it just ask pfsense directly via dhcp settings. Or you could do on the client directly via static settings.
Hmmm? sounds very complicated, ill leave that for another day.
-
@X2LR said in pihole on unraid not blocking ads with pfsense:
Where would you put dns? (9.9.9.9 ? im lost now.)
You wouldn't!!! what would be the freaking point of that?
So you want clients to ask pihole, and then pihole to ask pfsense (Only for local stuff) and then forward to 9.9.9.9?? Sure you could do that... If your going to do, might as well just take pfsense out of the equation and let pihole be your dhcp so it can resolve your local clients and take pfsense out of it for dns/dhcp.
But now your forwarding - not resolvoing.
