Pfsense with pihole correct configuration?
-
@johnpoz hi thank you for the answer, but i have a question, with my settings i suppouse to have all my clients connect directly to pihole right? im new on this sorry for asking many questions
-
@johnpoz i just changed the order of my rules
-
That rule allows a client to talk to anything on 53.. If you only want pihole to talk to clouldflare then set the specific rules..
If you want to block access to external, then you need to change your allow rule to dest for where you want to allow, lan address, clouldflare IP, etc.
The way you have your rules doesn't block any dns - because you have a rule that is any any for dns..
edit: Your port forwards are mess as well.. When would source address ever be lan address?
What did you do to your rule to get this?
-
-
that rule allows anything to talk to 1.1.1.1 not just pihole.
-
This post is deleted! -
@johnpoz got it
so on nat
what im confused is the lan rule not sure how exactly should be
that 192.168.1.89 is my pihole
-
No not really... The redirect is suppose to be to loopback 127.0.0.1
Which then you setup to ask pihole. Pihole then asks clouldflare.
Such a setup runs into asymmetrical flow.. I have gone over this multiple multiple times. if you want to do such a redirect then you would need to do a source nat on the traffic..
The only way such a redirect works if if pihole is on a different vlan then your clients your redirecting.
-
@johnpoz you recommend me erase that rule correct? so just leave this lan rules?
or like this
Allow all port 53 (DNS) traffic from your LAN to pi-hole server
-
May I ask why you run Pihole and not pfBlockerNG ?
-Rico
-
If your going to do a port forward.. Then you need a rule to talk to where your port forwarding.
It should be loopback if your doing the redirection. If you want to forward to pihole directly then you need to make sure you setup outbound nat for such a reflection.
Or you end up with this
dig @1.1.1.1 www.google.com ;; reply from unexpected source: 192.168.3.10#53, expected 1.1.1.1#53When you do something like this.
edit: I am not a fan of redirection.. If you want devices to use pihole, then hand them pihole via dhcp.. And just block all other dns.
Then just have pihole ask pfsense directly for stuff.. This allows you to resolve your own local stuff, and for pihole to see who asked.
If you don't want devices to use any thing else - then just block them from doing that. Users hate when their ISP does interception of dns.. But seems ok to do on your own network? Then why are you so mad when the ISP does it ;) It is their network after all that your connected too.
-
@johnpoz got it, now im clear, its better to have a diff segment for my pihole instead of using the same network on pfsense i should use vlan
-
@agaitan026 Putting you pi-hole on a network dedicated to such things is a good plan. I'm not prepared (no time) at the moment to lay out my setup but I'll say this:
Get your network working with unbound as a resolver.
Setup your DHCP and Unbound to register leases and static mappings in unbound. Set hosts names along with your static mappings in dhcp.
Add the pi-hole on a vlan/network of it's own or with other like devices.
Tell your devices (not the ones on the vlan with the pi-hole or the pi-hole) to use the pi-hole for dns with dhcp.
Use NAT to redirect (to the pi-hole) those who don't listen to dhcp, if you want.
Your devices would then use pi-hole which would then forward to pfsense (unbound).
Setup pi-hole to do 'conditional forwarding' (It's in pi-hole dns settings) so that the logs show the hostname dot local domain name.Sounds more complicated than it is. When time permits I'll post up all the settings in pfsense and pi-hole that are relevant.
-
@jwj sounds good, if its possible for you please share your settings :) thank you
-
@agaitan026 Will do. Might not be today, however. Sorry if the language above is not precise, it will make more sense when you see the settings.
I should add that I like pfblockerng. I use it for some light geo blocking and some other ip lists. I do prefer pi-hole for the GUI and the flexibility to create groups and manage blocklists, blacklisted domains and whitelisted domains on a client by client basis or a group of clients. For example a couple of apps on my Apple TVs will not work unless some domains are whitelisted. I don't want to whitelist them for every client (google ad network stuff), just the apple TV's. With pi-hole you can do that easily directly in the GUI.
-
@jwj correct thats what i like from pihole
-
This post is deleted! -
what i saw with my current setup, if i stop pihole, all my conectivity goes down, any chance to have pfsense as backup dns resolver?
-
@agaitan026 Yeah. No DNS resolution but you still can connect to anything by IP.
When it happens, say your on a MAC, you just go to network settings and manually put in the gateway until the problem is fixed. I assume windows has likewise settings. You can do that on an iPhone also.
Mine (on a Raspberry PI) has never died unexpectedly. I guess you could setup two...
I guess the question really is if I have say, 192.168.100.12 and 192.168.10.1 as servers will it use the first always unless the first is unavailable. I'm not sure but I think the answer is no. @johnpoz would know for sure.
-
You can not give a client more than 1 NS and know for sure which one they might query... You just can never know..
If your going to give a client more than 1 NS, then you need to make sure that both NS you give it resolve the same stuff.. For example if 1 filters and the other does not - you can not be sure that the client will use the unfiltered one only if the filtered one is offline.
Not sure were people get the idea that dns is some fragile thing that requires backup.. If it goes down... Yo will know about it - that is for sure.. Just fix it ;) Or point your client to another NS while you do.
The nice thing about dhcp, it is really simple to point your whole network to different NS if you setup goes down for some reason..
Using 2 piholes for example works sure - but now your logs are split and you have to look to both to know what say client ABC looked for, etc.
I have most of my clients use pihole, unless I don't want them being filtered. If so then I set them to use pfsense. If my pihole went down... Which it never has - running on a old pi 3B.. It would take only minutes to point just directly pfsense for dns.
This is my home network - this is not some mission critical network where millions are lost an hour if network is down, etc. Can tell you for damn sure my internet goes out way more often then my dns ;)
Do you have a backup internet connection? I would be putting that in place before ever thinking of needing to run more than 1 pihole on my network.
If your really concerned. Have a 2nd place you can fire up pihole in a couple of minutes. I would take all of 2 minutes for me to fire up a pihole docker or vm.. And then again don't really need that because if pihole went down - I would just point to pfsense directly, until I could get pihole working again. So I run unfiltered dns while I do that - not concern to be honest. So my wife gets a few ads on her game she is playing on the ipad ;)
Clients have a tendency to flip, and check both to see which one is faster, etc. And if for some reason NS1 doesn't answer fast enough, or at all - then switches to 2, and it might not go back to 1 ever or quite some time later. And if you send back a NX, client not going to ask the other one etc. It was told the record didn't exist - so why should it ask another NS? So you could run into a problem where your local records would not resolve, yet all your dns is up.. If your 2 different NS can not resolve the same stuff, etc.
You are much better off just using 1 NS, having a fall back you can switch to quickly then trying to running multiple NS at that same time that your clients point to..
Another quick way for recovery, is just bring your backup dns online with the same IP... This is really simple via a docker or VM, or another pi for example.. You could have pihole all setup on some other pi, and if your pihole pi goes down. Just bring up other pi with the same IP or secondary IP that is the same as your other device that was running pi.
Its not like it takes hours to restore dns if where its running currently goes down - shoot in a pinch, just point everything to googledns while you bring up your local cache, etc.
