Noob question about PiHole : selfhosted

[-] rentar42@kbin.social 23 points 10 months ago

The issue is that according to the spec the two DNS servers provided by DHCP are equivalent. While most clients favor the first one as the default, that's not universally the case and when and how it switches to the secondary can vary by client (and effectively appear random). So you won't be able to know for sure which client uses your DNS, especially after your DNS server was unreachable for a while for whatever reason. Personally I've "just" gotten a second Pi to run redundant copies of PiHole, but only having a single DNS server is usually fine as well.

[-] Kir@feddit.it 3 points 10 months ago

This answered my question. Thank you. I guess I will sacrifice redundancy

[-] Froyn@kbin.social 6 points 10 months ago

Or set up a second pi-hole.

[-] dorkage@lemmy.ca 3 points 10 months ago

I run multiple pinholes using keepalived. Then I only use one DNS in my DHCP server. Second pihole will seemlessly take over if the first one goes down whilst using the original DNS address.

Work quite well. I had to learn the hard way that only using a single pihole was just asking for my partner to be mad when it didn't work / when I was doing server maintenance. Now I have multiple and they can all seemlessly take over if any my server nodes are down

[-] Darkassassin07@lemmy.ca 1 points 10 months ago

How do you manage automatically transferring the ip of the main rpi to the backup rpi when the first disappears?

[-] dorkage@lemmy.ca 2 points 10 months ago

Keepalived

[-] bigMouthCommie@kolektiva.social -3 points 10 months ago

clone the Mac address

[-] Darkassassin07@lemmy.ca 1 points 10 months ago

Don't you then run into MAC conflicts?

How do you keep both on the network?

[-] bigMouthCommie@kolektiva.social -2 points 10 months ago

oh. fuck.

Arduino? lol

[-] bigMouthCommie@kolektiva.social -3 points 10 months ago

I'm just spit balling here: backup pi pings munute-ly main pi. if main pi is down 2 pings, it resets Mac and reboots network interface.

[-] Darkassassin07@lemmy.ca 1 points 10 months ago

Then when the main PI returns it creates a conflict...

[-] bigMouthCommie@kolektiva.social -2 points 10 months ago

oh hm...

hmmm

ok. both pis know the live IP and the backup IP, and have the same config: cold boot into backup I and ping live ip

[-] Lordjohn68@lemmy.world 1 points 10 months ago

Keepalived is the way. Gravity sync keeps everything in line. Works like a charm. I migrated yesterday from wifi to wired and cannot be happier. As a bonus did not need to reconfigure pivpn.

[-] mateomaui@reddthat.com 15 points 10 months ago

I would avoid it, as it may use the alternate instead of the pihole at anytime. If you want redundancy, it’s best to have a second pihole.

[-] seedd@lemmy.world 7 points 10 months ago* (last edited 10 months ago)

I tried that, devices just request to alternate dns when they get nothing from pihole. I use adgh, and ig there is a setting where you can set the answer to blocked stuff, like 0.0.0.0, empty..etc. if you set thay to 0.0.0.0, devices won't query 2nd dns (i hope) when adgh is up. But it is best to have a 2nd pihole/adgh, i have one on my proxmox and another on a pi, synced with adgh sync Edit: if you don't have another pi, use nextdns

[-] Darkassassin07@lemmy.ca 6 points 10 months ago

I setup a second pihole for redundancy.

90% of network traffic uses the primary, but some things like to use both or exclusively the secomd one on random days.

I use Gravity-Sync to keep the settings/lists between them identical. (lots of local dns records for local self-hosted stuff, and each device has a static ip + dns record to identify it easily in logs)

[-] Decronym@lemmy.decronym.xyz 4 points 10 months ago* (last edited 9 months ago)

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

Fewer Letters	More Letters
DNS	Domain Name Service/System
PiHole	Network-wide ad-blocker (DNS sinkhole)
VPS	Virtual Private Server (opposed to shared hosting)

[Thread #433 for this sub, first seen 17th Jan 2024, 09:35] [FAQ] [Full list] [Contact] [Source code]

[-] nul9o9@lemmy.world 3 points 10 months ago

I've set my secondary DNS to cloudflare, and my pihole still blocked ads for me. I assumed the secondary DNS server is used only if the primary can't be pinged. But i haven't actually looked into it.

[-] mateomaui@reddthat.com 5 points 10 months ago

I have two piholes, and sometimes both will receive requests at the same time, if there’s a lot of traffic.

[-] Rootiest@lemmy.world 4 points 10 months ago

Yeah this is what I do.

Putting Cloudflare as my secondary would allow some requests to get through and then often the device whose requests went to Cloudflare would continue using Cloudflare for a while.

The best solution I found was to run a second Pihole and use it as the secondary.

You can use something like orbital sync to keep them syncronized

[-] mateomaui@reddthat.com 2 points 10 months ago* (last edited 10 months ago)

Pretty much. Not sure how the router determines which DNS to use, but mine seems to latch onto whichever one serves up results the fastest, which would inevitably be cloudflare direct after the pihole returns enough blocks.

So I use a Raspberry Pi Zero W as a dedicated pihole, and my Pi 4 seedbox acts as its own pihole and as a redundant backup. Then use gravity-sync from the Zero to the 4 to mirror the settings.

[-] Rootiest@lemmy.world 3 points 10 months ago* (last edited 10 months ago)

Another cool trick is using tailscale to ensure your portable devices always can access your Pihole(s) from anywhere and then setting those server's tailscale addresses as your DNS servers in tailscale.

This way you can always use your DNS from anywhere, even on cell data or on public networks

I keep a third instance of Pihole running on a VPS and use it as the first DNS server in tailscale so it will resolve a bit faster than my local DNS servers when I'm away from home

[-] mateomaui@reddthat.com 1 points 10 months ago

Huh, I’ll definitely look into that. Both times I tried to route external pihole access, somehow other mystery services found it and it slowed to a crawl from getting absolutely pounded by requests not from me. Thanks for that tip!

[-] rambos@lemm.ee 3 points 10 months ago

Afaik there is no primary and secondary, you cant tell which one to use. Its best to have 2 piholes, but having 2nd DNS set to nextdns or something like that should be fine if you cant run 2 instances, probably not the best setup tho

[-] AtariDump@lemmy.world 3 points 10 months ago

When it comes to a “secondary”DNS... there is nothing like a primary and secondary DNS server. These indications are quite misleading but many systems adopted it this way. Pihole only list the DNS servers as primary and secondary, because this is what the providers write on their pages. The bad phrasing is supported especially by how Windows handles it.

Most operating systems implement DNS servers as alternatives, not as fallbacks, i.e. they will query any of both servers from time to time, so it is quite likely that you will loose your Pi-hole filtering capabilities (at least partially) [if you specify a secondary DNS server on your network].

The ONLY DNS server you should have set on your network is a/the PiHole(s).

[-] nul9o9@lemmy.world 2 points 10 months ago

Thanks for the clarification. I'll be updating my settings.

[-] TCB13@lemmy.world 3 points 10 months ago* (last edited 10 months ago)

mary DNS Server: Clients will first attempt to use the primary DNS server specified in their network settings. This ser

What's the point tho? If your PiHole fails you need to know otherwise you could be risking days / months of web surfing in the fallback DNS server without even noticing it.

As for a reply, there’s no RFC that specifies that a specific order is applied to DNS servers. So in short, you can't have a fallback that is reliable and most operating systems will just load balance or opportunistically pick between the two.

[-] Kir@feddit.it 2 points 10 months ago

Thank you, this is what I was worrying about. As for the "why", even if my server is quite stable, a shutdown may be necessary and sometimes slowdowns with pi-hole happened. Some redundancy would have been better.

[-] TCB13@lemmy.world 1 points 10 months ago

Well, I'm not sure you read the other comments but there is confirmation that for clients there isn't an order for DNS servers from RFC2182:

The distinction between primary and secondary servers is relevant only to the servers for the zone concerned, to the rest of the DNS there are simply multiple servers.

All are treated equally at first instance, even by the parent server that delegates the zone. Resolvers often measure the performance of the various servers, choose the “best”, for some definition of best, and prefer that one for most queries.

[-] AtariDump@lemmy.world 1 points 10 months ago

Setup two PiHoles

[-] BentiGorlich@gehirneimer.de 3 points 10 months ago

You should put your pihole server in the dns server in the network settings. My mobile devices didn't use my pihole server until I changed the dns server configured there... (I am using a FritzBox as well)

[-] SimonSaysStuff@lemmy.world 1 points 10 months ago

When you specify more than one DNS server for network clients, the order in which these servers are used is not random. The following sequence is observed:

Primary DNS Server: Clients will first attempt to use the primary DNS server specified in their network settings. This server is often considered the default.

Secondary DNS Server: If the primary DNS server is unavailable or unable to resolve a query, clients will then attempt to use the secondary DNS server. This server acts as a backup.

So in OPs case his Pihole will always be used if it's available, and only when it's not will the secondary be used.

[-] mateomaui@reddthat.com 7 points 10 months ago

Except that, as I’ve already mentioned, I have two piholes, and sometimes both will be receiving requests. Based on your description, the second would never receive requests as long as the first is online. Perhaps this is router dependent, but it’s what I’ve observed.

[-] TCB13@lemmy.world 3 points 10 months ago

There's no RFC that specifies that a specific order is applied to DNS servers.

[-] SimonSaysStuff@lemmy.world 0 points 10 months ago

RFC 2182 details the operation and functionality of secondary DNS servers. Which defines/influences how resolvers behave with multiple DNS servers.

[-] TCB13@lemmy.world 0 points 10 months ago* (last edited 10 months ago)

A number of problems in DNS operations today are attributable to poor choices of secondary servers for DNS zones

That RFC is about DNS servers in the context of DNS zones in domain names. Not for a DNS client running DNS queries like an operating system. And the RFC is very clear about this:

The distinction between primary and secondary servers is relevant only to the servers for the zone concerned, to the rest of the DNS there are simply multiple servers.

For your Windows, Linux whatever machine "there are simply multiple DNS servers".

Which defines/influences how resolvers behave with multiple DNS servers.

It doesn't. As I said in another comment "most operating systems will just load balance or opportunistically pick between the two", and there's the relevant part from the RFC:

All are treated equally at first instance, even by the parent server that delegates the zone. Resolvers often measure the performance of the various servers, choose the "best", for some definition of best, and prefer that one for most queries.

[-] AtariDump@lemmy.world 0 points 10 months ago

When it comes to a “secondary”DNS... there is nothing like a primary and secondary DNS server. These indications are quite misleading but many systems adopted it this way. Pihole only list the DNS servers as primary and secondary, because this is what the providers write on their pages. The bad phrasing is supported especially by how Windows handles it.

Most operating systems implement DNS servers as alternatives, not as fallbacks, i.e. they will query any of both servers from time to time, so it is quite likely that you will loose your Pi-hole filtering capabilities (at least partially) [if you specify a secondary DNS server on your network].

The ONLY DNS server you should have set on your network is a/the PiHole(s).

[-] ramble81@lemm.ee 2 points 10 months ago

What you stated is generally a Windows only feature. Other OSes don’t adhere to that. Drives me crazy on Windows Servers too.

[-] arudesalad@sh.itjust.works 1 points 10 months ago

https://fritzhelp.avm.de/help/en/FRITZ-Box-7530-AX-avme/avme/021/hilfe_internet_public_dns I found this guide for the fritz!box to set up a fallback dns, I think it should be on by default as it is on mine but I would read the article just to make sure

[-] Kir@feddit.it 2 points 10 months ago

uh! this is interesting! I'm gonna look into this. Thanks!

[-] AtariDump@lemmy.world 2 points 10 months ago

When it comes to a “secondary”DNS... there is nothing like a primary and secondary DNS server. These indications are quite misleading but many systems adopted it this way. Pihole only list the DNS servers as primary and secondary, because this is what the providers write on their pages. The bad phrasing is supported especially by how Windows handles it.

Most operating systems implement DNS servers as alternatives, not as fallbacks, i.e. they will query any of both servers from time to time, so it is quite likely that you will loose your Pi-hole filtering capabilities (at least partially) [if you specify a secondary DNS server on your network].

The ONLY DNS server you should have set on your network is a/the PiHole(s).

[-] arudesalad@sh.itjust.works 1 points 10 months ago

I'm not sure if this is a response to my comment but the article I linked isn't about setting a secondary dns, the fritz!box has a function that allows it to temporarily change the dns (usually to 8.8.8.8) if the specified dns isn't working. It is separate from the "normal" dns settings.

[-] AtariDump@lemmy.world 1 points 9 months ago* (last edited 9 months ago)

Not sure about that as I never used/seen a Fritzbox, but I stand by “ The ONLY DNS server you should have set on your network is a/the PiHole(s).”

[-] Tolstoy@lemmy.world 0 points 10 months ago

AFAIK the FritzBox switchs mainly to the faster DNS Server. I tried to use Quad9 with cloudfare as the second DNS server, most of the time cloudfare was the used since it was a bit faster.

Selfhosted