Guide: How to install Pi-Hole on Gold (Beta)

Follow

Comments

73 comments

  • Avatar
    Brian Shimkus

    Warning...absolutely clueless when it comes to docker networking...

    For the docker network, can I use my existing scheme?

    For example, I use 192.168.250.0/24 for addressing.

    Ideally, I'd like to set the pi-hole instance to 192.168.250.2.

    Thank you in advance for entertaining a rookie question.  :-)

    bks

    1
    Comment actions Permalink
  • Avatar
    Nathan Jones

    @Hans, sorry, I meant to include that.... I am not using Family Protect, Ad block or DNS over HTTPS on FWG. I tried disabling DNS booster for this client and I got the same results with or without DNS booster enabled. This particular client is hard wired to a switch connected directly to the FWG. I also tried clearing the cache of the DNS Booster using the app. No change.

    0
    Comment actions Permalink
  • Avatar
    Nathan Jones

    In case anyone else gets here through my troubles, I ended up opening a ticket with support. Apparently there was a bug in the iOS Firewalla App that setup the DNS incorrectly on the FWG. v1.40 (46) is supposed to fix it. Support was able to remote in and tweak something to make it work for me in the meantime.

    0
    Comment actions Permalink
  • Avatar
    Blake

    The instructions worked perfectly for me once I straightened out a few errors I made.  I have all of the FWG features on and running, but I don't care if I can't see device level stats on the pi-hole.  I just wanted the additional ad/malware/tracker blocking.  

    This is was also my first docker experience so even a n00b like me can figure this out.

    0
    Comment actions Permalink
  • Avatar
    Tom Jarvis

    Ok, I'm confused! :) 

    Pi-Hole setup and working perfectly, configured for Cleanbrowsing DNS servers. 

    1) If I turn on "Conditional Forwarding" in Settings > DNS, so I can see hostnames from the Firewalla, then the DNS query figures stop incrementing, but it shows hostnames.  If I turn it off, I lose hostnames but the stats increment! 

    2) I downloaded the Pi-Hole Remote App as above, and when using it, clicking on Statistics, it is telling me to check API and Privacy.  API QR scanned, and Privacy setting set to everything. 

    Might be whiskey .. but feeling a little confused! 

    0
    Comment actions Permalink
  • Avatar
    Danny Natale

    @Firewalla

    I made a small change and used the latest image for the docker pull. 

    From:

    image: pihole/pihole:v5.1.2

    To:

        image: pihole/pihole:latest

    Bringing the pihole into my gold seems to have increased my internet performance and now I can turn on all of the firewalla features.  Although per device statistics is a nice to have, turning off DNS booster doesn't work for me because it's an all or nothing and all new devices get it turned on.  Perhaps this will be fixed in the future but not a big deal.

    The firewalla gold is incredible and it has also dramatically simplified my home segmentation strategy.

     

    10/10

    0
    Comment actions Permalink
  • Avatar
    Binh Ton

    I saw there is new Pihole version.  How can I update the existing Pihole docker in FWG?

    0
    Comment actions Permalink
  • Avatar
    Mauricio Guerrero

    I see there’s a note regarding the DNS Booster and how it will interact with the pi-hole. How does the DoH functionality of the Gold interact with the setup?

    0
    Comment actions Permalink
  • Avatar
    Larry Lindenbaum

    Binh Ton, you can do this to update/upgrade:

    Before changing it you may want to backup your config of whitelists/blacklists/adlists/etc by logging into the admin page and going to settings then teleporter to download the config to your local machine.  That way you can restore it all easily after the upgrade by loading it back from the same spot in the interface though honestly that should not be necessary as the config information is being stored in the persistent volumes created in this guide (with a few minor exceptions).

    Remove the existing Docker container for pihole by getting the imageID from "sudo docker ps -a" if you are running multiple docker images and you want to keep the other containers and then remove that container with "sudo docker rmi -f <imageID>" ("sudo docker rm -f pihole" should also work) otherwise just stop all of your containers with "sudo docker stop"  and then "sudo docker prune -a -f" will remove them all as well as the networks attached to the containers.

    Then change your pihole yaml config to read image: pihole/pihole:latest (or just image: pihole:pihole:v5.2.1 which is the explicit new version I believe) instead of the existing line that says image: pihole/pihole:v5.1.2

    After that you can restart the docker container and network you had used like:

    sudo docker-compose pull
    sudo docker-compose up --no-start
    sudo ip route add 172.16.0.0/24 dev br-$(sudo docker network inspect pi-hole_default |jq -r '.[0].Id[0:12]') table lan_routable
    sudo ip route add 172.16.0.0/24 dev br-$(sudo docker network inspect pi-hole_default |jq -r '.[0].Id[0:12]') table wan_routable
    sudo docker-compose up --detach

    You don't need to do the sudo systemctl start docker at the beginning unless you did a sudo systemctl stop docker for some reason, though you won't get an error if you try to start it while it is already running. 

    Note that using the pihole/pihole:latest instruction will result in Docker always pulling the latest pihole image when you restart your FWG, which will leave you with a bunch of unused containers and may create issues for you later.  I suspect that's why this guide is written to use a specific pihole version, insuring you always can/do delete the old containers before updating.  Do not try and update the pihole image inside the existing container (using "sudo docker exec...").

    Hope that helps.

    Oh, you can if you want when cleaning house between upgrades safely delete anything other than the docker-config.yaml file in your pi-hole directory ( /home/pi/.firewalla/run/docker/pi-hole/ if you used the instructions above) and let it recreate itself after the container restarts.  I'm not sure there is a reason to do it unless possibly a new version would require some mandatory changes to the etc-dnsmasq.d directory/files and I doubt that is terribly likely, but it'll get recreated when you start the new container anyway...

     

    0
    Comment actions Permalink
  • Avatar
    Larry Lindenbaum

    @Brian Shimkus

    While you can change the network driver from the config file to specify "host" instead of "bridge" and create your container in the existing network space, it does not get assigned an ip address and would use the localhost address for everything.  Also, I THINK that Firewalla has already pre-assigned the Docker network to be 172.17.0.0/24 so my guess is you'd end up with an address in that space unless you also go ahead and reassign the entire docker network to use the host driver.  Anyway, this seems overly complicated and I am not sure what you're really going to get out of it in the end.  It's potentially helpful if you're running something in a container that requires a whole lot of port forwarding, as that eliminates the need to specify the ports.

     

    @Mauricio Guerrero: Should not interfere with anything if you enable it and should still work as intended.

     

     

    0
    Comment actions Permalink
  • Avatar
    Rob Abbott

    This is fantastic.  Thanks to all that contributed to this! 

    I have the DoH configuration running.  One thing I noted was that I had to turn off the "DNS over HTTPS" function in the FWG to get a consistent "Yes" hit from http://1.1.1.1/help

    Before I turned that off, I would randomly get Yes or No.

    0
    Comment actions Permalink
  • Avatar
    Brian Newbold

    Any guidance on installing on a Blue Plus?

    Here's the environment:

    • Blue Plus in Simple mode, IP set via DHCP reservation
    • Docker is up and running (had to apt-get install nano first, as only VIM was available)
    • Homebridge is up and running
    • Portainer is up and running (in case it's useful)

    Following the Gold guide for pi-hole my docker-compose.yaml file is identical except my network is as such:

    • ipv4_address: 192.168.86.19
    • - subnet: 192.168.86.0/24

    In STEP 2 of the guide is where I hit the roadblock:

    • sudo ip route add 192.168.0.0/24 dev br-$(sudo docker network inspect pi-hole_default |jq -r '.[0].Id[0:12]') table lan_routable
      
    • sudo ip route add 192.168.0.0/24 dev br-$(sudo docker network inspect pi-hole_default |jq -r '.[0].Id[0:12]') table wan_routable
      
    • BOTH of these calls return:
      Error: argument "lan_routable" is wrong: "table" value is invalid
    • sudo docker-compose up --detach
    • Fires up with Starting pihole ... done
    • Portainer shows pihole as unhealthy, I have access to the log file from here

    Any advice on how to proceed?

     

    0
    Comment actions Permalink
  • Avatar
    Larry Lindenbaum

    @Brian Newbold:

    Happy to try and help but shouldn't the install for the Blue Plus be the same as for the Blue and NOT the same as the Gold?  The Blue install is super easy:

    https://help.firewalla.com/hc/en-us/articles/360034635473-Tutorial-Running-Pi-Hole-on-Firewalla-Blue-in-5-mins

    If that's not the problem, post back 8)

    0
    Comment actions Permalink
  • Avatar
    Brian Newbold

    Blue plus supports docker and makes things nice and convenient... I suppose i'm on the >-5-mins route now :-)

    0
    Comment actions Permalink
  • Avatar
    Larry Lindenbaum

    Ahh, I didn't realize that.  Do you know what the default docker network is on the Blue plus?  I am wondering if you just need to change the network driver from bridge to host (then you can get rid of the ip route add commands entirely) or if instead you need to change the ip route command to something like ip route add <network> via <docker network> dev eth0 (or something similar).

    You set the pihole address to 192.168.86.19 on a /24 subnet but then tried to set your route to a network at 192.168.0.0/24 so that wouldn't work anyway (unless you just pasted it wrong).  What is the network of your home LAN?

    I'll caveat this all with the fact I have never used a Blue or Blue plus though 8) 

    0
    Comment actions Permalink
  • Avatar
    Brian Newbold

    Update:
    Added entries on rt_tables let me run ip route add command.

    /etc/iproute2/rt_tables
    Added: 
    202  lan_routable
    201  wan_routable

     

    Still no pihole, and unhealthy docker container.

    0
    Comment actions Permalink
  • Avatar
    Brian Newbold

    Got things fired up but still a bit untested

    Following this guide: https://homenetworkguy.com/how-to/install-pihole-on-raspberry-pi-with-docker-and-portainer/

    However, I used Larry's advice on HOST networking.
    And, I used the latest 5.2.1 image. (note, not using pihole:latest due to advice of available storage where additional future pulls would leave old images as clutter)

    Blending everything together, I found this to be an efficient process:

    • Install portainer (highly suggested, makes things simple, in the link)
    • Edit the compose file.
      Update image version to 5.2.1 or as desired
      Comment out the network info, ipv4_address to the bottom of the page. 
    • Run docker-compose up --no-start
      This creates the container according to firewalla spec above
    • Edit the newly created container in portainer, my setup shown below.

    0
    Comment actions Permalink
  • Avatar
    Larry Lindenbaum

    Nice!  I like that portainer has the ability to autoremove the container (I have never used it).  Your point on using the latest release bothers me as well on the Gold.  I should probably modify the autostart script to delete all existing docker containers and let it pull the latest image again though.  I don't know why I didn't think about that before your comment!

    Or maybe just try portainer... lol

    In the meantime I need to get back to making AdguardHome work on the Gold. And still do my xmas shopping...

     

    1
    Comment actions Permalink
  • Avatar
    Greg

    Is there any way to build this into the the FWG.  I'm not a complete novice but I'm very intimidated to try this on my own, now that I have my network and FWG all setup and working perfectly.  

    0
    Comment actions Permalink
  • Avatar
    Rob Dennison

    The OP script doesn't appear to work for me.

    After entering:

    sudo ip route add 172.16.0.0/24 dev br-$(sudo docker network inspect pi-hole_default |jq -r '.[0].Id[0:12]') table lan_routable

    I get the following error:

    Error: No such network: pi-hole_default
    Cannot find device "br-null"

    Now it seems to me (and I admit, Docker is relatively new to me) that the YAML file at no point specifies a pi-hole_default network, in fact the script only uses the word "pihole", never "pi-hole", so I'm not sure how a pi-hole_default network would have been created.

    Is there something I'm missing here? I can see that this tutorial has been up for a while and people are obviously having success... what am I missing?

     

    0
    Comment actions Permalink
  • Avatar
    Larry Lindenbaum

    @Rob Dennison:

    The network is defined between the services tage specifying "pi_hole" and the network tag specifying "default".

     

    As to your issue, I have a question: any chance you didn't delete the ~ or # that appears by default in some editors when you create a new file?  It just sounds to me like the issue is that the network line (at least) somehow got commented out in your .yaml file.  Reopen it in nano or vi or whatever you use and check.

    1
    Comment actions Permalink
  • Avatar
    Rob Dennison

    Thanks for responding @Larry Lindenbaum, but I cannot see "pi_hole" in the YAML file at the top of this page, just "pihole".

    The only underscores in the YAML file are in "container_name", and "ipv4_address".

     

    In answering your second question, no there aren't any rogue tildes or hashes... screencap here:

    Not asking for a review of my code... just a quick look at the OP's YAML file to see if I've got this right or wrong. 

    Thanks again!

    1
    Comment actions Permalink
  • Avatar
    Larry Lindenbaum

    Doh!  You are correct -- I name the directory the same as my services container, it takes it from the directory it finds the yaml in (here created as pi-hole) 

    Your Gold is running the 1.971 software?  I think before the 1.971 you needed to use a different network, 172.0.0.0/24 not 172.16.0.0/24

    Also just double checking there were no errors on the docker-compose pull or up commands?

     

     

    0
    Comment actions Permalink
  • Avatar
    Rob Dennison

    Yes - running 1.971 software. There were no errors on docker-compose pull or up commands: 

    0
    Comment actions Permalink
  • Avatar
    Rob Dennison

    But wait - as I'm going back through the commands, I see that I put the YAML file in the docker folder, not docker/pi-hole, which is very likely my problem. Let me try this again...

    0
    Comment actions Permalink
  • Avatar
    Larry Lindenbaum

    That'll do it!  

    0
    Comment actions Permalink
  • Avatar
    Rob Dennison

    After moving the YAML file into docker/pi-hole, the "up" won't work because "pool overlaps with other one on this address space"

    I removed the old route ("sudo ip route del 172.16.0.0/24"), so the only route left that's close is 172.17.0.0/16. There is also a default route through my WAN IP, but I don't think I should touch that ;)

    The rest are VPN, upstream DNS and LAN.

    sudo docker ps -a

    shows no containers (running or not), but 

    sudo docker network ls

    shows the following networks

    NETWORK ID NAME DRIVER SCOPE
    b2070f2cd3f5 bridge bridge local
    eb90dc2fedb3 docker_default bridge local
    079641ced105 host host local
    8208d92558af none null local

    That docker_default looks suspect because I learned earlier in this thread that the network created is based on the folder the YAML file is in, so this could have been created when I UPed the container from run/docker. The network name "docker_default" is scary, but when I inspect it:

    sudo docker network inspect eb90dc2fedb3
    [
    {
    "Name": "docker_default",
    "Id": "eb90dc2fedb3edbd364818f895ecb9ff917522fd023b4dabaa69c91e9634baeb",
    "Created": "2021-01-03T17:43:32.309277911Z",
    "Scope": "local",
    "Driver": "bridge",
    "EnableIPv6": false,
    "IPAM": {
    "Driver": "default",
    "Options": null,
    "Config": [
    {
    "Subnet": "172.16.0.0/24",
    "Gateway": "172.16.0.1"
    }
    ]
    },
    "Internal": false,
    "Attachable": true,
    "Ingress": false,
    "ConfigFrom": {
    "Network": ""
    },
    "ConfigOnly": false,
    "Containers": {},
    "Options": {},
    "Labels": {
    "com.docker.compose.network": "default",
    "com.docker.compose.project": "docker",
    "com.docker.compose.version": "1.25.4"
    }
    }
    ]

    This looks like the culprit. Before I go all "sudo docker network rm eb90dc2fedb3" on this, is there something I'm missing?

    I don't want to irreparably break things here so I have to reflash the Gold and rebuild the network config, rules, groups, etc.

    0
    Comment actions Permalink
  • Avatar
    Rob Dennison

    Nope - DNS now broken... I think maybe I shouldn't have deleted that route ><

    0
    Comment actions Permalink
  • Avatar
    Larry Lindenbaum

    The beautiful thing about the Firewalla is that rebooting it will restore things to a good state and you can run the docker-compose commands again 8)

    Though honestly removing that route and then finishing the setup should have worked though you might have needed to do a "sudo docker system prune -a -f" in case you had an untagged image that was still using the network (or trying to).  That command should also remove all stopped networks anyway, so that's probably a better option than deleting the network directly.

    0
    Comment actions Permalink
  • Avatar
    Eric Hawley

    How do we port forward (and firewall restrict to a certain external network range) to the docker container?  

    (want to make containerized Pihole DNS on FWG available externally to a specific network)

     

    0
    Comment actions Permalink

Please sign in to leave a comment.