Guide: How to install Pi-Hole on Gold/Purple (Beta)

Follow

Comments

102 comments

  • Avatar
    Larry Lindenbaum

    It's actually fairly simple, and this guide here descibes it pretty well:

    https://docs.docker.com/config/containers/container-networking/

    as does this one:

    https://runnable.com/docker/binding-docker-ports

    You can also use the "ports: HOST:CONTAINER" tags in the YAML config file to specify which ports you want exposed for a given container (since I think those other references talk more to exposing ports in an already running container).  

    The routing to/from the network itself would be configured in the Firewalla Gold app by creating your network segments and then rules to pass (or block) traffic between them.

     

    0
    Comment actions Permalink
  • Avatar
    Pimbox


    I've tried everything but I can't even ping the ip I selected for the pi-hole, I believe the docker has another ip and I don't know how to change it ... my network uses the 192.168.25.0/24 range

    if someone can help me, I will be more thanked!

    0
    Comment actions Permalink
  • Avatar
    Pimbox

    I follow exactly all steps, in the end the ip 172.16.0.2 ping normal, but when i try enter in pi-hole web site interface it show: the page canot be found. Some tip?

     

    ------------------------------------------------------------------------------------

    -----------------------------------------------------------------------------

     My Network is:

    Firewalla Gold eth0: My modem (bridged) connection (stactic ip).

    Firewalla gold eth1 (br1): Vlan in 192.168.25.9 ip (all my devices is in this network)

    Firewalla eth2 (br1): My Server with stactic network ip (192.168.25.222)

    Firewalla eth3 (br0): This port i need change the vlan because i link it in my wireless router wan port and it have a 192.168.25.0/24 in 4 lan ports and wi-fi ips too so WAN port need another range ip (192.168.24.9 in firewalla port)

    I try change the docker ip but its back to 172.17.0.1 when i restart the Firewalla Gold.

    I need fix it to run 2 (very light) dockers: 1 pi-hole and 1 TeamSpeak Server.

    I will be very grateful if anyone can help me, i tried to install the pi-hol keeping the default ipof the tutorial and it also didn´t work. ping the ip (172.16.0.2) but does not enter the page through the browser.

    Here is the picture of my Firewalla Gold config:

     

    0
    Comment actions Permalink
  • Avatar
    Joel Horner

    Be careful about using this on your Firewalla. It works great, for sure. BUT, the default for the logging database retention (365 days) is not overridden. Consequently, the database will continue to grow until it fills up the /data partition. This causes other problems with Firewalla.

    If one does wish to retain this solution running on the Firewalla, updating the pihole-FTL database retention period is recommended.

    As a general rule, I am now leaning toward not running anything but the core Firewalla services on the Firewalla Gold. The storage space seems pretty small and is likely sized for the core purpose of the Firewalla solution and updates.

    I've purchased a Raspberry Pi for the purpose of running ancillary solutions (Pi-hole, Homebridge, etc.). Although the prospect of running multiple services (containers) on the Firewalla is really attractive, weigh that desire against potentially losing Firewalla functionality.

    2
    Comment actions Permalink
  • Avatar
    Rob Abbott

    Thanks for the tip, this is really great info.  I would like to keep pi-hole on the firewalla, so I changed the database retention to 90 days. And I'll keep an eye on disk usage.   My FTL db was already at 508MB, it's been running a little under 90 days.

    Add "MAXDBDAYS=90" in /data/pi-hole/etc-pihole/pihole-FTL.conf and restart the container.

    The FTL db lives in the above directory so you can have a look there if you want to see how much storage it's consuming.

     

    0
    Comment actions Permalink
  • Avatar
    Firewalla

    Totally agree with @Joel, if you do plan to use a lot of storage, please leave the service off Firewalla. (or you can get a USB storage and use that instead) We get too many of these cases in our support, and it is wasting us a lot of time (which we can use for other things) supporting and debug disk full errors.

    0
    Comment actions Permalink
  • Avatar
    Blake

    Wow.  Mine is about 729 MB.  So do I trim this thing down?

     

    0
    Comment actions Permalink
  • Avatar
    Brian Newbold

    I updated pihole-FTL.conf to:
    DBINTERVAL=60
    MAXDBDAYS=30

    It will only write to the DB every 60 minutes in order to save the SD card.

    0
    Comment actions Permalink
  • Avatar
    Brian Newbold

    On Blue+ I'm deploying via portainer now, and have this YAML set up in Stacks. Working quite well and much easier to manage than going to SSH every 5 seconds.

    ---BEGIN YAML 4 PORTAINER STACK---

    version: '2'

    # More info at https://github.com/pi-hole/docker-pi-hole/ and https://docs.pi-hole.net/
    services:
    pihole:
    container_name: pihole
    image: pihole/pihole:latest
    environment:
    - TZ=Los_Angeles/America
    - DNS1=192.168.86.1
    - DNS2=no
    # set a secure password here or the default will be firewalla
    - WEBPASSWORD=yopasswordherebruddah
    # Volumes store your data between container upgrades
    volumes:
    - '/data/pi-hole/etc-pihole/:/etc/pihole/'
    - './etc-dnsmasq.d/:/etc/dnsmasq.d/'
    - '/etc/localtime:/etc/localtime:ro'
    restart: unless-stopped
    network_mode: host
    dns:
    - 127.0.0.1
    - 192.168.86.1
    ports:
    - "53:53"
    - "443:443"
    - "80:80"

    0
    Comment actions Permalink
  • Avatar
    K Kaji

    @Firewalla,

    Totally agree with @Joel, if you do plan to use a lot of storage, please leave the service off Firewalla. (or you can get a USB storage and use that instead)

    I highly recommend you to add a note of this advice at the top of this article :)

    Anyway, I want to thank you for your efforts to develop such a great device, Firewalla Gold!

    0
    Comment actions Permalink
  • Avatar
    Rob Dennison

    I've had the network go down a couple of times now with no explanation, and the only solution is to reboot the Firewalla Gold and have all the devices in the network reacquire IP addresses. Further reflection (and reading this thread) tells me that it's likely the pi-hole container that's blowing up the Firewalla storage, and rebooting clears out that history.

    To me, this means it's really not viable for my network. Is there any way the OP can update the original post (OP?) to account for a change to the pihole-FTL.conf to cap the storage?

    Either that, or maybe the better solution is to run pi-hole on a RPi on a new subnet (discussed here: https://help.firewalla.com/hc/en-us/articles/360062551673-How-to-run-external-pi-hole-on-the-Firewalla-Gold , but there are different issues there), which could maybe use a tutorial?

    Honestly, I'd poke around on it myself, but the amount of time the network would be down while I messed things up and corrected isn't feasible with 2 people WFH and 2 kids SFH here. Smarter people than me probably know how to set this up without having to experiment much.

    Thoughts?

    0
    Comment actions Permalink
  • Avatar
    Ma Ar

    It appears to me that there is some kind of exploit in cloudflared container. I have my setup regularly breached and the logs are pointing to a large amount of activity in dockerd.

    0
    Comment actions Permalink
  • Avatar
    Chris Hewitt

    @Ma At

    Not sure what you mean. Can you explain what you mean that your “set-up [is] regularly breached?” What “exploit” do you think you are seeing?

    What “Cloudflared container”? Are you using Cloudflare DNS over HTTPS in your Pi-Hole docker?

    Can you share the logs?

    0
    Comment actions Permalink
  • Avatar
    Alex M

    Is there a way to set maxdbdays and dbinterval with this approach?

    In a 'non-docker' setup, this would be set in pihole-ftl.conf...

    Thanks in advance!

     

    0
    Comment actions Permalink
  • Avatar
    Andy brown

    The pihole-FTL.conf is located

    /.firewalla/run/docker/pi-hole/etc-pihole

     

    0
    Comment actions Permalink
  • Avatar
    Alex M

    Thanks Andy!
    I was looking and I don't have that directory, in .... /pi-hole/ I only have docker-compose.yaml and etc-dnsmasq.d, which has 01-pihole.conf  and  06-rfc6761.conf...

    No etc-pihole to be seen...

    0
    Comment actions Permalink
  • Avatar
    Andy brown

    should be in yaml file:

    Volumes store your data between container upgrades
        volumes:
          - '/data/pi-hole/etc-pihole/:/etc/pihole/'
          - './etc-dnsmasq.d/:/etc/dnsmasq.d/'
          - '/etc/localtime:/etc/localtime:ro'

     

    0
    Comment actions Permalink
  • Avatar
    Alex M

    Found it!

    It was indeed in the yaml file, and based on that I found that the conf file is in /data/pi-hole/etc-pihole.

    Cheers!

    0
    Comment actions Permalink
  • Avatar
    Alex M

    Btw, anyone tried this docker image that includes pihole and unbound yet?

    https://github.com/chriscrowe/docker-pihole-unbound/tree/master/one-container


    I'm considering giving it a go...

    0
    Comment actions Permalink
  • Avatar
    Andy brown

    https://help.firewalla.com/hc/en-us/community/posts/1500001172701-Pihole-and-Unbound

    Have a look at this before you try.

    Firewalla are looking into it, but I failed to get it work

    0
    Comment actions Permalink
  • Avatar
    Alex M

    In terms of updating, am I doing anything wrong by reapplying the above procedure (I have the yaml file pointing to :latest) and then running

    sudo docker image prune -a

    afterwards to remove old docker images?

    0
    Comment actions Permalink
  • Avatar
    Nathan Piazza

    Hello all,

    I have managed to get pi-hole working as per the tutorial above. My only issue is that I cannot get it to stay persistent. I followed the steps shown in part 4 precisely. However if I restart the Firewalla I am left with a DNS issue as the pi-hole docker does not start on its own. If I manually run the .sh file created or run all commands manually it works without issue again. Any suggestions on how to make the firewalla run that .sh file on start-up?

    2
    Comment actions Permalink
  • Avatar
    Ruger1387

    Is anyone aware of how to enable IPV6 support?

    0
    Comment actions Permalink
  • Avatar
    goldfinger

    I managed to get all client ips to show up in pihole on docker on my firewalla gold.  just needed to create this config file on the firewalla:

    /home/pi/.firewalla/config/dnsmasq_local/00-config.conf

    add the following two lines:

    add-subnet=32,128
    add-mac

    and restart the service

    sudo systemctl stop firerouter_dns
    sudo systemctl start firerouter_dns

    Now I can see what each client is going to instead of just 172.16.0.2

    2
    Comment actions Permalink
  • Avatar
    Sonny Lee

    Are there are security implications of doing this and sending ECS data? I don't think there's an issue with the local pihole seeing additional information regarding partial IP and device MAC address but does any of this information ever get out to a public DNS server? I'm not really familiar with how ECS works and what firerouter does. But if there's no security risk, then this would be a great solution to getting pihole to actually show which device is requesting the DNS resolution.

    0
    Comment actions Permalink
  • Avatar
    Alex M

    Any reason why, for Cloudflared, the version needs to be

     image: cloudflare/cloudflared:2020.12.0

    instead of 2022.3.1?

    Tried it with 2022.3.1 and doesn't seem to work for now.

    Will try again with the older version...

    0
    Comment actions Permalink
  • Avatar
    Alex M

    The solution was here: https://help.firewalla.com/hc/en-us/community/posts/4593345581331-cloudflared-exec-format-error

    @mariusz figured out that the docker version that is being referred to in the opening post doesn't work for the architecture of the Firewalla Purple (maybe it does work for Gold, can't verify).

    0
    Comment actions Permalink
  • Avatar
    Alex M

    I also figured out how to run both Pi-Hole and Unbound in docker (so not using the recently natively implemented Unbound), see https://help.firewalla.com/hc/en-us/community/posts/1500001172701/comments/4941267404435

    0
    Comment actions Permalink
  • Avatar
    Stephen Ball

    In the volumes for Pi-Hole, why

        volumes:
          - '/data/pi-hole/etc-pihole/:/etc/pihole/'
          - './etc-dnsmasq.d/:/etc/dnsmasq.d/'

    instead of

        volumes:
          - '/data/pi-hole/etc-pihole/:/etc/pihole/'
        - '/data/pi-hole/etc-dnsmasq.d/:/etc/dnsmasq.d/'

    ?

    i.e. why is /data/pi-hole being used for the container /etc/pihole, but for but for the container /etc/dnsmasq.d it is being stored in /home/pi/.firewalla/run/docker/pi-hole/

    0
    Comment actions Permalink
  • Avatar
    kyee99

    Would anyone be able to provide step by step instructions on how to update the docker image when a new one is available?  thank you.

    0
    Comment actions Permalink

Please sign in to leave a comment.