Lessons / Tips On Forwarding DNS to Pihole Upstream

Ran into some issues when setting up pihole as the upstream DNS for Firewalla. Didn't see any wiki articles, so decided to post some solutions here. (Sorry if this is the wrong forum for this.)

The Setup

1. DNS Clients point to FIrewalla (e.g. 192.168.1.1, etc)
2. ISP Network (WAN) Set Upstream Primary & Secondary to Pihole (e.g. 192.168.1.2)
3. DNS over HTTPS / Unbound Disabled
4. DNS Booster (Caching) = On

Issue 1: Internet Check / Network Diagnostic Fails

When Firewalla makes the DNS check as part of healthchecks it will come from your WAN IP in this setup.

Pihole by default is set to drop all "non-local" traffic.

SOLUTION

Settings > DNS > Interface : Change to listen to eth0 (or BIND on eth0)

Issue 2: All clients appear to be Firewalla

When you check query logs in pihole all clients look like the Firewalla interface.

SOLUTION

1. SSH into Firewalla
2. Create a dnsmasq rule file, e.g.:

   $ cat ~/.firewalla/config/dnsmasq_local/zzz-001-forward-ip.conf
   add-subnet=32

3. sudo systemctl stop firerouter_dns

4. sudo systemctl start firerouter_dns