Can Pi-Hole be installed on Firewalla Gold running in router mode?
I'm running Pi-Hole on Firewalla Blue at the moment, but I'm planning to upgrade the Blue to Gold.
Can Pi-Hole be installed on Firewalla Gold running in router mode?
Regards,
-
Pi-hole needs to be installed in a docker container when in router mode for the Gold. The out of the box configuration for pi-hole docker may not work, our engineers are working on a solution now. The problem is the firewalla firewall's are pretty sensitive to the new docker network ...
Should have a fuller installation guide in a couple of weeks.
-
After extensive effort we gave up on trying to install PiHole through the default installation approach on our Gold. We broke some firewall rules in some really cool ways! Trashed the available free drive space too!
Best part is, after all the work, even if we would have been successful, remember that the Gold resets to a default known configuration on reboot (this is great for folks like us who can’t have nice things because we constantly break them).
Hey, Melvin, wanna try the docker solution on our Gold? We’ve got 512GB of free SATA SSD disk space (remember)? First get it working then figure out how to optimize it.
-
@chris join the early access program https://help.firewalla.com/hc/en-us/community/posts/360046872134-Early-Access-Onboarding
When 1.971 release, we will likely write up quick instructions for pi-hole on the Gold. 1.971 also has a hook that will allow you to trigger anything after reboot, so it will give your gold some memory between reboots.
-
@Danny, we just add the reasons here https://help.firewalla.com/hc/en-us/articles/360051284214-Firewalla-Gold-FAQ-and-Known-Issues
```
If client DNS is set to pihole's IP address
Since client and pihole are in the same network, the DNS traffic is directly sent to the pihole and will not go through layer 3 (IP layer) of Gold. Therefore, DNS interception on Gold will not take effect and DNS-based features will not work.
If client DNS is set to Gold's LAN IP
DNS traffic from the client will first be sent to Gold. All kinds of DNS-based features will work and if DNS cache is not hit on Gold, it will be further forwarded to pi-hole in the local network for resolution.
Here is an alternative way to make domain block work with pihole in the network:
-
Create another local network segment on Gold
-
Move the pihole to the newly created network
-
Change the DNS server in the old network's DHCP options to the new IP address of pihole
This way, all DNS traffic from other devices to pihole will go through Gold and DNS-based features will work properly.
```
-
-
I can't get to the pi-hole from my clients, no matter what I try. I think the Firewalla is injecting DNS somehow and bypassing the pi-hole, because even when I set the LAN segments to the Pi, the DNS resolves without going through the pi. I even tried setting my clients to static IPs to a bogus DNS that does not exist, it resolves.
I know my pi-hole works because it will dig correctly from the server.
This is from one of my clients: The server 192.168.1.1 does not exist on my network, yet google resolves. I've rebooted and flushed any cache.
; <<>> DiG 9.10.6 <<>> www.google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48151
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;www.google.com. IN A;; ANSWER SECTION:
www.google.com. 139 IN A 172.217.3.68;; Query time: 33 msec
;; SERVER: 192.168.1.1#53(192.168.1.1)
;; WHEN: Sat Sep 05 10:00:53 EDT 2020
;; MSG SIZE rcvd: 59 -
Here is the dig from the pi-hole - resolves back to 0.0.0.0 as expected. I just cant get my clients to hit it.
dig flurry.com
; <<>> DiG 9.16.1-Ubuntu <<>> flurry.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48132
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0;; QUESTION SECTION:
;flurry.com. IN A;; ANSWER SECTION:
flurry.com. 2 IN A 0.0.0.0;; Query time: 0 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Sat Sep 05 10:32:34 EDT 2020
;; MSG SIZE rcvd: 44 -
Here are the (beta) instructions for pi-hole on the gold. The part regarding persisting the configuration is pending 1.971 early access release (which should be soon)
https://help.firewalla.com/hc/en-us/articles/360051625034
Please sign in to leave a comment.
Comments
23 comments