Conditional Forwarding Command Help

Help
1

Hello,

I'd like to set up Conditional Forwarding and am having trouble figuring out the proper command.

I am not using the Pi-hole as my DHCP Server, that is being handled by my TP Link Deco router.

My Start IP is 192.168.68.50 and the End IP is 192.168.71.250

Can someone please let me know what command I should use for this range and why?

Thanks for the help and please let me know if you need any more info.

2

Your real range should be 192.168.68.0-192.168.71.255, even if you just use 192.168.68.50-192.168.71.250.

Why:

The number of IPs in a subnet range is always a power of 2 (1, 2, 4, 8, 16, ..., 1024, 2048, ...).

There are 2 ways to describe a network range:

  1. using a network mask that represents the bits of that mask, like 255.255.255.0, 255.255.254.0, 255.255.240.0

  2. using CIDR notation, like 192.168.0.0/24, 192.168.68.50/22, etc.

In your case, even if you only use up to 192.168.71.250, the range goes up to 192.168.71.255. Your range contains 1024 IPs (210 addresses).

This range starts with 192.168.68.0 and it ends with 192.168.71.255, but the usable range is actually 192.168.68.1 - 192.168.71.254.

You can use this subnet calculator to understand how the range changes when you change the prefix and the start IP. Enter 192.168.68.50/22 (or 192.168.68.0/22) on the Network Address Block field and hit Enter key. Change the values to learn how they work.

If you want to add this range to the Conditional Forwarding option, you need to know the router IP and then enter the 4 values, separated by comma, like this:

true,192.168.68.50/22,192.168.68.1,domain

  • true will enable this rule;
  • 192.168.68.50/22 is the network range;
  • 192.168.68.1 is the router IP (replace with the correct IP);
  • domain - this is the local domain name specified in your DHCP server (your router) for this to work. You can likely find it within the router DHCP settings.
3

Thank you for the great explanation.

Another basic question, I don't appear to have a domain specified.

Checked my ipconfig and none:

image
image677×146 3.29 KB

Am I looking in the wrong place?

Thank you!

4

Yes and no.

The domain should be shown as the DNS suffix (empty in your screenshot), but I'm not sure if Windows will always show the correct information

You need to look in the router settings. You will need to login into the router admin interface. This information is usually on the Network or LAN/DHCP settings.

5

A reliable way to determine the DNS search/suffix domain is to ask the router:

$ sudo pihole-FTL dhcp-discover
Scanning all your interfaces for DHCP servers and IPv6 routers
Timeout: 6 seconds

* Received 318 bytes from 10.0.0.2 @ eth0
[..]
  DHCP options:
[..]
   domain-name: "home.dehakkelaar.nl"
6

You're right... I forgot the domain is present in pihole-FTL dhcp-discover output.

7

Well its moot if Pi-hole runs in Docker :wink:

EDIT: But as always, there are more ways with Linux if you dont run the Docker host or macvlan "network driver":

$ apt show nmap
[..]
Description: The Network Mapper
 Nmap is a utility for network exploration or security auditing. It
 supports ping scanning (determine which hosts are up), many port
 scanning techniques, version detection (determine service protocols
 and application versions listening behind ports), and TCP/IP
 fingerprinting (remote host OS or device identification). Nmap also
 offers flexible target and port specification, decoy/stealth scanning,
 sunRPC scanning, and more. Most Unix and Windows platforms are
 supported in both GUI and commandline modes. Several popular handheld
 devices are also supported, including the Sharp Zaurus and the iPAQ.

$ sudo nmap --script broadcast-dhcp-discover
[..]
|     Server Identifier: 10.0.0.2
[..]
|     Domain Name: home.dehakkelaar.nl