How to make Pihole container to listen to a specific ip/interface?

Help
1

Please follow the below template, it will help us to help you!

Hi I am trying to make pihole container to listen only to a specific IP or interface
This is my configuration

services:                                                                                      
  pihole:                                                                                      
    container_name: pihole                                                                     
    image: pihole/pihole:latest                                                                
    # For DHCP it is recommended to remove these ports and instead add: network_mode: "host"   
    ports:                                                                                     
      - "192.168.178.2:53:53/tcp"                                                              
      - "192.168.178.2:53:53/udp"                                                              
      #- "67:67/udp" # Only required if you are using Pi-hole as your DHCP server              
      - "9080:80/tcp"                                                                          
    environment:                                                                               
      TZ: 'Europe/Zurich'                                                                      
      WEBPASSWORD: 'password'                                                           
      INTERFACE: 'br0'                                                                         
    # Volumes store your data between container upgrades                                       
    volumes:                                                                                   
      - './etc-pihole:/etc/pihole'                                                             
      - './etc-dnsmasq.d:/etc/dnsmasq.d'                                                       
    #   https://github.com/pi-hole/docker-pi-hole#note-on-capabilities                         
    #cap_add:                                                                                  
    #  - NET_ADMIN # Recommended but not required (DHCP needs NET_ADMIN)                       
    restart: unless-stopped

Expected Behaviour:

When I start it with

docker compose start

I expect that it would listen only to the interface br0 or to listent only to the IP specified 192.168.178.2:53

Actual Behaviour:

instead it starts with 0.0.0.0 and I cannot anymore start another DNS at localhost:53

tcp        0      0 0.0.0.0:53              0.0.0.0:*               LISTEN      19330/docker-proxy   
tcp        0      0 127.0.0.1:49449         127.0.0.1:953           TIME_WAIT   -                    
udp        0      0 0.0.0.0:53              0.0.0.0:*                           19351/docker-proxy   
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           410/avahi-daemon: r  

root@raspberrypi:~/pihole# ps -elf|grep docker-prox                                                                                                                                        
4 S root     19330   990  0  80   0 - 179200 futex_ 23:30 ?       00:00:00 /usr/bin/docker-proxy -proto tcp -host-ip 0.0.0.0 -host-port 53 -container-ip 172.22.0.2 -container-port 53     
4 S root     19336   990  0  80   0 - 185923 futex_ 23:30 ?       00:00:00 /usr/bin/docker-proxy -proto tcp -host-ip :: -host-port 53 -container-ip 172.22.0.2 -container-port 53          
4 S root     19351   990  0  80   0 - 185923 futex_ 23:30 ?       00:00:00 /usr/bin/docker-proxy -proto udp -host-ip 0.0.0.0 -host-port 53 -container-ip 172.22.0.2 -container-port 53     
4 S root     19357   990  0  80   0 - 179200 futex_ 23:30 ?       00:00:00 /usr/bin/docker-proxy -proto udp -host-ip :: -host-port 53 -container-ip 172.22.0.2 -container-port 53

Debug Token:

[https://tricorder.pi-hole.net/iz42Kwsd/)]

2

You are configuring Pi-hole within the container to listen to br0, not the host.

Your issue isn't with Pi-hole's container, but with Docker's docker-proxy.
It is docker-proxy that binds the unspecified 0.0.0.0 address.

I am not aware of a way to control docker-proxy to bind to a specific interface instead.

You'd have to consult Docker's documentation and support for details on if and how to have docker-proxy actually bind only specific IPs or interfaces.

Alternatively, you may try to switch your Pi-hole container's network driver to macvlan instead of using Docker's default bridge. This would assign a separate virtual network interface and separate IP to your Pi-hole container.

3

HI @Bucking_Horn ,
thanks for your suggestions.
In fact I didn't find any way to customize docker-proxy.
However the idea to start Pi-hole on a different VLan could work.

Will try it.
Thanks

4

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.