I am experimenting with running Pi-hole v6 on an Android TV box using Termux with an Ubuntu PRoot environment

Help Community Help
1

The issue I am facing:

I am experimenting with running Pi-hole v6 on an Android TV box using Termux with an Ubuntu PRoot environment.

Pi-hole installs successfully and FTL starts, but FTL cannot bind to the normal DNS port 53:

dnsmasq: failed to create listening socket for port 53: Permission denied
FTL started!

I confirmed that this is not simply another service occupying port 53 by testing a direct UDP bind from Python:

PermissionError: [Errno 13] Permission denied

If I change the Pi-hole DNS port to 5353, FTL starts and DNS works correctly.

The Pi-hole web interface has also been changed to port 8080, and that works correctly.

So my current working configuration is:

Pi-hole FTL/DNS: 5353
Pi-hole Web UI:  8080

The remaining problem is finding a way to make the Android TV box accept normal DNS requests on TCP/UDP port 53 and pass them to Pi-hole on port 5353.

Details about my system:

  • Android TV box
  • AArch64 / 64-bit ARM
  • Termux
  • Ubuntu running under PRoot
  • Pi-hole v6
  • FTL v6.7
  • systemd is not PID 1 in this environment

During installation/reconfiguration, Pi-hole reports:

System has not been booted with systemd as init system (PID 1). Can't operate.
Failed to connect to bus: Host is down

I can start/restart FTL manually using:

/etc/init.d/pihole-FTL restart

The Android firmware also has a "root" option. After enabling it, su gives:

uid=0(root) gid=0(root) groups=0(root),1077,1079,3003,9997,20084,50084

However, even from this root shell, attempts to use iptables NAT fail.

For example:

iptables -t nat -A PREROUTING -p udp --dport 53 -j REDIRECT --to-ports 5353

returns:

iptables v1.8.13 (legacy): can't initialize iptables table `nat': Permission denied (you must be root)
Perhaps iptables or your kernel needs to be upgraded.

I therefore appear to have UID 0 but not the kernel capabilities required for binding privileged ports and/or modifying the NAT table.

What I have changed since installing Pi-hole:

I changed the DNS port to 5353:

pihole-FTL --config dns.port 5353

I changed the Pi-hole v6 web interface to port 8080:

pihole-FTL --config webserver.port "8080"

Both of these work and answers DNS.

The web interface is accessible on:

http://<Android-box-IP>:8080/admin/

and FTL successfully listens on port 5353.

I also tried using Android root/iptables to redirect normal DNS traffic:

TCP/UDP 53 -> 5353

but Android denies access to the NAT table even after su.

My main question is:

Is there a supported or practical way to allow Pi-hole FTL to use port 53 in a Termux/PRoot Android environment, or alternatively redirect TCP/UDP port 53 to FTL on port 5353 when Android provides UID 0 but apparently does not provide the necessary network capabilities?

Debug logs:

https://tricorder.pi-hole.net/CfNbBXon/

https://tricorder.pi-hole.net/Ks7IvA9a/

2

I cannot comment on the specifics of Android/Termux but in most environments (Linux at least), ports <= 1024 are considered 'privileged' and often require root to bind to them. Many systemd services now use things like:

AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_NET_ADMIN CAP_SYS_NICE CAP_IPC_LOCK CAP_CHOWN CAP_SYS_TIME

Note the first capability: CAP_NET_BIND_SERVICE...that's how Pi-hole can bind the FTL service to port 53 AND still run as the pihole user.

You may have to see if there is a similar mechanism that can be employed for your setup/experiment.

4

You are asking if there is a "supported" way to do that.

The answer is:
No. Android environments are not officially supported.

Reading your findings, it looks like FTL is working correctly, but the OS won't allow to use port 53.

I don't think you will find answers here. This is actually an Android question, about specific OS permissions capabilities.

You should ask this on Android forums. Maybe someone will know if this is possible and how to do it.