Pihole needs to access DNS servers on the internet on port 53. Be careful not to open port 53 for inbound traffic.