IPv6 and DNS-Over-HTTPS on Pi-hole

Please follow the below template, it will help us to help you!

Expected Behaviour:

I hoped to find IPv6 support for DNS-Over-HTTPS and followed the guide Configuring DNS-Over-HTTPS on Pi-hole on https://docs.pi-hole.net/guides/dns-over-https/.

I added to /etc/default/cloudflared the following

# Commandline args for cloudflared
CLOUDFLARED_OPTS=--port 5053 --upstream https://1.1.1.1/dns-query --upstream https://1.0.0.1/dns-query --upstream https://2606:4700:4700::1111/dns-query --upstream https://2606:4700:4700::1001/dns-query

ran

systemctl restart cloudflared

and

configured

Actual Behaviour:

root@odroid:~# dig @127.0.0.1 -p 5053 google.com

; <<>> DiG 9.11.3-1ubuntu1.8-Ubuntu <<>> @127.0.0.1 -p 5053 google.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26460
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1452
; PAD: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 (".....................................................................")
;; QUESTION SECTION:
;google.com.                    IN      A

;; ANSWER SECTION:
google.com.             163     IN      A       216.58.213.238

;; Query time: 52 msec
;; SERVER: 127.0.0.1#5053(127.0.0.1)
;; WHEN: Fri Aug 16 14:47:32 CEST 2019
;; MSG SIZE  rcvd: 138

but there does not seem to be DoH over IPv6. My provider supports IPv6 and the router is connected to the provider with DS Lite.

root@odroid:~# dig @::1 -p 5053 google.com

; <<>> DiG 9.11.3-1ubuntu1.8-Ubuntu <<>> @::1 -p 5053 google.com
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

Debug Token:

https://tricorder.pi-hole.net/9i9uu5i0w8

From your debug log - none of the assigned IPv6 addresses match the configured address for Pi-Hole:

[✓] IPv6 address(es) bound to the eth0 interface:
   2a04:4540:6d06:db00:8a12:dd8e:fb02:5b00 does not match the IP found in /etc/pihole/setupVars.conf (https://discourse.pi-hole.net/t/use-ipv6-ula-addresses-for-pi-hole/2127)
   2a04:4540:6d15:2600:8a12:dd8e:fb02:5b00 does not match the IP found in /etc/pihole/setupVars.conf (https://discourse.pi-hole.net/t/use-ipv6-ula-addresses-for-pi-hole/2127)
   2a04:4540:6d15:2600:1cd0:827a:30c:cc89 does not match the IP found in /etc/pihole/setupVars.conf (https://discourse.pi-hole.net/t/use-ipv6-ula-addresses-for-pi-hole/2127)
   2a04:4540:6d15:2600:2ffc:c821:14fa:92 does not match the IP found in /etc/pihole/setupVars.conf (https://discourse.pi-hole.net/t/use-ipv6-ula-addresses-for-pi-hole/2127)
   fe80::8a12:dd8e:fb02:5b00 does not match the IP found in /etc/pihole/setupVars.conf (https://discourse.pi-hole.net/t/use-ipv6-ula-addresses-for-pi-hole/2127)

*** [ DIAGNOSING ]: Name resolution (IPv6) using a random blocked domain and a known ad-serving domain
[✓] instagramn.info is :: via localhost (::1)
[✗] Failed to resolve instagramn.info via Pi-hole (fd00::8a12:dd8e:fb02:5b00)
[✗] Failed to resolve doubleclick.com via a remote, public DNS server (2001:4860:4860::8888)

Thanks for the hint. I updated the file:

clpC738

clp41E6

It did not change anything on the tests on https://1.1.1.1/help and https://en.internet.nl/connection/785e49e56c2d49b787125ad73f28d4e0/results

I reran pihole -d and there is still an error:

[i] Default IPv4 gateway: 192.168.178.1
   * Pinging 192.168.178.1...
[✓] Gateway responded.
[i] Default IPv6 gateway: fe80::7eff:4dff:fe95:34c4
fe80::7eff:4dff:fe95:34c4
   * Pinging fe80::7eff:4dff:fe95:34c4
fe80::7eff:4dff:fe95:34c4...
ping: fe80::7eff:4dff:fe95:34c4
fe80::7eff:4dff:fe95:34c4: No address associated with hostname
[✗] Gateway did not respond. 

Gateway is

root@odroid:~ip -6 route | grep default | cut -d ' ' -f 3
fe80::7eff:4dff:fe95:34c4
fe80::7eff:4dff:fe95:34c4

/etc/dhcpcd.conf reads:

# A sample configuration for dhcpcd.
# See dhcpcd.conf(5) for details.

# Allow users of this group to interact with dhcpcd via the control socket.
#controlgroup wheel

# Inform the DHCP server of our hostname for DDNS.
hostname

# Use the hardware address of the interface for the Client ID.
#clientid
# or
# Use the same DUID + IAID as set in DHCPv6 for DHCPv4 ClientID as per RFC4361.
# Some non-RFC compliant DHCP servers do not reply with this set.
# In this case, comment out duid and enable clientid above.
duid

# Persist interface configuration when dhcpcd exits.
persistent

# Rapid commit support.
# Safe to enable by default because it requires the equivalent option set
# on the server to actually work.
option rapid_commit

# A list of options to request from the DHCP server.
option domain_name_servers, domain_name, domain_search, host_name
option classless_static_routes
# Most distributions have NTP support.
option ntp_servers
# Respect the network MTU. This is applied to DHCP routes.
option interface_mtu

# A ServerID is required by RFC2131.
require dhcp_server_identifier

# Generate Stable Private IPv6 Addresses instead of hardware based ones
slaac hardware
interface eth0
        static ip_address=192.168.178.52/24
        static routers=192.168.178.1
        static domain_name_servers=127.0.0.1

Ok, I managed to get the IPv6 gateway working as well. There is still no IPv6 support for DNS-Over-HTTPS as per the test in the first post.

Is Cloudflared listening on IPv6 locally?

Try dig @127.0.0.1 -p 5053 google.com AAAA as well to see if it returns the IPv6 addresses. You may not need IPv6 since and IPv4 resolver can hand out AAAA records just as easily as A records.

; <<>> DiG 9.11.3-1ubuntu1.8-Ubuntu <<>> @127.0.0.1 -p 5053 google.com AAAA
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56652
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1452
; PAD: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 (".........................................................")
;; QUESTION SECTION:
;google.com.                    IN      AAAA

;; ANSWER SECTION:
google.com.             1       IN      AAAA    2a00:1450:4005:80b::200e

;; Query time: 51 msec
;; SERVER: 127.0.0.1#5053(127.0.0.1)
;; WHEN: Fri Aug 16 20:25:56 CEST 2019
;; MSG SIZE  rcvd: 138

However

So just use 1.1.1.1 and 1.0.0.1 as the upstreams and take out the IPv6 ones. You'll get the same answers from IPv4 as IPv6 and save the headache of trying to get IPv6 right.

Why do get then this error message?

What does https://ipv6-test.com show for your connectivity?

You don't have IPv6.

I do have IPv6

Then something is not configured correctly as the ipv6-test checks for IPv6 connectivity across the internet. And that test said you have no global internet IPv6.

Please see these snipets from pihole -d I do have a global IPv6. DoH is not using it.

Then back to the question I asked earlier, is cloudflared listening on IPv6?

The check on ipv6-test showing that the browser does not have IPv6 connectivity is telling that it doesn't matter if you have IPv6 AAAA records resolved, the client can't use them.

My suggestion is to just disable IPv6 on the router and forget about IPv6. You don't gain anything from having it enabled and it causes a lot of issues for people that are not well versed in networking.

And what if I want to reach a Nextcloud from a user that only provides IPv6?

I cannot disable IPv6 on the router as I only have DS Lite, not Dual Stack.