# Make pihole-FTL bind only on certain IPs \[v4.0\]

**URL:** <https://discourse.pi-hole.net/t/make-pihole-ftl-bind-only-on-certain-ips-v4-0/11883>\
**Category:** Help\
**Tags:** v4-0\
**Created:** [August 14, 2018, 5:35pm UTC](https://discourse.pi-hole.net/t/make-pihole-ftl-bind-only-on-certain-ips-v4-0/11883 "2018-08-14T17:35:33Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Slippery](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/s/85e7bf/32.png) [@Slippery](https://discourse.pi-hole.net/u/Slippery)\
**Post date:** [August 14, 2018, 5:35pm UTC](https://discourse.pi-hole.net/t/make-pihole-ftl-bind-only-on-certain-ips-v4-0/11883/1 "2018-08-14T17:35:33Z")

</div>

I recently upgraded to pihole v4.0 and I can't force the DNS resolver to listen only on certain IPs.

My set-up is like a special VPN concentrator and I need different DNS resolver for different subnets. Since pihole-FTL seems to always bind to 0.0.0.0 I cannot start any different daemon on port 53.

## Expected Behaviour:

The DNS service (pihole-FTL) should listen only on specified IP (e.g. 10.10.0.1)

## Actual Behaviour:

pihole-FTL listens on 0.0.0.0 for both IPv4/IPv6

```
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name Timer
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 15631/lighttpd off (0.00/0/0)
tcp 0 0 0.0.0.0:53 0.0.0.0:* LISTEN 15798/pihole-FTL off (0.00/0/0)
tcp 0 0 127.0.0.1:4711 0.0.0.0:* LISTEN 15798/pihole-FTL off (0.00/0/0)
tcp6 0 0 :::80 :::* LISTEN 15631/lighttpd off (0.00/0/0)
tcp6 0 0 :::53 :::* LISTEN 15798/pihole-FTL off (0.00/0/0)
tcp6 0 0 ::1:4711 :::* LISTEN 15798/pihole-FTL off (0.00/0/0)
udp 0 0 0.0.0.0:53 0.0.0.0:* 15798/pihole-FTL off (0.00/0/0)
udp6 0 0 :::53 :::* 15798/pihole-FTL off (0.00/0/0)

```

## Debug Token:

ptofzbqjhe

---

<div class="post-metadata">

**Author:** ![deHakkelaar](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dehakkelaar/32/674_2.png) [@deHakkelaar](https://discourse.pi-hole.net/u/deHakkelaar)\
**Post date:** [August 15, 2018, 3:37am UTC](https://discourse.pi-hole.net/t/make-pihole-ftl-bind-only-on-certain-ips-v4-0/11883/4 "2018-08-15T03:37:52Z")

</div>

Try the "`listen-address=`" directive:

```
pi@noads:~ $ man dnsmasq
[..]
  -a, --listen-address=<ipaddr>
        Listen on the given IP address(es). Both --interface and --lis‐
        ten-address options may be given, in which case the set of both
        interfaces and addresses is used. Note that if no --interface
        option is given, but --listen-address is, dnsmasq will not auto‐
        matically listen on the loopback interface. To achieve this, its
        IP address, 127.0.0.1, must be explicitly given as a --listen-
        address option.

[..]

```

You can put that directive in a new dnsmasq config file that will be read by pihole-FTL:

`sudo nano /etc/dnsmasq.d/99-my-settings.conf`

---

<div class="post-metadata">

**Author:** ![Slippery](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/s/85e7bf/32.png) [@Slippery](https://discourse.pi-hole.net/u/Slippery)\
**Post date:** [August 16, 2018, 10:54am UTC](https://discourse.pi-hole.net/t/make-pihole-ftl-bind-only-on-certain-ips-v4-0/11883/5 "2018-08-16T10:54:21Z")

</div>

I just did a test but the configuration seems to be ignored and it keeps listening on 0.0.0.0

For completeness this is the conf file:

> ```
> root@vps:~# cat /etc/dnsmasq.d/02-pihole-my.conf 
> listen-address=::1,127.0.0.1,10.10.0.1
> root@vps:~# ls -la /etc/dnsmasq.d/
> total 60
> drwxr-xr-x 2 root root 4096 Aug 16 12:27 .
> drwxr-xr-x 83 root root 45056 Aug 14 19:07 ..
> -rw-r--r-- 1 root root 1522 Aug 14 19:07 01-pihole.conf
> -rw-r--r-- 1 root root 64 Aug 16 12:27 02-pihole-my.conf
> 
> ```

Actually I used the "`listen-address=`" directive on previous pihole versions to achieve my goal. On v4.0, however, the standard dnsmasq installation seems to be dropped and embedded in pihole-FTL. In fact I totally uninstalled dnsmasq from the system and pihole set-up does not install it anymore.

Moreover pihole-FTL seems to read only its dedicated conf file (no mention of dnsmasq config files in logfiles):

> ```
> root@vps:~# egrep 'conf' /var/log/pihole*.log
> /var/log/pihole-FTL.log:[2018-08-16 12:28:25.689] Starting config file parsing (/etc/pihole/pihole-FTL.conf)
> /var/log/pihole-FTL.log:[2018-08-16 12:28:25.689] Finished config file parsing
> /var/log/pihole-FTL.log:[2018-08-16 12:28:25.690] Successfully accessed setupVars.conf
> /var/log/pihole-FTL.log:[2018-08-16 12:30:24.137] Starting config file parsing (/etc/pihole/pihole-FTL.conf)
> /var/log/pihole-FTL.log:[2018-08-16 12:30:24.138] Finished config file parsing
> /var/log/pihole-FTL.log:[2018-08-16 12:30:24.148] Successfully accessed setupVars.conf
> root@vps:~# egrep '/etc/dnsmasq' /var/log/pihole*.log
> root@vps:~# 
> 
> ```

Was it too early for me to switch to v4.0?

---

<div class="post-metadata">

**Author:** ![deHakkelaar](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dehakkelaar/32/674_2.png) [@deHakkelaar](https://discourse.pi-hole.net/u/deHakkelaar)\
**Post date:** [August 16, 2018, 1:34pm UTC](https://discourse.pi-hole.net/t/make-pihole-ftl-bind-only-on-certain-ips-v4-0/11883/6 "2018-08-16T13:34:21Z")

</div>

Seems you also need the "`bind-interfaces`" directive:

```
pi@noads:~ $ cat /etc/dnsmasq.d/99-my-settings.conf
listen-address=::1,127.0.0.1,10.0.0.2
bind-interfaces

pi@noads:~ $ sudo systemctl restart pihole-FTL`

pi@noads:~ $ sudo netstat -nltup | grep 'Proto\|:53 \|:67 \|:80 \|:471'
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:4711 0.0.0.0:* LISTEN 20645/pihole-FTL
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 8101/lighttpd
tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 20645/pihole-FTL
tcp 0 0 10.0.0.2:53 0.0.0.0:* LISTEN 20645/pihole-FTL
tcp6 0 0 ::1:4711 :::* LISTEN 20645/pihole-FTL
tcp6 0 0 :::80 :::* LISTEN 8101/lighttpd
tcp6 0 0 ::1:53 :::* LISTEN 20645/pihole-FTL
udp 0 0 127.0.0.1:53 0.0.0.0:* 20645/pihole-FTL
udp 0 0 10.0.0.2:53 0.0.0.0:* 20645/pihole-FTL
udp 0 0 0.0.0.0:67 0.0.0.0:* 20645/pihole-FTL
udp6 0 0 ::1:53 :::* 20645/pihole-FTL

```

From the man page:

```
   -z, --bind-interfaces
          On systems which support it, dnsmasq binds the wildcard address, even when
          it is listening on only some interfaces. It then discards requests that it
          shouldn't reply to. This has the advantage of working even when interfaces
          come and go and change address. This option forces dnsmasq to really bind
          only the interfaces it is listening on. About the only time when this is
          useful is when running another nameserver (or another instance of dnsmasq)
          on the same machine. Setting this option also enables multiple instances
          of dnsmasq which provide DHCP service to run in the same machine.

```

---

<div class="post-metadata">

**Author:** ![Slippery](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/s/85e7bf/32.png) [@Slippery](https://discourse.pi-hole.net/u/Slippery)\
**Post date:** [August 16, 2018, 3:49pm UTC](https://discourse.pi-hole.net/t/make-pihole-ftl-bind-only-on-certain-ips-v4-0/11883/7 "2018-08-16T15:49:37Z")

</div>

Thank you, the "`bind-interfaces`" did it! 😃

In fact this setting, coupled with "`interface=`" (already set in `/etc/dnsmasq.d/01-pihole.conf`), renders the "`listen-address`" useless, and I get the same results even commenting the latter out.

What was puzzling me, however, was that pihole-FTL still used dnsmasq own location for configuration files. Since a standalone dnsmasq is not needed anymore, IMHO it would be clear to move that files within `/etc/pihole` subdir, wouldn't it?  
May be possible to add also [in the docs](https://docs.pi-hole.net/ftldns/configfile/) that pihole-FTL still honors `/etc/dnsmasq*` files?

Thank-you again for your help @deHakkelaar!

---

<div class="post-metadata">

**Author:** ![deHakkelaar](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dehakkelaar/32/674_2.png) [@deHakkelaar](https://discourse.pi-hole.net/u/deHakkelaar)\
**Post date:** [August 16, 2018, 3:55pm UTC](https://discourse.pi-hole.net/t/make-pihole-ftl-bind-only-on-certain-ips-v4-0/11883/8 "2018-08-16T15:55:44Z")

</div>

> [@Slippery](#):
>
> Since a standalone dnsmasq is not needed anymore, IMHO it would be clear to move that files within `/etc/pihole` subdir, wouldn’t it?

Or maybe symlinks.

```
pi@noads:~ $ sudo ln -s /etc/dnsmasq.d /etc/pihole/

pi@noads:~ $ ll /etc/pihole/
lrwxrwxrwx 1 root root 14 Aug 16 18:03 dnsmasq.d -> /etc/dnsmasq.d

pi@noads:~ $ ll /etc/pihole/dnsmasq.d/
total 24
drwxr-xr-x 2 root root 4096 Aug 16 15:51 .
drwxr-xr-x 92 root root 4096 Aug 9 05:50 ..
-rw-r--r-- 1 root root 1519 Aug 8 20:49 01-pihole.conf
-rw-r--r-- 1 root root 479 Aug 8 20:49 02-pihole-dhcp.conf
-rw-r--r-- 1 root root 349 Nov 23 2017 04-pihole-static-dhcp.conf
-rw-r--r-- 1 root root 211 Apr 12 2017 README

```

Put in a feature request 😉

---

<div class="post-metadata">

**Author:** ![Mcat12](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/mcat12/32/20_2.png) [@Mcat12](https://discourse.pi-hole.net/u/Mcat12)\
**Post date:** [August 16, 2018, 8:48pm UTC](https://discourse.pi-hole.net/t/make-pihole-ftl-bind-only-on-certain-ips-v4-0/11883/9 "2018-08-16T20:48:29Z")

</div>

All of the major modifications to the embedded dnsmasq are noted in the docs, and beyond that everything is the same as normal dnsmasq, so this is already documented.

---

<div class="post-metadata">

**Author:** ![system](https://discourse.pi-hole.net/uploads/default/original/3X/7/c/7c8792f649eeb921c5d2b4c41564ffa873d9a2b8.png) [@system](https://discourse.pi-hole.net/u/system)\
**Post date:** [September 6, 2018, 8:48pm UTC](https://discourse.pi-hole.net/t/make-pihole-ftl-bind-only-on-certain-ips-v4-0/11883/10 "2018-09-06T20:48:33Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.