I recently upgraded to pihole v4.0 and I can't force the DNS resolver to listen only on certain IPs.
My set-up is like a special VPN concentrator and I need different DNS resolver for different subnets. Since pihole-FTL seems to always bind to 0.0.0.0 I cannot start any different daemon on port 53.
Expected Behaviour:
The DNS service (pihole-FTL) should listen only on specified IP (e.g. 10.10.0.1)
Actual Behaviour:
pihole-FTL listens on 0.0.0.0 for both IPv4/IPv6
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name Timer
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 15631/lighttpd off (0.00/0/0)
tcp 0 0 0.0.0.0:53 0.0.0.0:* LISTEN 15798/pihole-FTL off (0.00/0/0)
tcp 0 0 127.0.0.1:4711 0.0.0.0:* LISTEN 15798/pihole-FTL off (0.00/0/0)
tcp6 0 0 :::80 :::* LISTEN 15631/lighttpd off (0.00/0/0)
tcp6 0 0 :::53 :::* LISTEN 15798/pihole-FTL off (0.00/0/0)
tcp6 0 0 ::1:4711 :::* LISTEN 15798/pihole-FTL off (0.00/0/0)
udp 0 0 0.0.0.0:53 0.0.0.0:* 15798/pihole-FTL off (0.00/0/0)
udp6 0 0 :::53 :::* 15798/pihole-FTL off (0.00/0/0)
pi@noads:~ $ man dnsmasq
[..]
-a, --listen-address=<ipaddr>
Listen on the given IP address(es). Both --interface and --lis‐
ten-address options may be given, in which case the set of both
interfaces and addresses is used. Note that if no --interface
option is given, but --listen-address is, dnsmasq will not auto‐
matically listen on the loopback interface. To achieve this, its
IP address, 127.0.0.1, must be explicitly given as a --listen-
address option.
[..]
You can put that directive in a new dnsmasq config file that will be read by pihole-FTL:
I just did a test but the configuration seems to be ignored and it keeps listening on 0.0.0.0
For completeness this is the conf file:
root@vps:~# cat /etc/dnsmasq.d/02-pihole-my.conf
listen-address=::1,127.0.0.1,10.10.0.1
root@vps:~# ls -la /etc/dnsmasq.d/
total 60
drwxr-xr-x 2 root root 4096 Aug 16 12:27 .
drwxr-xr-x 83 root root 45056 Aug 14 19:07 ..
-rw-r--r-- 1 root root 1522 Aug 14 19:07 01-pihole.conf
-rw-r--r-- 1 root root 64 Aug 16 12:27 02-pihole-my.conf
Actually I used the "listen-address=" directive on previous pihole versions to achieve my goal. On v4.0, however, the standard dnsmasq installation seems to be dropped and embedded in pihole-FTL. In fact I totally uninstalled dnsmasq from the system and pihole set-up does not install it anymore.
Moreover pihole-FTL seems to read only its dedicated conf file (no mention of dnsmasq config files in logfiles):
-z, --bind-interfaces
On systems which support it, dnsmasq binds the wildcard address, even when
it is listening on only some interfaces. It then discards requests that it
shouldn't reply to. This has the advantage of working even when interfaces
come and go and change address. This option forces dnsmasq to really bind
only the interfaces it is listening on. About the only time when this is
useful is when running another nameserver (or another instance of dnsmasq)
on the same machine. Setting this option also enables multiple instances
of dnsmasq which provide DHCP service to run in the same machine.
In fact this setting, coupled with "interface=" (already set in /etc/dnsmasq.d/01-pihole.conf), renders the "listen-address" useless, and I get the same results even commenting the latter out.
What was puzzling me, however, was that pihole-FTL still used dnsmasq own location for configuration files. Since a standalone dnsmasq is not needed anymore, IMHO it would be clear to move that files within /etc/pihole subdir, wouldn't it?
May be possible to add also in the docs that pihole-FTL still honors /etc/dnsmasq* files?
All of the major modifications to the embedded dnsmasq are noted in the docs, and beyond that everything is the same as normal dnsmasq, so this is already documented.
