Name resolution on Windows

Help Community Help
1

Team,

See below: any suggestions?

With warm regards - Will

=====

The issue I am facing:
With pihole v6 name resolution on Windows is working different compared to v5.
Pihole (v5 and v6 - not at the same time) is running in a docker container and hosted on a lxc called morpheus.tech.lan with ip 192.168.139.235. This ip is also shown within system and used for the webui.

The Windows system is in subnet 192.168.210.0/24. It has 192.168.210.241 as default gateway. And 192.168.210.235 as dns server for that vlan/subnet.

When running pihole v6 and doing a nslookup of morpheus.tech.lan it says:

Server:  morpheus.tech.lan
Address:  192.168.**210**.235

Name:    morpheus.tech.lan
Address:  192.168.**210**.235

When running pihole v6 and doing a nslookup of logos.tech.lan it says:

Server:  morpheus.tech.lan
Address:  192.168.**210**.235

Name:    logos.tech.lan
Address:  192.168.139.250

When running pihole v5 and doing a nslookup of morpheus.tech.lan it says:

Server:  morpheus.tech.lan
Address:  192.168.**139**.235

Name:    morpheus.tech.lan
Address:  192.168.**139**.235

When running pihole v5 and doing a nslookup of logos.tech.lan it says:

Server:  morpheus.tech.lan
Address:  192.168.**139**.235

Name:    logos.tech.lan
Address:  192.168.139.250

The output of pihole v5 would also be the expected results with pihole v6.

Details about my system:

A docker container hosted by a debian lxc container - both the latest version.

Pihole versions

What I have changed since installing Pi-hole:
Upgrading from v5 to v6 - both are running the same (dnsmasq) settings.

2

And in what way does v6 behave differently?

Also, as always, a debug token would be most welcome.

3

Thank you for the quick response.
Sorry for the confusion - just rephrased the question in the initial post.

Does this help?

The token is: https://tricorder.pi-hole.net/Ay64xpuT/

4

From what I can tell, your issue is that with v6, it's giving you the IP for the VLAN you are on? This seems to be a bug fix, as that is how it should be, yes?

Can we see the nslookup commands you entered?

5

The client is in the vlan called wired.lan and has subnet 192.168.210.0/24.
The pihole-host ip for this vlan/subnet is 192.168.210.235.

The management vlan is called tech.lan and has subnet 192.168.139.0/24
The pihole-host ip for this vlan/subnet is 192.168.139.235.

Within pihole v6 any nslookup with this client shows morpheus.tech.lan with ip 192.168.210.235 as being the dns server for that client. I'm expecting morpheus.wired.lan - the ip is correct.

With pihole v5 any nslookup with the same client shows morpheus.wired.tech and ip 192.168.210.235 as being the dns server. Which is as expected.

In addition, the pihole v6 output of "nslookup morpheus.tech.lan" is 192.168.210.235. I'm expecting 192.168.139.235 as seen with pihole v5.

6

Note that those DNS requests went to a different IP address, i.e. your Windows machine has learned a different DNS server IP.

In both cases, that IP belongs to your Pi-hole, and DHCP ranges for both 192.168.210.0/24 as well as 192.168.139.0/24 subnets have been defined.

Run from your Windows machine, what's the output of:

ipconfig /all | findstr /i "suffix"

ipconfig /all | findstr /i "IPv4"
7

Here is the requested output:

PS C:\WINDOWS\system32> ipconfig /all | findstr /i "suffix"
   Primary Dns Suffix  . . . . . . . :
   DNS Suffix Search List. . . . . . : wired.lan
   Connection-specific DNS Suffix  . :
   Connection-specific DNS Suffix  . : wired.lan
   Connection-specific DNS Suffix  . :
   Connection-specific DNS Suffix  . : reumafonds.lan
   Connection-specific DNS Suffix  . :
   Connection-specific DNS Suffix  . :
   Connection-specific DNS Suffix  . :
PS C:\WINDOWS\system32> ipconfig /all | findstr /i "IPv4"
   IPv4 Address. . . . . . . . . . . : 192.168.210.35(Preferred)

The part that says reumafonds.lan is from a vpn adapter. Which is not with a subnet on pihole.

The point I'm trying to make is that with pihole v5, nslookup morpheus.tech.lan returns 192.168.139.235 - which is correct. While with pihole v6 nslookup morpheus.tech.lan returns 192.168.210.235 - which is not correct.

Yes - both are vlans and subnets on the same pihole - it is just that pihole v6 seems to mixing things up.

8

wired.lan matches the 192.168.210.0 range.

As Windows has acquired a lease through that range, using 192.168.210.235 for DNS is correct, and that also makes the resolution results expected.

The question then would be:
Why does Windows acquire a different lease from your v5's DHCP server?

How is that Windows machine connecting to your network, and how does your router treat it with regards to your VLANs?

If you compare the v6 against the v5 dnsmasq configuration files, would there be any differences, specifically for the 192.168.139.0 range?

9

Ok - so the webui of pihole is only available via morpheus.tech.lan and ip 192.168.139.235.
With pihole v6 the client always gets 192.168.210.235 for morpheus.tech.lan.

How can that client reach the webui then?

Just tested with a debian/linux client - the result is the same.

I just triple checked the dnsmasq config files for both versions. They are exactly the same!

The same applies for the leases - in both versions the clients gets ip 192.168.210.35 with gateway 192.168.210.241 and dns 192.168.210.235 - there are no differences.

So the qustion for pihole v6 (versus v5) remains: why is morpheus.tech.lan resolved as 192.168.210.235? And not 192.168.139.235 is seen in pihole v5?

10

That's already clear: Because your client get's attached to a different subnet.
The question is why do clients get a presumably incorrect DHCP lease?

No doubt your 90-vlan.conf custom configuration file is identical, but the 192.168.139.0 that fails to get activated is from Pi-hole's configuration, and Pi-hole v6 and v5 store that in a different location, and the v6 file looks differently, too.

Are you positive you are comparing the correct configurations?

Your issue is not with the web server, that's just a consequence.
Your issue is the DHCP server assessing your PC's DHCP request as belonging to specific ranges that you don't want it to be in.

I assume you swapped out v5 for v6 without restarting your entire network?

Maybe swapping DHCP servers on the fly left Pi-hole v6 puzzled about DHCP clients unicasts for renewal.

Did you try ipconfig /renew or rebooting your Windows machine, to have it broadcast a proper DHCPDISCOVER yet?

11

What gives you this idea?

=====

To make sure we are on the same page:
Nothing is changed on the client or network site - its the same client connected to the same switchport with the same vlan-id, the same /24-subnet, the same gateway-ip and the same dns-ip. The only difference is on the docker site - switching between pihole-v5 and v6.

The given client is dual boot with Windows and Debian/Linux. And yes - I rebooted more then once, did an "ipconfig /renew". Both os-es are always getting the same (and correct!) ip config and are having the same issue.

I also have a chromebook connected to a different vlan/subnet (i.e. 220). And it has the same issue: the nslookup for morpheus.tech.lan shows the dns-ip for the wifi-vlan/subnet (i.e. 192.168.220.235). All other nslookups are correct - it is just the part that involves the pihole-host where the name resolution is not working as expected.

Another example - this time with reverse lookup:
If I do an nslookup of 192.168.210.235 and 192.168.220.235, the response is always morpheus.tech.lan (with v6). This should not be the case - regardless the subnet the client is actually in.

If I do the same with v5 the response is morpheus.wired.lan (vlan/subnet 210) and morpheus.wifi.lan (vlan/subnet 220) respectively. Which is as expected.

I run out of testing options here... I can try native dnsmasq - if that is of any help...

Again... there is really only one difference... different response from pihole v6 compared to pihole v5. And only for the part that involves dns resolution of the pihole-host itself (i.e. the docker container running with the docker host network). All other dns resolutions are resolving as expected.

12

No, there are two differences, and as explained, the primary difference is with the DNS server that your client is using. The different response is just a result of talking to that different DNS server.

Your client uses the following domain and IP address from a 192.168.210.0 subnet:

It uses a DNS server with an IP from the same 192.168.210.0 subnet:

It does so because it acquired a lease according to your DHCP configuration for your 210 VLAN:

dhcp-range=eth0.210,192.168.210.11,192.168.210.99,168h
dhcp-option=eth0.210,option:router,192.168.210.241
dhcp-option=eth0.210,option:dns-server,192.168.210.235
dhcp-option=eth0.210,option:ntp-server,192.168.210.235
dhcp-option=eth0.210,option:domain-name,wired.lan
dhcp-option=eth0.210,option:domain-search,.

With v5, your client uses a different DNS server from the 192.168.139.0 subnet:

This would indicate that it has acquired its lease from a different set of your v5's DHCP server options, one that points it to use 192.168.139.235 as DNS server.

13

This would indicate that it has acquired its lease from a different set of your v5's DHCP server options, one that points it to use 192.168.139.235 as DNS server.

Again - sorry for the confusion.

That is not what I was trying to say (and is not the case).
The client gets the same ip config in pihole versions (see below).

> PS C:\WINDOWS\system32> ipconfig /all
> 
> Windows IP Configuration
> 
>    Host Name . . . . . . . . . . . . : pandora
>    Primary Dns Suffix  . . . . . . . :
>    Node Type . . . . . . . . . . . . : Hybrid
>    IP Routing Enabled. . . . . . . . : No
>    WINS Proxy Enabled. . . . . . . . : No
>    DNS Suffix Search List. . . . . . : wired.lan
> 
> Unknown adapter OpenVPN-Wintun:
> 
>    Media State . . . . . . . . . . . : Media disconnected
>    Connection-specific DNS Suffix  . :
>    Description . . . . . . . . . . . : Wintun Userspace Tunnel
>    Physical Address. . . . . . . . . :
>    DHCP Enabled. . . . . . . . . . . : No
>    Autoconfiguration Enabled . . . . : Yes
> 
> Ethernet adapter Wired - HP G4 dock:
> 
>    Connection-specific DNS Suffix  . : wired.lan
>    Description . . . . . . . . . . . : Intel(R) Ethernet Controller (3) I225-LMvP
>    Physical Address. . . . . . . . . : 5C-28-86-04-A1-9B
>    DHCP Enabled. . . . . . . . . . . : Yes
>    Autoconfiguration Enabled . . . . : Yes
>    IPv4 Address. . . . . . . . . . . : 192.168.210.35(Preferred)
>    Subnet Mask . . . . . . . . . . . : 255.255.255.0
>    Lease Obtained. . . . . . . . . . : zondag 2 maart 2025 10:07:32
>    Lease Expires . . . . . . . . . . : zondag 9 maart 2025 10:07:32
>    Default Gateway . . . . . . . . . : 192.168.210.241
>    DHCP Server . . . . . . . . . . . : 192.168.210.235
>    DNS Servers . . . . . . . . . . . : 192.168.210.235
>    NetBIOS over Tcpip. . . . . . . . : Disabled

The above is the lease for both pihole versions - nothing related to vlan tech.lan (i.e. 192.168.139.0/24) - let alone morpheus.tech.lan (i.e. 192.168.139.235).

14

Your nslookup result indicates otherwise:

The DNS server IP address used for that lookup is 192.168.139.235.
You'd have to find out why your clients are using that instead of 192.168.210.235.

15

The above was used to illustrate the differences in output between v6 and v5.

Below is what clients show when running pihole v6. And is with the lease parameters as posted previously.

PS C:\WINDOWS\system32> nslookup morpheus.wired.lan
Server:  morpheus.tech.lan
Address:  192.168.210.235

Name:    morpheus.wired.lan
Address:  192.168.210.235

PS C:\WINDOWS\system32> nslookup morpheus.tech.lan
Server:  morpheus.tech.lan
Address:  192.168.210.235

Name:    morpheus.tech.lan
Address:  192.168.210.235

As you can see in the pihole config: the fqdn morpheus.tech.lan is actually 192.168.139.235. And not what the above pihole-v6 wants me to believe (i.e. 192.168.210.235).

16

I don't know why you refuse to accept that the nslookup results you've shared clearly demonstrate that your Windows client is using a different DNS server when acquiring its lease through your v6 than through your v5:

17

That is because this is what pihole v6 is returning?

It is not what I'm expecting based on the lease config of the client.
And it is not what is shown when doing the same in pihole v5.

Perhaps I overlooked something in the pihole v6 config? But what could that be?

18

Please:

As you now describe that morpheus.tech.lan has been defined by your configuration:

Your debug log is void of any such definition.
The only occurrence of morpheus is this:

2025-03-01 00:30:24.575 CET [56M] INFO: ########## FTL started on morpheus! ##########

I can only repeat myself:

19

Yes - I'm aware of the different places and files:
Within v5 there setupVars.conf and pihole-FTL.conf.
In addition, there are a few dnsmasq configs - something that starts with 01-pihole and 04-pihole.

Those where "converted" and merged into pihole.toml (if memory serves me right).
At least they where not there once the upgrade was done.

I will switch back to v5 later today. And create another debug token (i.e. tricorder log).

One question here: what do you recommend for the config setupVard.conf?
Since this is still shown in pihole.toml.

20

Are you saying you are wasting my time by making up those nslookup results rather than posting genuine results?

In that case, you're on your own.