No blocking activity on Firewalla install

Help Community Help
1

Expected Behaviour:

Firewalla Blue - install went fine.
FW is in DHCP mode, PiHole is DNS.
FW overlay network points to PH as DNS
Router points to PH as DNS
I have run pi-hole -r to no impact
Debug Token is u1i9q5uaor
Debug log doesn’t show any obvious issues.

I have tried setting DNS for primary network to PH and it has no impact, so it is now NOT set to the PH. Overlay network DNS is always the PH IP.

Actual Behaviour:

Query counter works fine. Just no blocking.
I’d expect some blocking, but it is zero or minimal. Strangely, it works every now and again, blocking up to 10-12% of requests. For example, when i first set the router DNS to the PH IP it works great for about 24 hours. And then goes back down to zero for no reason i can find. Reboots of PH, FW, router, etc., regravity have no impact.

Debug Token:

u1i9q5uaor
Log uploaded Sat morning.

Thanks in advance!
Mike

2

Honestly, if it works for a bit and then doesn't then the issue probably lies with Firewalla. You paid for that device and paid for the support so I think you'll need to follow up with them to find out what they are doing.

3

There are two DHCP servers active on your network:

*** [ DIAGNOSING ]: Discovering active DHCP servers (takes 10 seconds)
   Scanning all your interfaces for DHCP servers
   Timeout: 10 seconds
   
   * Received 300 bytes from eth0:192.168.86.1
     Offered IP address: 192.168.86.21
     Server IP address: 192.168.86.1
     DHCP options:
      Message type: DHCPOFFER (2)
      server-identifier: 192.168.86.1
      router: 192.168.86.1
      domain-name: "lan"
      dns-server: 192.168.86.1
      --- end of options ---
    
   * Received 300 bytes from eth0:192.168.184.1
     Offered IP address: 192.168.184.141
     Server IP address: 192.168.184.1
     DHCP options:
      Message type: DHCPOFFER (2)
      server-identifier: 192.168.184.1
      dns-server: 192.168.86.21
      router: 192.168.184.1
      --- end of options ---

Only one is distributing Pi-hole as DNS server - and that one seems to be on a different subnet altogether.
Even if clients acquire their DHCP lease via the second server, they may still fail to contact Pi-hole if you haven't setup routing and/or your subnet mask accordingly.

You'd have to sort both your DHCP and your subnetworking issues to have your clients make use Pi-hole as their DNS server.

4

True. The google mesh router won’t let me shut off DHCP completely and still use mesh. So it’s dhcp pool is a single IP address, that of the FW. Then the FW is supposed to do DHCP duties using the overlay network. I have them setup per the FW instructions and it seems to be working well otherwise.

I have tried setting DNS of the primary network in FW to the PH but it doesn’t seem to make a difference. FW says that should not be necessary.

Can you point me to a reference to diagnose and learn how to make sure the dhcp and subnets are setup correctly?

Thanks
Mike

5

https://help.firewalla.com/hc/en-us/articles/360021737793-How-to-keep-your-network-unchanged-in-DHCP-mode-Blue-Red-Only-#h_ea3b3434-672b-4c44-9f8f-9033db9f1cc1

Would method 2 help prevent the problem by creating a single subnet?

Mike

6

As long as your client's are receiving Pi-hole's IP as DNS server and they are able to connect to that IP, any network configuration will suffice.

I can't know if the documents you've linked to will help you in creating a working configuration, for the simple reason that I don't know your network and I am not familiar with Firewalla at all.

However, I can say that two DHCP servers may coexist on the same segment/link and manage the same subnet if they are configured for DHCP pools that do not overlap.

In addition, you'd have to make sure that the DHCP server that hands out Pi-hole attracts all clients.
You'd normally do so by restricting the other DHCP server's DHCP pool to exactly those few entries that need a fixed DHCP lease (aka DHCP lease reservation) from it, and if you can, you should define those before bringing in the second DHCP server. Often, the machine running Pi-hole is the only one with such a lease reservation.
With the DHCP pool restricted and all IP addresses leased, any further request for a DHCP should then go unanswered or denied, leaving the otgher server as the sole remaining source for a DHCP lease.

I take it that this is (almost) what you expect your configuration to be already, judging from your following remark:

(Almost, as your DHCP servers don't share the same subnet. That may well be intended by you, though.)

However, your debug log shows both DHCP servers are actually offering an IP address.

So either your restricted DHCP pool is not as small as you think, or your Google router is not respecting your restricted configuration, or your Google router is not among the DHCP servers on Pi-hole's link, i.e. it's on a different network segment.

My (somehow generic) advice would still be the same:
You'd have to sort both your DHCP and your subnetworking issues to have your clients make use of Pi-hole as their DNS server.

Apart from the additional analysis, I can't walk you much further. We're good here at solving and assisting with Pi-hole problems, but yours looks like a networking issue.

It may be time to consider Dan's earlier advice: If Firewalla is a paid product, it could be worth to consult their support channels to solve any issues you have with them specifically. I can't tell though whether your issue is still basic networking or already related to Firewalla.

There may be users around that also run Firewalla and a Google mesh network, so you should consider to alter your topic's title to include those key factors to increase chances they read it and share their experience.

To that same end, I've moved your topic's category to Community help.

7

You’re a genius. I changed the overlay network to be the same as the primary network so that both DNS servers are on same sub and PH seems to be rolling. I’ll give it a couple days to make sure it stays up.

Thanks again.

Mike

8

You’re still a genius, but no luck. Worked perfectly until exactly noon today and then no blocking and only a handful of requests.

Firewalla team is digging into it as well. FWIW, new log is rdq017p7y8.

Thanks,
Mike

9

DNS over HTTPS on FW must be off.

Appears FW drives around PH DNS service with encrypted requests otherwise. Installed secure DNS on PH using the instructions on site here. Works perfectly.

Thanks again for all the help - signed up on patreon.

Mike.