Pi-Hole with Meraki DHCP

Expected Behaviour:

Ping to hostname resolves to LAN IP address.

Components

  • DHCP Server = Meraki MX84

  • Managed Switch = Avaya BAYSTACK5540

  • PiHole Box = Dell Optiplex 7020 128GB SSD 4GB RAM

  • PiHole OS = Ubuntu 18.04 LTS

  • PiHole Version = 5.1.1

  • DHCP Server has 5 VLANs: 192.168.XXX.0/24

  • Each VLAN has identical configuration:

    • 1 day lease
    • Custom nameserver: PiHole IP
    • DHCP Options: Code 15 (Domain) acme.com
    • VLAN gateway is 192.168.XXX.2

PiHole Config: Is this in the Tricorder "readings"?
Using Unbound as per Pi-Hole Docs > Guides > Unbound

Actual Behaviour:

Clients on each VLAN accept DHCP assignments normally.
Clients on each VLAN show PiHole as the only DNS server.
Clients do respond to ping on the IP address.
Clients do NOT respond to ping on the hostname.
(Admin

Debug Token:

https://tricorder.pi-hole.net/8v9g89os9d

Thank you for your help.

I don't understand the specific problem. Clients cannot load the domain

http://pi.hole/admin

but can load

http://192.168.151.54/admin

?

The issue is that Hostnames do not resolve to IP addresses.
ping SMITH-01 fails but ping 192.168.1.24 works.

*The incomplete line should be "(Admin UI works fine and is accessible at http://pi.hole)"

Pihole doesn't know the hostnames of the clients. You could set up conditional forwarding in pihole to your DHCP server. It (should) know the hostnames of your clients. With 5 VLANs you have to configure it manually via config files in /etc/dnsmasq.d/ as at the moment pihole let you enter only one subnet via GUI. But support for more than one CF field in the GUI is in the pipeline.

Or you could create "Local DNS Records" for all your clients in pihole.

Thanks for the info. That's too bad. That was my main reason for installing Pi-Hole. We need to access 100+ local machines on a daily basis.

The Meraki offers a robust DHCP server (i.e. 5 VLANs) and other security features, but it doesn't perform internal DNS. Any suggestions on what would fit this need?

Best option at the moment is to set up conditional forwarding for all your VLANs manuall by adding the necessary config file in /etc/dnsmasq.d/. In the topic I linked you can find the necessary syntax.

Conditional Forwarding will not help you if your DHCP server doesn't inject the necessary DNS records into its own DNS from the hostname provided by a client during DHCP lease negotiation (e.g. ISC wouldn't do that by default).

You could verify your Meraki's behaviour by issuing the following lookups from your Pi-hole machine:

dig @192.168.xx.xx hostname
dig @192.168.xx.xx -x 192.168.xx.20

Replace 192.168.xx.xx with your Meraki's IP, hostname with a known hostname, and 192.168.xx.20 with that hostname's IP as returned by the first command.

If either command fails to provide the expected answer, CF won't work for you.

Pi-hole's DHCP server will create all necessary DNS entries automatically, so you could try to enable it. However, given your network's size, I'd recommend using dnsmasq's configuraton files to configure it. That provides you with way more options and details than Pi-hole's UI, which is targeted at an average home user.

It would be preferable if you could change this on your router, though.

Some routers may allow you to inject scripts into their DHCP lease process, which could supplement the missing DNS injections (if your router run's a local DNS server instance at all).
Others may allow you to switch to a different DHCP/DNS server like dnsmasq altogether.

I'd recommend checking also with Meraki's documentation and support to properly weigh your available options.

Both commands failed. I ran various combinations to be sure.

Someone suggested today that I simply drop the VLANs and run a single LAN for all 150 clients. That would allow the Windows 10 machines to naturally detect each other (I hope). My predecessor set up the VLANs, and I have no idea why. (we've never met and he left no records behind.)

Thanks again for the input.

Both digs failing indicates that there is no DNS on your Meraki.

Relying on Windows LLMNR (or link-local multicast name resolution) isn't likely to solve your issue either. Just as the name suggests, it is limited to link-local devices. At 150 devices, I doubt they are all on the same segment.

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.