Pihole not resolving queries when upstream DNS is on localhost

Help docker
1

Expected Behaviour:

Queries forwarded to upstream DNS from localhost should resolve and return to client

Actual Behaviour:

When Pihole's upstream DNS is pointed to a port on local host, for instance unbound or cloudflared, queries will not be returned to the client.

Debug Token:

1f8ucvtdy4

Comments:

I'm fairly new to Pihole so I'm unsure if this is a particular issue with my unbound/cloudflared configuration, but anytime I change the upstream DNS from i.e., 1.1.1.1 to a local program (currently trying to get unbound to work) then I get no response.

I think it's probably a Pihole configuration issue, because if I use dig or nslookup on the specific port that unbound/cloudflared are running from then I get a response

Querying Pihole directly, currently using 1.1.1.1 as upstream DNS

; <<>> DiG 9.10.6 <<>> pi-hole.net @192.168.50.114 -p 53
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34075
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;pi-hole.net.			IN	A

;; ANSWER SECTION:
pi-hole.net.		1784	IN	A	192.124.249.118

;; Query time: 32 msec
;; SERVER: 192.168.50.114#53(192.168.50.114)
;; WHEN: Wed Jan 20 12:18:08 CST 2021
;; MSG SIZE  rcvd: 56

Querying unbound directly

; <<>> DiG 9.10.6 <<>> pi-hole.net @192.168.50.114 -p 5335
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53744
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1472
;; QUESTION SECTION:
;pi-hole.net.			IN	A

;; ANSWER SECTION:
pi-hole.net.		2758	IN	A	192.124.249.118

;; Query time: 19 msec
;; SERVER: 192.168.50.114#5335(192.168.50.114)
;; WHEN: Wed Jan 20 12:18:59 CST 2021
;; MSG SIZE  rcvd: 56

Querying Pihole directly, using 127.0.0.1#5335 as upstream DNS

; <<>> DiG 9.10.6 <<>> pi-hole.net @192.168.50.114 -p 53
;; global options: +cmd
;; connection timed out; no servers could be reached

Looking at the logs in Pihole I can see that its forwarding my request

Jan 20 12:24:17 dnsmasq[6137]: query[A] pi-hole.net from 192.168.50.205
Jan 20 12:24:17 dnsmasq[6137]: forwarded pi-hole.net to 127.0.0.1

But I never seem to get a response

4 
[✓] IPv4 address(es) bound to the eth0 interface:
   172.19.0.2/16 does not match the IP found in /etc/pihole/setupVars.conf (https://discourse.pi-hole.net/t/use-ipv6-ula-addresses-for-pi-hole/2127)

*** [ DIAGNOSING ]: Setup variables
    BLOCKING_ENABLED=true
    INSTALL_WEB_SERVER=true
    INSTALL_WEB_INTERFACE=true
    IPV4_ADDRESS=0.0.0.0


; <<>> DiG 9.10.6 <<>> pi-hole.net @192.168.50.114 -p 53

Run pihole -r choose reconfigure and change the IPv4 Address to the IP of your Pihole.

6

Let's take a look at your unbound configuration. Please post the output of the following commands from the Pi terminal:

unbound-checkconf

sudo grep -v '#\|^$' -R /etc/unbound/unbound.conf*

Edit - are you running Pi-hole in Docker or on bare metal?

7

Looks like a Docker address.

1 Like
8

I am running it out of docker, so could be an issue with my configuration

docker-compose.yml

version: "3"

services:
  pihole:
    container_name: pihole
    image: pihole/pihole:latest
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "67:67/udp"
      - "80:80/tcp"
      - "443:443/tcp"
    environment:
      TZ: 'America/Chicago'
      WEBPASSWORD: ########
    volumes:
      - './etc-pihole/:/etc/pihole/'
      - './etc-dnsmasq.d/:/etc/dnsmasq.d/'
    cap_add:
      - NET_ADMIN
    restart: unless-stopped
  unbound:
    container_name: unbound
    image: mvance/unbound-rpi:latest
    volumes:
    - './unbound/:/opt/unbound/etc/unbound'
    ports:
    - "5335:53/tcp"
    - "5335:53/udp"
    healthcheck:
      disable: true
    restart: unless-stopped

unbound.conf

server:
    verbosity: 0

    interface: 0.0.0.0
    port: 53
    do-ip4: yes
    do-udp: yes
    do-tcp: yes
    do-ip6: no

    prefer-ip6: no

    harden-glue: yes

    harden-dnssec-stripped: yes

    use-caps-for-id: no

    edns-buffer-size: 1472

    prefetch: yes

    num-threads: 1

    so-rcvbuf: 1m

    private-address: 192.168.0.0/16
    private-address: 169.254.0.0/16
    private-address: 172.16.0.0/12
    private-address: 10.0.0.0/8
    private-address: fd00::/8
    private-address: fe80::/10

    access-control: 127.0.0.1/32 allow
    access-control: 192.168.0.0/16 allow
    access-control: 172.16.0.0/12 allow
    access-control: 10.0.0.0/8 allow

I wonder if I need an access control entry for my pihole address?

9

That's probably a big sign that Unbound isn't running right.

10

That won't work with docker, unless you're running in host mode networking.

What is the address you have in Pi-hole for the upstream?

Edit: Ah, PIHOLE_DNS_1=127.0.0.1#5335. That won't work. That's pointing to the Pi-hole container and not the unbound container.

11

Hmm, I'm pretty new to Docker, didn't realize it would assign a different address. I assumed localhost would work since I could resolve lookups from a separate computer using nslookup ... 192.168.50.144:5335 which should be the port unbound is receiving from. But since thats just my LAN address I could see how it might be different on the actual device.

I suppose I need to configure the network within my docker-compose.yml configuration?

12

The easiest would be to use host mode networking. But yeah, it's probably the networking that is causing the issues.

13

Ended up creating docker network and configured ipv4 addresses for both unbound and pihole and that seemed to do the trick

version: "3"

networks:
  dns_net:
    driver: bridge
    ipam:
        config:
        - subnet: 172.20.0.0/16

services:
  pihole:
    container_name: pihole
    image: pihole/pihole:latest
    networks:
      dns_net:
        ipv4_address: 172.20.0.6
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "67:67/udp"
      - "80:80/tcp"
      - "443:443/tcp"
    environment:
      TZ: 'America/Chicago'
      WEBPASSWORD: #######
    volumes:
      - './etc-pihole/:/etc/pihole/'
      - './etc-dnsmasq.d/:/etc/dnsmasq.d/'
    cap_add:
      - NET_ADMIN
    restart: unless-stopped
  unbound:
    container_name: unbound
    image: mvance/unbound-rpi:latest
    networks:
      dns_net:
        ipv4_address: 172.20.0.7
    volumes:
    - './unbound/:/opt/unbound/etc/unbound'
    ports:
    - "5053:5053/tcp"
    - "5053:5053/udp"
    healthcheck:
      disable: false
    restart: unless-stopped

Then set the upstream DNS for pihole to point to 172.20.0.7#5053

14

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.