Support for add-subnet option from dnsmasq (ECS/EDNS0 Client Subnet)

Feature Requests Implemented
75

WOW, I have waited so long for this option :slight_smile:

I would have liked to solve this with the proxy protocol, but it works for now. Maybe the proxy protocol will be implemented as well.

So far I have tested the following, and Pihole now receives the IP address of the requesting client.

Dns over port 53 (lokal network):
LAN -(port 53)-> dnsdist -(dns,53, docker internal)-> pihole --(dns,53, docker internal)-> unbound

DoH:
Internet -(HTTPS,443)-> Haproxy -(HTTP,80, docker internal)-> dnsdist -(dns,53, docker internal)-> pihole --(dns,53, docker internal)-> unbound

DoT:
Internet —(DoT,853)—> dnsdist —(dns,53, docker internal)—> pihole --(dns,53, docker internal)—> unbound

Changes in dnsdist:
To evaluate the X-Forwarded-For header of haproxy (haproxy -> dnsdist) you have to activate the parameter addDOHLocal(..., trustForwardedForHeader=true).
https://dnsdist.org/reference/config.html?highlight=trustforwardedforheader

For EDNS (dnsdist -> pihole) you have to adjust three global parameters

setECSOverride(true)
setECSSourcePrefixV4(32)
setECSSourcePrefixV6(128)

and activate newServer(..., useClientSubnet=true) for pihole.
https://dnsdist.org/advanced/ecs.html

in Pihole Docker container I did the following:

# docker exec -it dnsrec_pihole_1 bash
root@32302c83e05e:/var/log# pihole checkout ftl new/edns0
  Please note that changing branches severely alters your Pi-hole subsystems
  Features that work on the master branch, may not on a development branch
  This feature is NOT supported unless a Pi-hole developer explicitly asks!
  Have you read and understood this? [y/N] y

  [✓] Branch new/edns0 exists
  [✓] Downloading and Installing FTL
  [✓] Restarting pihole-FTL service...
  [✓] Enabling pihole-FTL service to start on reboot...

QUESTION: how can I activate this permanently in the pihole docker container?

Here my futile efforts for the implementation of the proxy protocol:

2 Likes