Unsure if IPv6 DNS server is advertised on LAN

Help
1

Hi,

Been awhile since my last posting, but having read Lots of queries but very little adblocking - Help - Pi-hole Userspace I suddenly became bit worried over my own setup, and decided to open new post in order not to high-jack to other post.

Current setup:
Running Pi-hole (Core v6.1.4 FTL v6.2.3 Web interface v6.2.1) as DNS server on Pi 4 Model B Rev 1.5 using Unbound, Gateway UniFi UCG Fiber as DHCP server.

https://tricorder.pi-hole.net/7pobJ0im/

Following the different steps / suggestions from the other post I am not sure if somehow IPv6 DNS servers are advertised on my LAN that would allow my clients to bypass Pi-hole.

The below comamnd, does show a IPv6 address

C:\Users\seh20>nslookup pi.hole
Server:  pi.hole
Address:  192.168.1.XXX

Name:    pi.hole
Addresses:  fe80::f2aa:XXXX:XXXX:XXXX
192.168.1.XXX

Not sure if this indicates a IPv6 server in play?

nslookup -class=chaos -type=txt version.bind 198.41.0.4

command and output on Windows:

image
image1006×715 52.3 KB

same command and output on Pi:

image
image868×129 4.13 KB

Not sure what next or if I am on wild ghost chase.

Thanks in advance - Steen

2

You are all good.

There isn't.

That output demonstrates that request was handled by your Pi-hole machine's IPv4, and as that lookup for pi.hole returns an IPv6 link-local address of fe80::f2aa:XXXX:XXXX:XXXX, this would indicate that your Pi-hole would answer DNS requests sent to that address.

However, your debug log is void of any IPv6 router advertisements, which would suggest that your network is only aware of your Pi-hole machine's IPv4 address.
EDIT: You can check on your network's IPv4 DHCP and IPv6 router advertisements (RAs) by inspecting output of sudo pihole-FTL dhcp-discover.

As a result, your clients will talk to your Pi-hole for DNS via IPv4 exclusively.
That's a solid configuration.

That command has nothing to do with IPv6 or high query counts.
It can give an indication whether your Pi-hole/network would be able to talk to the DNS root servers directly, or whether DNS traffic would be intercepted.
This would be particularly important if you'd run a recursive resolver like unbound in conjunction with Pi-hole, which must talk to authoritative DNS servers directly for DNSSEC verification of DNS replies.

You are seeing the expected result ("ATLAS"), so nothing interfering with those requests.

1 Like
3

Hi,

Many thanks for reassuring that my setup is OK :slight_smile: :slight_smile:

The post I read combined with having a new gateway I got a bit nervous.

Keep up the good work!

Warm regards - Steen

4

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.