Using dnsmasq to advertise two DNS servers via DHCP

Help Community Help
1

I have a pair of devices set up with PiHole, and syncing via Nebula. DNS is working perfectly.

Before I enable DHCP on the devices, I wanted to make sure I had the best understanding of how to properly advertise both PiHole devices via DHCP, so that if one goes down, clients will still reach the other one. From what I am seeing, this can be done via a conf file in /etc/dnsmasq.d/

Would this be a valid entry to add to a conf file?

dhcp-option=option6:10.0.0.4,10.0.0.5,[2601:8c:4d80:595:9b5e:85a6:702a:b190],[2601:8c:4d80:595:f7ea:5b1c:790c:832f]

Just wanting to do a sanity check before I add it and potentially break something.

Thank you!

2

This appears to be an invalid configuration parameter, per the dnsmasq manual:

You want dhcp-option=6,Pi-holeIP,SecondaryDNSIP

But, note that in Pi-hole V6 you will need to explicit enable additional dnsmasq files in directory /etc/dnsmasq.d.

In file /etc/pihole/pihole.toml

  # Should FTL load additional dnsmasq configuration files from /etc/dnsmasq.d/?
  # Warning: This is an advanced setting and should only be used with care.
  # Incorrectly formatted or config files specifying options which can only be defined
  # once can result in conflicts with the automatic configuration of Pi-hole (see
  # /etc/pihole/dnsmasq.conf) and may stop DNS resolution from working.
  etc_dnsmasq_d = true ### CHANGED, default = false

Change the parameter to true as shown.

Also, note that you don't really need IPv6 DNS server addresses. You are using local addresses on your LAN, and any type of DNS query can be resolved over either IPv4 or IPv6. This will work fine with just the IPv4 addresses.

3

That won't work.
You are nor declaring a type of option, which should be dns-server.

In addition, note that DHCP is strictly an IPv4 protocol.
IPv6's close equivalent is DHCPv6, which is a different protocol using different ports.

Consequently, you can't mix IPv4 and IPv6 addresses in a DHCPv6 option - IPv4 options (option) and IPv6 options (option6) will require their own lines.

For IPv4, the correct line would read:

dhcp-option=option:dns-server,10.0.0.4,10.0.0.5

While you could consider to add an option6 line for your IPv6 addresses, you should be aware that most client OS would prefer to configure themselves via NDP, i.e. they won't request DNS server information via DHCPv6, but rather will learn them from RDNSS information as advertised by your router.

You should first verify whether your router would support IPv6 DNS configuration.

If it doesn't allow you to disable advertising its own IPv6 as DNS server or setting a custom IPv6 address, then clients will pick up your router's IPv6 as DNS server via RDNSS RAs, by-passing Pi-hole.

Running sudo pihole-FTL dhcp-discover may help in diagnosing which IPv6 addresses your router is advertising for DNS.

4

@Bucking_Horn - thank you for your insight.

My router (an Orbi 850 series) won't let me assign DNS via DHCP - if I use the Router for DHCP, it automatically assigns itself as the DNS server. (I found this out after I bought it, wired up the house, set up the satellites, etc., so I am not amused.) I could arguably tell the router to use the PiHoles as DNS instead of upstream, but I'd prefer to cut out the middleman, as it were.

So my plan at this point is to try to use DHCP off my PiHoles, and have them list each other as alternate DNS servers.

I've already determined that if I don't set them as DNS servers manually for IPv6, I can't resolve things internally on my network. So I do need to make sure that DNS is handed out for IPv6, and points to my PiHoles, to make use of their internal redirection. I just need to figure out how to list both DNS servers for DHCP.

5

That may well work for DHCP/IPv4, as long as you can disable your router's DHCP server.

But disabling its DHCP server may not necessarily disable its RDNSS RAs as well, hence:

6

Here's the results - router info below this.

root@dns1:/home/orangepi# pihole-FTL dhcp-discover
Scanning all your interfaces for DHCP servers and IPv6 routers
Timeout: 6 seconds

* Received 104 bytes from fe80::<redacted>85 @ end0
  Hop limit: 64
  Stateful address conf.: No
  Stateful other conf.: Yes
  Mobile home agent: No
  Router preference: Low
  Neighbor discovery proxy: No
  Router lifetime: 1800 s
  Reachable time: N/A
  Retransmit time: N/A
  - Prefix: 2601:<redacted>::/64
    Valid lifetime: 252477 sec
    Preferred lifetime: 252477 sec
    On-link: Yes
    Autonomous address conf.: Yes
  - Route: 2601:<redacted>::/64
    Route preference: High
    Route lifetime: 291381 sec
  Recursive DNS server 1/1: 2601:<redacted>85
  DNS server lifetime:1200 sec
  Source link-layer address: C8:<redacted>:85

* Received 548 bytes from 10.0.0.1 @ end0
  Offered IP address: 10.0.0.4
  Server IP address: N/A
  Relay-agent IP address: N/A
  BOOTP server: (empty)
  BOOTP file: (empty)
  DHCP options:
   Message type: DHCPOFFER (2)
   server-identifier: 10.0.0.1
   lease-time: 86400 ( 1d )
   netmask: 255.255.255.0
   router: 10.0.0.1
   dns-server: 10.0.0.1
   --- end of options ---
(…)
Received 1 DHCP (IPv4) and 7 RA (IPv6) answers on end0
7 
**Router's IPv6 Address On LAN**
2601:<redacted>85/64
8

I didn't mean for you to share the output, but to use it in your analysis.
I've reduced your output to the relevant part and obfuscated your public IPv6 as well as MAC addresses.

Your router is advertising its own public IPv6 GUA as DNS server:

To be sure that Pi-hole can't be by-passed via IPv6, you should verify whether that RDNSS line would disappear when you disable your router's DHCP server.
Note that even if it does, your clients may still continue to use it until its lifetime has expired.

And if it still shows up, you should consult your router's documentation and support for further assistance on its IPv6 DNS configuration options, which should include DHCPv6 as well as NDP RDNSS RAs.

9

Got it, thank you. At some point when I can make the switch and it won't impact the rest of my household (i.e. - we're not all WFH at the time), I will try disabling DHCP on the router, and enabling it on the PiHoles, then run the check again to see if the Router is still advertising DNS for IPv6.

I guess my remaining question is this: I would like to have redundancy for IPv6 DNS in the event one of the PiHoles is offline (updates, rebooting, hardware failure, etc.). Is there a need to, and a way, to set DHCP on the PiHole devices so that they advertise each other for redundancy?

10

For your dual stack and IPv4-only clients (IoTs, mostly), it would be fully sufficient to provide them exclusively with a set of IPv4 DNS server addresses.
Doing so would also make your Pi-hole's dashboard and Query Log tidier and easier to read.

If you'd still opt to have Pi-hole advertise their IPv6 addresses for DNS, you should advertise one of their stable ULA or LLA addresses, by supplying an option6:dns-server line and enabling Pi-hole's IPv6 support.

Don't pick temporary addresses, as their IID will change over time, and you don't want to edit your Pi-hole configuration every two hours.

For similar reasons, you want to stay clear from GUAs as well, as their IPv6 prefix may be changed by your ISP, either regularly or e.g. after a router restart.