PI-Hole DNS filter on Turris Omnia

The DNS filter software PI-Hole is available in version 5 and can also run as a container on Turris Omnia. Is there any experience with the interaction of PI-Hole and knot? How can I connect PI-Hole from the container to the name services of TOS? Can DNS queries to TOS be redirected to PI-Hole without changing the DNS entries on the clients?
Cheers Harry

1 Like

I’m using pihole in a lxc container (Ubuntu 16.04), it works pretty well.
lxc containers run on an internal ssd, pihole has a separate IP which is configured in the Turris DHCP server and forwards queris to Turris resolver (kresd).

1 Like

Yes. I just want to stress that if you want both Pi-hole and Knot Resolver (or generally, both filtering and a validation), you want to put filtering between clients and the other resolver, not the other way around. That’s because there’s no good way of proving if a change in DNS content was wanted by the user. Otherwise the filtered names would cause lots of retries.

You can run PiHole in LXC container ; once set-up and running, you go to Luci > Network > Interfaces > LAN ; scroll down to DHCP part and there go to “Advanced Settings”
There is DHCP-Option where you add your PiHole IP (sample where .1.1 is TOS and .1.2 is PiHole) 6,192.168.1.1 to 6,192.168.1.1,192.168.1.2 (save-and-apply)
That will propagate both resolvers to the DHCP clients as 1st and 2nd dns servers. You can change the order there :slight_smile:

If you want PiHole to be “main” resolver you have to set TOS resolver to forward ( Luci > Network > DHCP and DNS > General Settings and there is DNS forwarding options ) dns queries only to Pihole (which will forward it to some public resolvers or your own).

notes

btw: i have kresd/dnsmasq serving to dynamic/static domains so i am not forwarding any queries out and Pihole is forwarding queries to TOS first as second to NIC.cz resolvers and as third to google. So i have it as backup and for some “static” clients (like TV, MediaCenters to use only pihole)
(i am having omnia with 3.x branch) , so i do not have any know-how for 4.x or 5.x branches , but i hope that above mentioned hint is valid, if not let me know and i with withdraw my post :slight_smile:

1 Like

Thank You. That’s exactly the information I was looking for! I already switched to TOS 5.0. I will test the new pi-hole release the next days.