Ancestors

Toot

Written by mel on 2024-10-17 at 08:37

DNS trouble with pihole running with podman

https://jlai.lu/post/11531678

=> More informations about this toot | More toots from mat@jlai.lu

Descendants

Written by JASN_DE@lemmy.world on 2024-10-17 at 08:44

The request from the other machines go through the firewall and are being redirected, the requests from the NAS are basically trying to connect to localhost, so no redirection here as the requests aren’t leaving the machine.

=> More informations about this toot | More toots from JASN_DE@lemmy.world

Written by BluescreenOfDeath@lemmy.world on 2024-10-17 at 09:56

I agree.

So the solution, OP, is to set the DNS settings on your NAS to your router’s internal IP so the firewall can redirect the traffic to your new port.

=> More informations about this toot | More toots from BluescreenOfDeath@lemmy.world

Written by IsoKiero@sopuli.xyz on 2024-10-17 at 11:42

As it’s only single device I’d suggest configuring DNS server for that to :1053. Port forwarding rule on the nas firewall most likely applies only to ‘incoming’ traffic to the nas and as locally generated DNS request isn’t ‘incoming’ (you can think it as ‘incoming’ traffic is everything coming via ethernet cable into the nas) then the port redirection doesn’t trigger as you’re expecting.

=> More informations about this toot | More toots from IsoKiero@sopuli.xyz

Written by BluescreenOfDeath@lemmy.world on 2024-10-17 at 12:42

An inbound only DNS forwarding rule would be pointless. All DNS queries should be originating from within the network.

=> More informations about this toot | More toots from BluescreenOfDeath@lemmy.world

Written by IsoKiero@sopuli.xyz on 2024-10-17 at 14:15

If the firewall was running on a router then you’d need to DNAT back to the same network from which they originated and that is (in general) quite a PITA to get running properly. My understanding is that the firewall doing port forwarding is running on the NAS. And we don’t have much information on what that ‘NAS’ even is, I tend to think devices like qnap or synology when talking on NAS-boxes, but that might as well be a full linux-system just running CIFS/NFS/whatever.

OP could obviously use his router as a DNS server for the network and set upstream DNS server for the router to pihole, but that’s a whole different scenario.

=> More informations about this toot | More toots from IsoKiero@sopuli.xyz

Written by mel on 2024-10-17 at 17:10

For now my NAS it not really running anything (I want to have proper DNS/IDM before starting any other service and for storage I think I may go with owncloud ocis or nextcloud)

=> More informations about this toot | More toots from mat@jlai.lu

Written by IsoKiero@sopuli.xyz on 2024-10-17 at 18:27

NAS stands for ‘Network Attached Storage’ and there’s dedicated hardware for that task from multiple brands. It’s a somewhat spesific thing and from what I understand you have a multi-purpose server running on your network. For discussion it’s better to use the established terminology to avoid confusion on what’s what. Your generic server can of course act like a NAS, but a 100€ Synlogy NAS can’t (for the most part) act as a generic server.

Similarly there’s a dedicated hardware for routers and they are not the same than generic servers which can run whatever. Dedicated routers do some things way better/faster than generic server, and there’s pretty much always a trade-off between the two. You can of course install hardware to your server to be as good as or even better than any consumer grade router and run a pfsense on virtual machine on top of it, but that’s going to be at least more expensive than dedicated hardware.

So, your server is running pihole in a container on the same network address/hardware than the rest of your server, and I suppose you already gathered from other messages that the firewall component on it treats traffic coming from outside the server itself differently than traffic originating from the server itself. For this spesific case I’d say it’s just simpler to configure the server to use DNS server as localhost:1053 than trying to work out firewall forwarding rules for it, if possible. If not, and you absolutely insist that your pihole runs on a unprivileged port and that your server also has to use pihole as DNS sever, then you need to dig out a firewall config for outgoing traffic which redirects the destination port. Or you could set up a dns proxy on the server which uses pihole as upstream and serves addresses to localhost only or one of the other multiple ways to achieve what you’re after, but each of those have some kind of trade-off and there’s too many to go trough in a single post.

=> More informations about this toot | More toots from IsoKiero@sopuli.xyz

Written by mel on 2024-10-17 at 17:05

I am still using my ISP’s router, so the firewall rule is on the NAS (for now it is almost a do it all server), otherwise I would run the pihole on the router I think

=> More informations about this toot | More toots from mat@jlai.lu

Written by mel on 2024-10-17 at 16:29

Thank you for the reply. It is exactly this

=> More informations about this toot | More toots from mat@jlai.lu

Written by oranki on 2024-10-17 at 13:50

Have you considered lowering the unprivileged port limit instead?

Then remove the firewall rule and bind to port 53.

=> More informations about this toot | More toots from oranki@piefed.social

Written by InnerScientist@lemmy.world on 2024-10-17 at 15:58

Just set the DNS server to localhost:1053 for the nas?

=> More informations about this toot | More toots from InnerScientist@lemmy.world

Written by mel on 2024-10-17 at 16:30

Do you have any idea on how to do it ? Knowing that I am on opensuse

=> More informations about this toot | More toots from mat@jlai.lu

Written by InnerScientist@lemmy.world on 2024-10-17 at 17:15

Well, on linux I’d use systemd’s resolved which would listen on localhost:53 (it would also point resolv.conf there) and then set resolved’s uplink server to your custom port. I don’t have the exact config in mind but it seems to support custom uplink ports(“expects IPv4 or IPv6 address specifications of DNS servers […] optionally take a port number separated with “:”[…]”)

=> More informations about this toot | More toots from InnerScientist@lemmy.world