3 ms·

So I did this too. The downside is that if that pihole server goes down your entire network loses DNS access.

tbyehl 8y ago
Do wish they'd come up with an HA strategy. I run mine on old, low-wattage PC hardware that cost me about $30 all-in and boots in 20 seconds, so at least I'm not at the mercy of unpredictable mSD cards or an ESXi server that takes 10 minutes to start launching VMs after a power outage.
- detaro 8y ago
  If I remember correctly, client OSes that know about multiple DNS servers will try the other if one fails, so just have two and announce both through DHCP?
  - marcrosoft 8y ago
    I'm not positive but I believe it works by blocking the request which means an alternative route would be used and defeat the purpose. Edit: if that's not the case I still think applications round robin also defeating the purpose.
    - detaro 8y ago
      I meant two PiHole-based servers. But a "blocked request" is an answer, and would likely not trigger a request to a different server, but I wouldn't rely on that being entirely leak-free.
      - marcrosoft 8y ago
        I didn't think of having two. That's probably a good enough solution if you have two servers.
        w7 8y ago
        Pihole has 4 blocking modes: returning 0.0.0.0 or [::] for blocked A/AAAA records (this is the default), returning the pihole server's address (to provide a custom blocking page), or returning either NXDOMAIN or NODATA. I if I recall correctly Windows, Linux, and MacOS all have the resolving behavior of only querying alternative servers if absolutely no response at all is received within some default time frame with the order of attempted servers being the order listed in the DNS configuration. I believe that this is also the behavior recommended by RFC. These methods should also result in some level of local caching as well by default if you're on Windows or MacOS, but Linux will vary by distro. Because alternatives will only be tried if the preceding server fails it should be safe to manually add something like Cloudflare as a back up DNS server or distribute the alternative via DHCP (along with pihole or via pihole if it's also acting as DHCP).
        tbyehl 8y ago
        For the most part, once a client goes through the process of selecting another DNS server it will stick with that choice until the process is triggered again. This will cause It's Always DNS memes when you've configured multiple servers which have differing views of DNS.
        w7 8y ago
        Oh you're right. I didn't think about the time it'd take to switch back to the "more desirable" name server or how often it checks it (or if it even does) when it's already selected another. I wonder what the differences are on OS/forwarder implementations for that.
        tbyehl 8y ago
        If you want to give yourself a migraine, Microsoft has a comprehensive document[0]. DNS/AD has been the focus of my job for the last 5 years and I'm still not absolutely certain the circumstances that a given Windows client will return to the 1st candidate DNS server when there are > 2. On Unix-y things, resolv.conf is specified to be used in the listed order[1]. Local caching resolvers will default to remembering the last successful server and treating the list as circular, so after the first DNS server has a failure it won't be tried again until each subsequent server has failed. Every time a distro has switched to having a local caching resolver by default you'll find big threads of people confused over the altered behavior[2]. And default behaviors are meant to be over-ridden, so in places where I have dnsmasq providing DNS for a network (PiHole, EdgeRouters) I set all-servers[3] so that every upstream is queried simultaneously and the fastest response wins -- an exceptionally bad configuration option when having upstreams with differing views of DNS, but for the general use case it makes the Which public DNS is fastest debate moot. [0] https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd197552(v=ws.10) https://docs.microsoft.com/en-us/previous-versions/windows/i... [1] http://man7.org/linux/man-pages/man5/resolv.conf.5.html http://man7.org/linux/man-pages/man5/resolv.conf.5.html [2] https://github.com/systemd/systemd/issues/5755 https://github.com/systemd/systemd/issues/5755 [3] http://www.thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html http://www.thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html
    - basch 8y ago
      it could also just end up as "oh weird ads are showing up on the web, i should go fix my dns server." or are you thinking that the secondary dns would start answering for every blocked result?
  - tbyehl 8y ago
    That's an option but then you're maintaining multiple independent PiHoles. What I'd like is for multiple DNS servers to receive their configuration from, and forward their metrics to, a single management instance.
    - lostlogin 8y ago
      If it’s Dockered it would be trivial to copy the config, however after that you are right, you’re maintaining 2.
lostlogin 8y ago
If you’re doing it in docker and have more than one machine on, it’s pretty trivial to duplicate the container for a backup.

Do wish they'd come up with an HA strategy. I run mine on old, low-wattage PC hardware that cost me about $30 all-in and boots in 20 seconds, so at least I'm not at the mercy of unpredictable mSD cards or an ESXi server that takes 10 minutes to start launching VMs after a power outage.

detaro 8y ago
If I remember correctly, client OSes that know about multiple DNS servers will try the other if one fails, so just have two and announce both through DHCP?
- marcrosoft 8y ago
  I'm not positive but I believe it works by blocking the request which means an alternative route would be used and defeat the purpose. Edit: if that's not the case I still think applications round robin also defeating the purpose.
  - detaro 8y ago
    I meant two PiHole-based servers. But a "blocked request" is an answer, and would likely not trigger a request to a different server, but I wouldn't rely on that being entirely leak-free.
    - marcrosoft 8y ago
      I didn't think of having two. That's probably a good enough solution if you have two servers.
      - w7 8y ago
        Pihole has 4 blocking modes: returning 0.0.0.0 or [::] for blocked A/AAAA records (this is the default), returning the pihole server's address (to provide a custom blocking page), or returning either NXDOMAIN or NODATA. I if I recall correctly Windows, Linux, and MacOS all have the resolving behavior of only querying alternative servers if absolutely no response at all is received within some default time frame with the order of attempted servers being the order listed in the DNS configuration. I believe that this is also the behavior recommended by RFC. These methods should also result in some level of local caching as well by default if you're on Windows or MacOS, but Linux will vary by distro. Because alternatives will only be tried if the preceding server fails it should be safe to manually add something like Cloudflare as a back up DNS server or distribute the alternative via DHCP (along with pihole or via pihole if it's also acting as DHCP).
        tbyehl 8y ago
        For the most part, once a client goes through the process of selecting another DNS server it will stick with that choice until the process is triggered again. This will cause It's Always DNS memes when you've configured multiple servers which have differing views of DNS.
        w7 8y ago
        Oh you're right. I didn't think about the time it'd take to switch back to the "more desirable" name server or how often it checks it (or if it even does) when it's already selected another. I wonder what the differences are on OS/forwarder implementations for that.
        tbyehl 8y ago
        If you want to give yourself a migraine, Microsoft has a comprehensive document[0]. DNS/AD has been the focus of my job for the last 5 years and I'm still not absolutely certain the circumstances that a given Windows client will return to the 1st candidate DNS server when there are > 2. On Unix-y things, resolv.conf is specified to be used in the listed order[1]. Local caching resolvers will default to remembering the last successful server and treating the list as circular, so after the first DNS server has a failure it won't be tried again until each subsequent server has failed. Every time a distro has switched to having a local caching resolver by default you'll find big threads of people confused over the altered behavior[2]. And default behaviors are meant to be over-ridden, so in places where I have dnsmasq providing DNS for a network (PiHole, EdgeRouters) I set all-servers[3] so that every upstream is queried simultaneously and the fastest response wins -- an exceptionally bad configuration option when having upstreams with differing views of DNS, but for the general use case it makes the Which public DNS is fastest debate moot. [0] https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd197552(v=ws.10) https://docs.microsoft.com/en-us/previous-versions/windows/i... [1] http://man7.org/linux/man-pages/man5/resolv.conf.5.html http://man7.org/linux/man-pages/man5/resolv.conf.5.html [2] https://github.com/systemd/systemd/issues/5755 https://github.com/systemd/systemd/issues/5755 [3] http://www.thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html http://www.thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html
  - basch 8y ago
    it could also just end up as "oh weird ads are showing up on the web, i should go fix my dns server." or are you thinking that the secondary dns would start answering for every blocked result?
- tbyehl 8y ago
  That's an option but then you're maintaining multiple independent PiHoles. What I'd like is for multiple DNS servers to receive their configuration from, and forward their metrics to, a single management instance.
  - lostlogin 8y ago
    If it’s Dockered it would be trivial to copy the config, however after that you are right, you’re maintaining 2.

lostlogin 8y ago

If you’re doing it in docker and have more than one machine on, it’s pretty trivial to duplicate the container for a backup.