PiHoleDNS in docker causing issues with DNS response times

[Jack-Punter]

I'm trying to use this tool, and also have a custom PiHole DNS server running on my local network in another docker container. My machines all access this dns server on the hosts IP (192.168.0.91) which is also the same machine I'm trying to run this on, however when I set that as my DNS server in DNS_NAMESERVER_4_IP I get a consistent timeout with a response from a docker IP (although interestingly not the IP that portainer lists as pihole's IP. Is there someway this setup can be supported, or something i can do to work around the issue (aside from simply not monitoring my pihole DNS server

The resolution lifetime expired after 5.138 seconds: Server Do53:192.168.0.91@53 answered got a response from ('172.21.0.1', 53) instead of ('192.168.0.91', 53); Server Do53:192.168.0.91@53 answered got a response from ('172.21.0.1', 53) instead of ('192.168.0.91', 53); Server Do53:192.168.0.91@53 answered got a response from ('172.21.0.1', 53) instead of ('192.168.0.91', 53); Server Do53:192.168.0.91@53 answered got a response from ('172.21.0.1', 53) instead of ('192.168.0.91', 53); Server Do53:192.168.0.91@53 answered got a response from ('172.21.0.1', 53) instead of ('192.168.0.91', 53); Server Do53:192.168.0.91@53 answered got a response from ('172.21.0.1', 53) instead of ('192.168.0.91', 53)

[securedpackets]

I’ll work on fixing this for Pinole users

…

On Sun, May 5, 2024 at 6:47 PM Jack Punter ***@***.***> wrote: I'm trying to use this tool, and also have a custom PiHole DNS server running on my local network in another docker container. My machines all access this dns server on the hosts IP (192.168.0.91) which is also the same machine I'm trying to run this on, however when I set that as my DNS server in DNS_NAMESERVER_4_IP I get a consistent timeout with a response from a docker IP (although interestingly not the IP that portainer lists as pihole's IP. Is there someway this setup can be supported, or something i can do to work around the issue (aside from simply not monitoring my pihole DNS server The resolution lifetime expired after 5.138 seconds: Server ***@***.*** answered got a response from ('172.21.0.1', 53) instead of ('192.168.0.91', 53); Server ***@***.*** answered got a response from ('172.21.0.1', 53) instead of ('192.168.0.91', 53); Server ***@***.*** answered got a response from ('172.21.0.1', 53) instead of ('192.168.0.91', 53); Server ***@***.*** answered got a response from ('172.21.0.1', 53) instead of ('192.168.0.91', 53); Server ***@***.*** answered got a response from ('172.21.0.1', 53) instead of ('192.168.0.91', 53); Server ***@***.*** answered got a response from ('172.21.0.1', 53) instead of ('192.168.0.91', 53) — Reply to this email directly, view it on GitHub <#33>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AIQ4XUJ5OVLCSPFXP463XG3ZA2ZHZAVCNFSM6AAAAABHICWM6KVHI2DSMVQWIX3LMV43ASLTON2WKOZSGI3TSNZXGI2TGNQ> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[Jack-Punter]

Thanks for the quick reply! Other than this minor issue this has worked perfectly, thanks for your work on it. 👍

[plaintextpackets]

@Jack-Punter can I get the version of Pihole you're running so I can test it myself

[Jack-Punter]

Hi I am currently on the following version of Pihole:
Docker Tag 2024.05.0 Pi-hole v5.18.2 FTL v5.25.2 Web Interface v5.21

and the service is defined in a docker compose "stack" in my portainer . the snippet is:

  pihole:
    image: pihole/pihole:latest
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "8080:80/tcp"
    environment:
      TZ: 'Europe/London'
      WEBPASSWORD: ${PIHOLE_WEB_PASSWORD}
    volumes:
      - pihole:/etc/pihole
      - './etc/dnsmasq.d:/etc/dnsmasq.d'
    restart: unless-stopped

and the pihole volume is defined as an external volume at the bottom:

volumes:
  pihole:
    external: true

[Jack-Punter]

I'll also add, that this is running in a portainer configured stack and i'm running this as per the readme manually using docker compose up so they're separate if that makes any difference (I'm kinda new to this stuff so idk if this is actually useful information or not)

[plaintextpackets]

So to be clear you're configuring "192.168.0.91" as your DNS server right?

[Jack-Punter]

Ah sorry yes, the server is definitely running on "192.168.0.91" My PC's configuration is here:

The server is running PiHole is a VM on a proxmox machine, and is the same VM which is running these containers

[plaintextpackets]

Ok I've figured this out. When you are trying to route to the host's IP from within docker, for some reason the return traffic gets NAT'd to the gateway IP of your docker private network, so 192.168.x.x or 172.16.x.x. Unfortunately I think this is a defect in docker, I had this issue crop up on another project.

So what works:

If you specify the gateway of your netprobe-probe container as your DNS server, it will work, as the pihole DNS service is also available on this IP. Procedure:

1. Stop netprobe but don't wipe it (docker compose down)

2. Find the gateway IP of your netprobe-probe container:

chocolate@chocolate:/scripts/netprobe_lite$ docker inspect netprobe-probe | grep Gateway
            "Gateway": "",
            "IPv6Gateway": "",
                    "Gateway": "192.168.208.1",
                    "IPv6Gateway": "",
chocolate@chocolate:/scripts/netprobe_lite$ 

3. Enter that IP into your .env file

4. Restart netprobe (docker compose up)

--

I will see if there is another way to hack the network config to stop this behaviour but I think it might be the way it is. I can also manually define the subnet to make it easier but then we hit the conflicts issue.

Let me know if the above works, and I'll adjust the readme

[Jack-Punter]

This did work, thanks 👍
Docker did assign the stack to a new subnet when bringing it up but taking it down, changing the env and restarting seemed to work.

[plaintextpackets]

I'm going to close this issue as I've updated the readme for folks who use Pihole or other DNS servers in Docker