pi-hole + gluetun? #1089

FillHK · 2022-08-02T15:34:15Z

FillHK
Aug 2, 2022

I have pi-hole (docker version) installed, everything has worked as expected for a long time.
But I am just interested if it's possible to keep pi-hole as the main server for blocking ads etc. and also use a VPN for all outbound connections with Gluetun.

So faw I am unable to make it working.
I have gluetun installed using portainer, I can login into container and see that container connected over VPN (hidemyass), but only this container is connected, and how to route all the traffic from pi-hole container to gluetun - have no idea...

Anyone?

qdm12 · 2022-08-02T16:23:55Z

qdm12
Aug 2, 2022
Maintainer

To avoid leaking your dns requests outside the vpn, you should run a pihole container connected through gluetun, and specify DOT=off and DNS_PLAINTEXT_ADDRESS=127.0.0.1 such that it uses the gluetun-connected pihole listening on port 53 on localhost (gluetun).

5 replies

FillHK Aug 2, 2022
Author

Just to clarify.

Connect Pi-hole container connected through gluetun.
In this case I need to remove port settings for pi-hole container:

PORT CONFIGURATION | 0.0.0.0:4443 443/tcp:::4443 443/tcp0.0.0.0:53 53/tcp:::53 53/tcp0.0.0.0:53 53/udp:::53 53/udp0.0.0.0:67 67/udp:::67 67/udp0.0.0.0:4480 80/tcp:::4480 80/tcp

Other way container can't be deployed
2. DOT=off and DNS_PLAINTEXT_ADDRESS=127.0.0.1
This should be done in ENV? For pi-hole container I assume?

If it will work I will be happiest person.
Big thank for your work and support.

FillHK Aug 2, 2022
Author

My steps done:

pi-hole

All network ports removed (another way can't deploy container)
added to variables into ENV (DNS_PLAINTEXT_ADDRESS=127.0.0.1 and DOT=off)
Network - > Container > gluetun
Everything deployed, container is up, the issue is pi-hole web interface no more available for me http://192.168.0.66:4480/admin/queries.php

Gluetun - no changes made

qdm12 Aug 2, 2022
Maintainer

set those 2 env variables for Gluetun, not pihole
port map port 4480:4480 on gluetun to access pihole

See the wiki on port mapping for more information

FillHK Aug 2, 2022
Author

Thank you.

I did all the steps above.

ENV added to glutun container (DOT - changed to off, DNS_PLAINTEXT_ADDRESS=127.0.0.1 added as a new variable)
Added port mapping (copied from pi-hole because in pi-ho;e container now it's deleted)
**PORT CONFIGURATION** |0.0.0.0:4443 4443/tcp:::4443 4443/tcp0.0.0.0:4480 4480/tcp:::4480 4480/tcp0.0.0.0:53 53/tcp:::53 53/tcp0.0.0.0:53 53/udp:::53 53/udp0.0.0.0:67 67/udp:::67 67/udp
Here is a log from Gluetun when run:

2022-08-02T21:19:29Z INFO Settings summary:
├── VPN settings:
|   ├── VPN provider settings:
|   |   ├── Name: hidemyass
|   |   └── Server selection settings:
|   |       ├── VPN type: openvpn
|   |       ├── Countries: netherlands
|   |       └── OpenVPN server selection settings:
|   |           └── Protocol: UDP
|   └── OpenVPN settings:
|       ├── OpenVPN version: 2.5
|       ├── User: [set]
|       ├── Password: [set]
|       ├── Tunnel IPv6: no
|       ├── Network interface: tun0
|       ├── Run OpenVPN as: root
|       └── Verbosity level: 1
├── DNS settings:
|   ├── DNS server address to use: 127.0.0.1
|   ├── Keep existing nameserver(s): no
|   └── DNS over TLS settings:
|       └── Enabled: no
├── Firewall settings:
|   ├── Enabled: yes
|   ├── Debug mode: on
|   └── Outbound subnets:
|       └── {127.0.0.0 ffffff00}
├── Log settings:
|   └── Log level: INFO
├── Health settings:
|   ├── Server listening address: 127.0.0.1:9999
|   ├── Target address: cloudflare.com:443
|   ├── Read header timeout: 100ms
|   ├── Read timeout: 500ms
|   └── VPN wait durations:
|       ├── Initial duration: 6s
|       └── Additional duration: 5s
├── Shadowsocks server settings:
|   └── Enabled: no
├── HTTP proxy settings:
|   └── Enabled: no
├── Control server settings:
|   ├── Listening address: :8000
|   └── Logging: yes
├── OS Alpine settings:
|   ├── Process UID: 1000
|   └── Process GID: 1000
├── Public IP settings:
|   ├── Fetching: every 12h0m0s
|   └── IP file path: /tmp/gluetun/ip
└── Version settings:
    └── Enabled: yes

And container works:

08-02T21:19:29Z INFO [routing] default route found: interface eth0, gateway 172.17.0.1 and assigned IP 172.17.0.3
2022-08-02T21:19:29Z DEBUG [routing] ip rule add from 172.17.0.3/32 lookup 200 pref 100
2022-08-02T21:19:29Z INFO [routing] adding route for 0.0.0.0/0
2022-08-02T21:19:29Z DEBUG [routing] ip route replace 0.0.0.0/0 via 172.17.0.1 dev eth0 table 200
2022-08-02T21:19:29Z INFO [firewall] setting allowed subnets...
2022-08-02T21:19:29Z DEBUG [firewall] iptables --append OUTPUT -o eth0 -s 172.17.0.3 -d 127.0.0.0/24 -j ACCEPT
2022-08-02T21:19:29Z INFO [routing] default route found: interface eth0, gateway 172.17.0.1 and assigned IP 172.17.0.3
2022-08-02T21:19:29Z INFO [routing] adding route for 127.0.0.0/24
2022-08-02T21:19:29Z DEBUG [routing] ip route replace 127.0.0.0/24 via 172.17.0.1 dev eth0 table 199
2022-08-02T21:19:29Z DEBUG [routing] ip rule add to 127.0.0.0/24 lookup 199 pref 99
2022-08-02T21:19:29Z INFO TUN device is not available: open /dev/net/tun: no such file or directory; creating it...
2022-08-02T21:19:29Z INFO [pprof] http server listening on [::]:6060
2022-08-02T21:19:29Z INFO [dns over tls] using plaintext DNS at address 1.1.1.1
2022-08-02T21:19:29Z INFO [http server] http server listening on [::]:8000
2022-08-02T21:19:29Z INFO [healthcheck] listening on 127.0.0.1:9999
2022-08-02T21:19:29Z INFO [firewall] allowing VPN connection...
2022-08-02T21:19:29Z DEBUG [firewall] iptables --append OUTPUT -d 84.17.46.134 -o eth0 -p udp -m udp --dport 553 -j ACCEPT
2022-08-02T21:19:29Z DEBUG [firewall] iptables --append OUTPUT -o tun0 -j ACCEPT
2022-08-02T21:19:29Z DEBUG [firewall] ip6tables-nft --append OUTPUT -o tun0 -j ACCEPT
2022-08-02T21:19:29Z INFO [openvpn] OpenVPN 2.5.6 aarch64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Apr 17 2022
2022-08-02T21:19:29Z INFO [openvpn] library versions: OpenSSL 1.1.1q  5 Jul 2022, LZO 2.10
2022-08-02T21:19:29Z INFO [openvpn] TCP/UDP: Preserving recently used remote address: [AF_INET]84.17.46.134:553
2022-08-02T21:19:29Z INFO [openvpn] UDP link local: (not bound)
2022-08-02T21:19:29Z INFO [openvpn] UDP link remote: [AF_INET]84.17.46.134:553
2022-08-02T21:19:32Z WARN [openvpn] 'link-mtu' is used inconsistently, local='link-mtu 1557', remote='link-mtu 1558'
2022-08-02T21:19:32Z WARN [openvpn] 'comp-lzo' is present in remote config but missing in local config, remote='comp-lzo'
2022-08-02T21:19:32Z INFO [openvpn] [server] Peer Connection Initiated with [AF_INET]84.17.46.134:553
2022-08-02T21:19:33Z WARN [openvpn] You have specified redirect-gateway and redirect-private at the same time (or the same option multiple times). This is not well supported and may lead to unexpected results
2022-08-02T21:19:33Z INFO [openvpn] TUN/TAP device tun0 opened
2022-08-02T21:19:33Z INFO [openvpn] /sbin/ip link set dev tun0 up mtu 1500
2022-08-02T21:19:33Z INFO [openvpn] /sbin/ip link set dev tun0 up
2022-08-02T21:19:33Z INFO [openvpn] /sbin/ip addr add dev tun0 100.120.201.178/24
2022-08-02T21:19:33Z INFO [openvpn] UID set to nonrootuser
2022-08-02T21:19:33Z INFO [openvpn] Initialization Sequence Completed
2022-08-02T21:19:33Z INFO [ip getter] Public IP address is 84.17.46.141 (Netherlands, North Holland, Amsterdam)
2022-08-02T21:19:33Z INFO [vpn] You are running on the bleeding edge of latest!
2022-08-02T21:19:34Z INFO [healthcheck] healthy!

For Pi-hole I have:

Deleted port mapping
Container connected to Gluetun
Some settings from container:

 DNS1 | 127.0.0.1
ServerIP	127.0.0.1

And logs from Pi-hole container:

[s6-init] making user provided files available at /var/run/s6/etc...exited 0.
[s6-init] ensuring user provided files have correct perms...exited 0.
[fix-attrs.d] applying ownership & permissions fixes...
[fix-attrs.d] 01-resolver-resolv: applying... 
[fix-attrs.d] 01-resolver-resolv: exited 0.
[fix-attrs.d] done.
[cont-init.d] executing container initialization scripts...
[cont-init.d] 05-changer-uid-gid.sh: executing... 
[cont-init.d] 05-changer-uid-gid.sh: exited 0.
[cont-init.d] 20-start.sh: executing... 
 ::: Starting docker specific checks & setup for docker pihole/pihole
  [i] Installing configs from /etc/.pihole...
  [i] Existing dnsmasq.conf found... it is not a Pi-hole file, leaving alone!
  [i] Installing /etc/dnsmasq.d/01-pihole.conf...
  [✓] Installed /etc/dnsmasq.d/01-pihole.conf
  [i] Installing /etc/.pihole/advanced/06-rfc6761.conf...
  [✓] Installed /etc/dnsmasq.d/06-rfc6761.conf
Converting DNS1 to PIHOLE_DNS_
Setting DNS servers based on PIHOLE_DNS_ variable
::: Assigning password defined by Environment Variable
  [✓] New password set
DNSMasq binding to default interface: eth0
Added ENV to php:
			"TZ" => "America/Chicago",
			"PIHOLE_DOCKER_TAG" => "2022.04.3",
			"PHP_ERROR_LOG" => "/var/log/lighttpd/error.log",
			"ServerIP" => "127.0.0.1",
			"CORS_HOSTS" => "",
			"VIRTUAL_HOST" => "127.0.0.1",
Using IPv4 and IPv6
::: Preexisting ad list /etc/pihole/adlists.list detected ((exiting setup_blocklists early))
https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
::: Testing lighttpd config: Syntax OK
::: All config checks passed, cleared for startup ...
::: Enabling Query Logging
  [i] Enabling logging...

  [✓] Logging has been enabled!
 ::: Docker start setup complete
  Checking if custom gravity.db is set in /etc/pihole/pihole-FTL.conf
  Pi-hole version is v5.11.4 (Latest: v5.11.4)
  AdminLTE version is v5.13 (Latest: v5.13)
  FTL version is v5.16.1 (Latest: v5.16.1)
  Container tag is: 2022.04.3
[cont-init.d] 20-start.sh: exited 0.
[cont-init.d] done.
[services.d] starting services
Starting pihole-FTL (no-daemon) as pihole
Starting lighttpd
Starting crond
[services.d] done.

Unfortunately:

pi-hole not accessble by IP: http://192.168.0.66:4480/admin/queries.php
all devices connected to the home wife still have public IP
Please advice.

qdm12 Aug 2, 2022
Maintainer

pi-hole not accessble by IP: http://192.168.0.66:4480/admin/queries.php

Make sure 4480:4480 is mapped on gluetun and that pihole listens on all interfaces (:4480 or 0.0.0.0:4480).

all devices connected to the home wife still have public IP

They will still have a public IP, but their dns requests will be sent through the vpn/gluetun (depending on your router dhcp settings or each lan device dns settings).
The only way for LAN devices to have the vpn ip address is to use shadowsocks (better) or the http proxy.

amuilyas · 2023-02-07T22:06:12Z

amuilyas
Feb 7, 2023

I have pi-hole (docker version) installed, everything has worked as expected for a long time. But I am just interested if it's possible to keep pi-hole as the main server for blocking ads etc. and also use a VPN for all outbound connections with Gluetun.

So faw I am unable to make it working. I have gluetun installed using portainer, I can login into container and see that container connected over VPN (hidemyass), but only this container is connected, and how to route all the traffic from pi-hole container to gluetun - have no idea...

Anyone?

Hi
I notice you are running HMA on docker and can authenticate no issues. I am trying to do the same but keep getting authentication issues. I created a free Privado account and that works with no issues.

Can you tell me how you are adding in your username and password?
Are you using quotes "xxx" or 'xxx"?
Username or email address?
Password or activation code?

I tired so many combinations in Docker and cannot get it to work.

Thanks in advance for your help

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

pi-hole + gluetun? #1089

{{title}}

Replies: 2 comments 5 replies

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

pi-hole + gluetun? #1089

FillHK Aug 2, 2022

Replies: 2 comments · 5 replies

qdm12 Aug 2, 2022 Maintainer

FillHK Aug 2, 2022 Author

FillHK Aug 2, 2022 Author

qdm12 Aug 2, 2022 Maintainer

FillHK Aug 2, 2022 Author

qdm12 Aug 2, 2022 Maintainer

amuilyas Feb 7, 2023

FillHK
Aug 2, 2022

Replies: 2 comments 5 replies

qdm12
Aug 2, 2022
Maintainer

FillHK Aug 2, 2022
Author

FillHK Aug 2, 2022
Author

qdm12 Aug 2, 2022
Maintainer

FillHK Aug 2, 2022
Author

qdm12 Aug 2, 2022
Maintainer

amuilyas
Feb 7, 2023