Pihole network lan DHCP setup issue (not under docker)

z06frank · 16. Januar 2021

My OMV (version 5.5.21-1 Usul) is an Armbian Helios 64 NAS on 5.9.14-rockchip64. I have a raspberry pi3B running latest core version 5.2.3. with working Unbound pointing IPV4 to 127.0.0.1#5053 only. Static IP of the pihole is 192.168.1.103; static IP of the Helios 64 OMV is 192.168.1.115. My OMV hostname is:GryzNAS; router is a Asus RT-AX88U running asuswrt-merlin with gateway IP:192.168.1.1

Key point here is the pihole is setting the DHCP (router DHCP turned off). Pihole is not having any issues assigned DHCP to other clients (or other statics IPs assigned around the pihole/DNS server.....except for the OMV.

Current network settings of the OMV are:

My issue is I think is I need to open the several of OMVs ports across the lan as the pihole is sending dnsmasq-dhcp constantly and I think the OMV cannot answer due to closed ports.

I ran this CLI nmap:

pi@pihole: $ sudo nmap -sU -p67,80,443 --script dhcp-discover 192.168.1.115

Starting Nmap 7.70 ( https://nmap.org ) at 2021-01-15 16:22 CST

Nmap scan report for GryzNAS (192.168.1.115)

Host is up (0.00063s latency).

PORT STATE SERVICE

67/udp closed dhcps

80/udp closed http

443/udp closed https

MAC Address: 64:62:66:D0:09:84 (GryzNAS)

Nmap done: 1 IP address (1 host up) scanned in 2.18 seconds

The tail output from the pihole.log using this CLI command:

The query that dnsmasq-DHCP is constantly running from $ grep 'dnsmasq-dhcp' /var/log/pihole.log

Jan 15 13:24:14 dnsmasq-dhcp[1445]: DHCPINFORMATION-REQUEST(eth0) 00:02:00:00:ab:11:05:4b:fd:af:a4:b8:a1:76 GryzNAS

Jan 15 13:24:17 dnsmasq-dhcp[1445]: RTR-ADVERT(eth0) 2601:246:cc00:a00::

Jan 15 13:24:17 dnsmasq-dhcp[1445]: DHCPSOLICIT(eth0) 00:02:00:00:ab:11:05:4b:fd:af:a4:b8:a1:76

Jan 15 13:24:17 dnsmasq-dhcp[1445]: DHCPREPLY(eth0) 2601:246:cc00:a00::107 00:02:00:00:ab:11:05:4b:fd:af:a4:b8:a1: 76 GryzNAS

Jan 15 13:24:17 dnsmasq-dhcp[1445]: RTR-SOLICIT(eth0) 38:18:4c:0a:59:22

Jan 15 13:24:17 dnsmasq-dhcp[1445]: RTR-ADVERT(eth0) 2601:246:cc00:a00::

Jan 15 13:24:21 dnsmasq-dhcp[1445]: DHCPINFORMATION-REQUEST(eth0) 00:02:00:00:ab:11:05:4b:fd:af:a4:b8:a1:76 GryzNAS

Jan 15 13:24:28 dnsmasq-dhcp[1445]: DHCPINFORMATION-REQUEST(eth0) 00:02:00:00:ab:11:05:4b:fd:af:a4:b8:a1:76 GryzNAS

Jan 15 13:24:36 dnsmasq-dhcp[1445]: DHCPINFORMATION-REQUEST(eth0) 00:02:00:00:ab:11:05:4b:fd:af:a4:b8:a1:76 GryzNAS

Jan 15 13:24:36 dnsmasq-dhcp[1445]: RTR-SOLICIT(eth0) 04:5d:4b:86:d2:42

Jan 15 13:24:36 dnsmasq-dhcp[1445]: RTR-ADVERT(eth0) 2601:246:cc00:a00::

Jan 15 13:24:43 dnsmasq-dhcp[1445]: DHCPINFORMATION-REQUEST(eth0) 00:02:00:00:ab:11:05:4b:fd:af:a4:b8:a1:76 GryzNAS

This query is constantly running and taking up the pihole.log and wearing on the SD card of the rpi3b pihole.

How do I set up a new network interface to open the same ports as you show in the docker set up. But I obviously not using docker so I don't think this would be a vlan? I was looking here for help (downloadable PDF): [How To] OMV4 - Install Pi-Hole in Docker: Update 01/27/20 - Adding Unbound, a Recursive DNS Server

Thanks......

crashtest · 16. Januar 2021

If I'm understanding what you're doing correctly, I would assign a static IP address (or a static DHCP lease) and a public DNS server address, on your OMV server (the Helios 64).

Pi-hole is fine for LAN clients and it adds more security, but the server doesn't need pi-hole's block lists. The server will only be contacting software repo's for new packages or updates.

___________________________________________________

BTW, on your OMV server, these two ports of interest might be closed to udp, but they're open to TCP on your local LAN. They're necessary to connect to the WEB GUI.

80/udp closed http

443/udp closed https

z06frank · 16. Januar 2021

Are you saying the OMV static ip address (129.168.1.115) I assigned during set up are not addressed network lan? Here is my ifconfig from the OMV (GryzNAS). Note::

root@GryzNAS:~# ifconfig

docker0:

flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500

inet 172.17.0.1 netmask 255.255.0.0 broadcast 172.17.255.255

inet6 fe80::42:95ff:fe84:51f2 prefixlen 64 scopeid 0x20<link>

ether 02:42:95:84:51:f2 txqueuelen 0 (Ethernet)

RX packets 0 bytes 0 (0.0 B)

RX errors 0 dropped 0 overruns 0 frame 0

TX packets 1580 bytes 398827 (389.4 KiB)

TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

eth0:

flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500

inet 192.168.1.115 netmask 255.255.255.0 broadcast 192.168.1.255

inet6 fe80::6662:66ff:fed0:984 prefixlen 64 scopeid 0x20<link>

inet6 2601:246:cc00:a00:b2cd:7291:62a4:63d8 prefixlen 64 scopeid 0x0<global>

inet6 2601:246:cc00:a00::107 prefixlen 128 scopeid 0x0<global>

inet6 2601:246:cc00:a00:6662:66ff:fed0:984 prefixlen 64 scopeid 0x0<global>

ether 64:62:66:d0:09:84 txqueuelen 1000 (Ethernet)

RX packets 45681728 bytes 29074191714 (27.0 GiB)

RX errors 0 dropped 515686 overruns 0 frame 0

TX packets 49102046 bytes 72017111902 (67.0 GiB)

TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

device interrupt 27

lo:

flags=73<UP,LOOPBACK,RUNNING> mtu 65536

inet 127.0.0.1 netmask 255.0.0.0

inet6 ::1 prefixlen 128 scopeid 0x10<host>

loop txqueuelen 1000 (Local Loopback)

RX packets 194187 bytes 83526694 (79.6 MiB)

RX errors 0 dropped 0 overruns 0 frame 0

TX packets 194187 bytes 83526694 (79.6 MiB)

TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

veth3bc86dc:

flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500

inet6 fe80::ec4f:93ff:fece:97dd prefixlen 64 scopeid 0x20<link>

ether ee:4f:93:ce:97:dd txqueuelen 0 (Ethernet)

RX packets 0 bytes 0 (0.0 B)

RX errors 0 dropped 0 overruns 0 frame 0

TX packets 1604 bytes 404480 (395.0 KiB)

TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

Should I set up a new vlan static IP to eth0? And if so, assign this IPV4 as DHCP or create a new static IP to this vlan?

crashtest · 16. Januar 2021

Vlans would have to be assigned at your router or an actively managed switch. That shouldn't be a factor in a home LAN.

__________________________________________________________________________

All I'm suggesting is:

Don't let Pi-hole assign an IP address to your OMV server by DHCP

If you want to use DHCP to assign an address to your OMV server, use a static lease.

(Below is pi-hole's static lease assignment window.)

(OR)

Use a static IP address

________________________________________________________________________

In either case, if using a static DHCP lease OR a Static IP address,

use a public DNS server, for your Helios OMV server.

crashtest · 16. Januar 2021

The 172.x.x.x network (docker0) is an internal network used only on the host, by Docker. That's not a consideration.

z06frank · 16. Januar 2021

That seemed to help resolve the constant bombardment of DHCP requests. I also made a change in my Asus Rt-AX88U router and turned off "Enable Router Advertisement" under IPV6 settings.

In seeing people talk about enabling IPV6 in software and routers....the complication level goes up exponentially.... I agreeing

Thanks for your help crashtest!

Enable (Asus Rt-AX88U Router Advertisement

crashtest · 16. Januar 2021

Zitat von z06frank

In seeing people talk about enabling IPV6 in software and routers....the complication level goes up exponentially....

I agree.

As a personal preference, I won't touch IPv6 until I've forced to use it. While the concept is sound and the addressing structure is vast, there's too much potential for security issues in the implementation. I would want IPv6 to be in wide spread use for years, and thoroughly tested, before I'd adopt it. When I'm forced to use it, in my opinion, it will be ready.

Until then, NAT with private networks behind a router work fine for me. (But, I'm admittedly on the conservative side. )

Pihole network lan DHCP setup issue (not under docker)

crashtest 16. Januar 2021

crashtest 16. Januar 2021

Jetzt mitmachen!