So I’ve been a pihole user for a long long time…but seeing the advancements in AdGuard Home and some of the nicer UI facets, I was interested in giving it a try. I also have an active directory domain that I need to manage as well.
So, prior to recently, I had routed all DNS requests thought the AD DCs, and their upstream resolver was PiHole, and then Pihole routed to its internal install of cloudflared with DNS over HTTPS to the cloudflare DNS services.
More recently, I changed my DNS services in DNS to point directly to pihole, managed my local dns records in pihole and then used conditional forwarding to my AD DCs for local DNS resolution. The biggest benefit I saw in this adjustment is that I can identify what hosts are making what requests.
More recently than that, I brought Adguard Home into the environment and am using it as a secondary DNS server. I ended up taking it out of the mix for the moment. My thought process was having one DNS server on each of my active VM hosts just in case…but managing internal DNS records in adguard home is a bit of a pain in the ass, and there is no way to import in bulk.
So, the questions, 1) do you just use one or the other… pihole, vs adguard home… 2) do you use multiple dns servers or just a single one upstream…3) whats your preferred method of internal dns management in conjunction w/ pihole/adguard home?
You must log in or register to comment.
I use Unbound as a DNS resolver and pfBlockerNG for ad blocking. My firewall blocks external DNS, DoH, & DoT servers except for
dns.adguard-dns.com, which I use on my phone.clients>pihole>unbound
Same. Although I really wish Pihole supported wildcard domains in local DNS. I haven’t quite figured out how to add wildcard domain with unbound.
If you use helm charts this is really easy!! The one I use from mojo exposes this in the helm chart / config.
It does, but you have to tinker a bit more than usual. Because pihole uses dnsmasq, you can modify the dnsmasq configuration file to allow for wildcard subdomains. Unfortunately, while this will be picked up by pihole, you can view or modify it through their Web interface, so it’s much less convenient.
Wait, is your unbound querying the root servers directly? Aren’t services that use cdn having their performance affected ?
Not that I’ve noticed
Opnsense Unbound
Pinhole+unbound
I use nextdns as I can use that when mobile but if you want a local solution adguard home has DOH/DOT built in and a nicer interface than pihole IMHO
Straight into Pihole with Cloudflare upstream
I use NextDNS on occasion. I used to use pihole a while back during the “Covid years” but something it was blocking royally screwed up my kid’s Google Classroom submitted schoolwork, he was turning in empty assignments and we thought it was his fault but it wasn’t. Had to apologize to multiple schoolteachers and vowed never to use that piece of shit software again.
If you have active directory why not just use it’s DNS server?
Clients --> Windows Server 2022 DNS --> Pihole --> Internet
Clients>Bind>pihole>unbound
I run 2 pihole containers on my k8s cluster. They serve up DNS to the rest of my network. This is extremely easy as I can just use helm to launch the pihole containers into two different namespaces using 2 different site specific files. Then I use teleport to keep them in sync when I change something, which is seldom. I run 2 because DNS is important and I like automated patching / reboots. This requires I have redundant services.
I’ve been using PiHole for years but just switched to NextDNS. Mainly because I use DNS to filter adult sites for my kids. NextDNS works regardless of the network they are on. I used to block YouTube etc at night but if we’re are on holiday they get no filter.
I switched to AD Guard (at home) now as I can configure DNS over TLS for devices that only support regular DNS. So for example my kids TV talks to AD Guard and then AD Guard looks at the MAC address and sends it down a specific DNS over TLS address. So that TV gets the filters of my kids NextDNS profile.
2 instances of Adguard Home (VM and Raspberry PI with adguard sync) using DOH upstream servers (currently Cloudflare, Quad 9, and Mullvad). Works like a champ, have not touched it in over a year.
I was using two instances of Pihole, one on a Pi and one via WSL on my Win10 host. Unfortunately my Win10 host no longer works, it’s randomly stopped and I haven’t had the time to try and fix it. I’ve got backups of the config luckily, but to be honest if I can do a more friendly local install with Adguard I’m probably going to give that a go on windows instead. Never tried it but I’m willing to give it a shot if it means it’s not going to break. My Pi install has been bulletproof so far and kept my network running whilst my Windows install has been broken.
I use technitium as the primary server, with a pair of backup servers running bind9.
The backup servers do zone-transfers from the primary.