> For the complete documentation index, see [llms.txt](https://docs.lapluu.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.lapluu.com/homelab/pi-hole-dns-sinkhole.md).

# Pi-hole DNS sinkhole

<div align="center"><figure><img src="https://www.endpointdev.com/blog/2020/12/pihole-great-holiday-gift/pihole-logo.png" alt="" width="375"><figcaption></figcaption></figure></div>

<div align="center"><figure><img src="https://upload.wikimedia.org/wikipedia/commons/thumb/9/92/Unraid-logo-2024.svg/2560px-Unraid-logo-2024.svg.png" alt="" width="188"><figcaption></figcaption></figure></div>

## Objective

* Install and configure Pi-hole docker on my Unraid server.
* Configure upstream DNS setting and Adlists/Blocklists
* Configure clients DNS manually and router DNS.

## Install and configure Pi-hole docker on my Unraid server

Unraid supports community applications plugin, and I navigate there and install pihole docker by Spants's Repository.

<figure><img src="https://1820870588-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fh2Mfv6GozWnEgtcWgNdQ%2Fuploads%2FGJnkAXlotkZAg0sAVPy5%2Fimage.png?alt=media&amp;token=6c6efd52-d0e9-4473-b783-0758250cd150" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1820870588-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fh2Mfv6GozWnEgtcWgNdQ%2Fuploads%2Fu5zSVx1L7hMD1rzipuEn%2FPihole_Config.PNG?alt=media&amp;token=8a96959c-0609-43eb-94c6-ae58374634a3" alt=""><figcaption></figcaption></figure>

Follow official docker-compose.yml, I set the repository **"pihole/pihole:latest"** to download pihole image, add parameters **"--cap-add=NET\_ADMIN"** to be able to run Pi-hole as DHCP server.

Create static IP address "192.168.1.9"

Set TCP/UDP port number to 53.

## Configure upstream DNS setting and Adlists/Blocklists

After saved my configuration, Unraid will download docker image and start my docker automatically.

### Upstream DNS setting

Once I accessed Pi-hole web GUI,  I navigated to Settings > DNS.

<figure><img src="https://1820870588-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fh2Mfv6GozWnEgtcWgNdQ%2Fuploads%2Fvn545GOht4PgcNxyRsta%2Fimage.png?alt=media&amp;token=fac12d7b-bf85-4cea-b333-9833e745de48" alt=""><figcaption></figcaption></figure>

I selected Cloudflare as my upstream DNS for faster queries speed.

I enabled "Permit all origins" because I also use this DNS server for my VPN.

For advanced DNS setting, I selected "Enable DNSSEC", this can help avoid DNS poisoning attack.

### Adlists/Blocklists

I started adding a few blocklists, which are provided by The firebog.

<figure><img src="https://1820870588-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fh2Mfv6GozWnEgtcWgNdQ%2Fuploads%2F2XVioOL8pGC2AV94ptHr%2Fimage.png?alt=media&amp;token=1d12a491-b648-4090-87ba-90168d9f83d1" alt=""><figcaption></figcaption></figure>

I did not add many blocklists to my pi-hole to prevent false positives, which could cause more inconvenience.

## Configure DNS on OPNsense router and endpoint devices

Navigated to Services > DHCPv4 > LAN interface, and entered the Pi-hole IP address in DNS option.

This would route any DNS queries of endpoint devices on LAN interface to Pi-hole.

<figure><img src="https://1820870588-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fh2Mfv6GozWnEgtcWgNdQ%2Fuploads%2FWEmHmWnrjSlkR9nfOPB1%2Fimage.png?alt=media&amp;token=b3946de4-40e9-4217-b4b5-b0f4c60cc477" alt=""><figcaption></figcaption></figure>

For devices were using static IP address, I configured their prefer DNS point to Pi-hole

<figure><img src="https://1820870588-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fh2Mfv6GozWnEgtcWgNdQ%2Fuploads%2FLQoPcmjLI9HFaIfjEpP0%2F%E1%BA%A3nh.png?alt=media&amp;token=d4a36a3d-a358-4af3-abc8-98488065f85b" alt="" width="375"><figcaption></figcaption></figure>

## Checking query log

Once I configured everything, I went check to see if pi-hole was getting any queries.

<figure><img src="https://1820870588-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fh2Mfv6GozWnEgtcWgNdQ%2Fuploads%2Fg2QuIhbRZ4q78oQtPcu4%2F%E1%BA%A3nh.png?alt=media&amp;token=a3e75b09-7efd-43fc-a829-4946fce3a0bf" alt=""><figcaption></figcaption></figure>

For more information, I navigated to query log.

<figure><img src="https://1820870588-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fh2Mfv6GozWnEgtcWgNdQ%2Fuploads%2FUAOpnvTBTdGdf4wXFMgy%2F%E1%BA%A3nh.png?alt=media&amp;token=e5d8dba1-2529-4fea-910a-17e5b4c147a0" alt=""><figcaption></figcaption></figure>

## Conclusion

In summary, Pi-hole is an excellent open-source DNS server that effectively filters out bogus, malware, and adult domains according to my preferences. It plays a crucial role in protecting my family's privacy by blocking trackers across many websites.

However, at its core, Pi-hole is primarily a DNS forwarder, though it can also serve as a home recursive DNS. To further enhance my family's privacy, especially from large ISPs, I'm exploring better DNS servers that support DNS-over-TLS or DNS-over-HTTPS.