Replying to an earlier post

One day, our internet just stopped working entirely. Our ISP was fine, router good, but no outside connection and I couldn’t access local devices. I have two Unraid servers. I took a quick glance at them, they were powered on, all looked ok. I decide to power cycle everything. Still no internet. Then I realize that I can still access Google from my phone when on WiFi… hmm. That would mean… an issue with pi-hole!

I begin to try to diagnose from my phone with a hotspot to my computer. I’m getting warmer but some things just aren’t making sense. I go back and stare at the server running pi-hole. Then it fucking hits me.

I have the pretty odd and totally not ideal home network. I have plans to upgrade everything but currently I have two wifi networks tied to the same WAN. One network is run off of access points so I can get Ethernet to odd areas of the property. The Unraid server hosting pi-hole was connected to an AP and the Ethernet cable I used didn’t have a clip, so it just barely unseated itself from it, breaking the connection. The router+pi-hole config meant also breaking the internet if anything happened to pi-hole or that server. I swapped it for a better cable and it all instantly started working.

Spent that weekend sorting out the network so it doesn’t happen again. It was definitely a head-scratcher.

Replying to @⁨nnullzz@lemmy.world⁩

I’ve been running two piholes for a few years:

I let the router handle dhcp, while having it hand out each of the piholes IPs as DNS #1 and DNS #2. Those piholes settings are mirrored using Nebula-Sync, so any change made to one pihole gets copied over to the other automatically.

Both of those piholes are setup to wrap outbound DNS reqests in DOH as well, with the router blocking port 53 outbound. So all DNS traffic leaving the network has to be DOH/DOT or it just gets dropped. Currently using NextDNS and quad9 as my upstream DOH providers.

Note: the cloudflared method for DOH is outdated. I’m still using it via the docker image “image: cloudflare/cloudflared:2025.11.1”

I believe This (dns-crypt) is the more recent method.

Synchronize configuration of multiple Pi-hole v6.x instances.  - lovelaze/nebula-syncGitHubGitHub - lovelaze/nebula-sync: Synchronize configuration of multiple Pi-hole v6.x instances.Synchronize configuration of multiple Pi-hole v6.x instances. - lovelaze/nebula-sync

Replying to an earlier post

I mean, would you want it to serve clients outside of your subnet? I guess maybe if you had something like a guest network. But I tend to take the “fuck it, you get basic service and nothing else” approach to things like guest networks.

Isn’t it a potential security issue to have your pihole serve things on any subnet, because it allows an improperly configured firewall to stab at your pihole? I think you can specify any additional subnets it will serve in the settings somewhere. But IIRC, the default behavior is to intentionally drop traffic from unknown subnets. But that’s just off the top of my head.