The original post: /r/pihole by /u/gunduthadiyan on 2024-09-27 11:40:11.
Hello,
I have been running pihole + unbound + wireguard + caddy in one of these cheap VPS’s(Oracle etc) for years just fine now. I have secured my setup using a combination of ipset + iptables. I have an ipset list called “dns-allowed” which contains a handful of ips(my home, my dad, brother, bff, wireguard range etc).
Further I have these entries. This works like a charm, I have an ansible playbook and I have kept spinning up/down vps’s.
-A INPUT -p tcp -m set --match-set dns-allowed src -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m set --match-set dns-allowed src -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m set --match-set dns-allowed src -m tcp --dport 53 -j ACCEPT
-A INPUT -p udp -m set --match-set dns-allowed src -m udp --dport 53 -j ACCEPT
I had some time in my hand and I also was reading about the upcoming pihole 6, so I wanted to migrate my setup over into a containerized model using docker. Further I made some minor tweaks to my setup.
My new dockerized setup which I have built out using docker-compose.
- cloudflared
- caddy
- pihole
I have gotten this to work very well, alas with one problem that I am unable to secure it. The iptables entries listed above don’t seem to work anymore and I am able to hit pihole dns from anywhere without any restrictions. Upon further investigation, it looks like Docker manages its own iptables and I have to tweak my setting accordingly. So I added this new line.
iptables -I DOCKER-USER 1 -i enp0s6 -m set ! --match-set dns-allowed src -j DROP
This seems to work, but then fundamentally pihole loses all its ability to query upstream to either my CloudFlare gateway or 1.1.1.1 or 8.8.8.8.
Can some kind knowledgeable soul point out what I am missing or doing wrong and how I can work around the predicament I am in.
Thank you all, especially the PiHole team, greatly appreciate all your time you guys have put into this effort over the years. I still have my PiHole commemorative coin in my desk.
GT