Right In The Pi-hole

Ran into issues with ubuntu-26.04-standard container in ProxMox in regards to dig: there was no output. Tested 22.04 and it worked. Resorted 25.04.

Pi-hole

REMEMBER TO SET YOUR DHCP UP!!! - Erin will find you

Setup

sudo rm -f /etc/resolv.conf
sudo bash -c 'cat <<EOF > /etc/resolv.conf
nameserver 1.1.1.1
nameserver 8.8.8.8
EOF'

sudo apt update && sudo apt upgrade -y



sudo apt install curl -y

sudo systemctl stop systemd-resolved
sudo systemctl disable systemd-resolved

curl -sSL https://install.pi-hole.net | sudo PIHOLE_SKIP_OS_CHECK=true bash

Selections

Do the setup questions...

Time

sudo systemctl stop systemd-timesyncd
sudo systemctl disable systemd-timesyncd
sudo dpkg-reconfigure tzdata

Password

pihole setpassword

URL

Go to http://IP:80/admin and login

Unbound

jnTracks pointed me this way...

Setup

sudo apt update
sudo apt install unbound -y
sudo nano /etc/unbound/unbound.conf.d/pi-hole.conf

Pasta

server:
    verbosity: 0
    interface: 127.0.0.1
    port: 5335
    do-ip4: yes
    do-udp: yes
    do-tcp: yes

    # May be set to yes if you have native IPv6 connectivity from your ISP
    do-ip6: no

    # Use the root hints file downloaded earlier
    root-hints: "/var/lib/unbound/root.hints"

    # Trust glue only if it is within the server's authority
    harden-glue: yes

    # Require DNSSEC data for trust-anchored zones, if such data is absent, the zone becomes BOGUS
    harden-dnssec-stripped: yes

    # Don't use Capitalization randomization (can cause issues with some upstream servers)
    use-caps-for-id: no

    # Reduce EDNS reassembly fragmentation issues (recommended value per RFC)
    edns-buffer-size: 1232

    # Perform prefetching of close-to-expired cache entries
    prefetch: yes

    # Match this to your VM's CPU cores
    num-threads: 1

    # Ensure kernel buffer is large enough to prevent losing messages during spikes
    so-rcvbuf: 4m

    # Ensure privacy of local infrastructure IP ranges
    private-address: 192.168.0.0/16
    private-address: 169.254.0.0/16
    private-address: 172.16.0.0/12
    private-address: 10.0.0.0/8
    private-address: fd00::/8
    private-address: fe80::/10

Get Root Hints

curl -o /var/lib/unbound/root.hints https://www.internic.net/domain/named.root

PreFlight Check

sudo systemctl restart unbound
sudo systemctl enable unbound

Test both a pass and a servfail

dig pi-hole.net @127.0.0.1 -p 5335

dig sigfail.attrib.org @127.0.0.1 -p 5335

Point Pi-Hole to Unbound

1. Open your Pi-hole Admin Web Interface in a browser.
2. Navigate to Settings > DNS.
3. Uncheck any public Upstream DNS Servers you had enabled (e.g., Google, Cloudflare).
4. Under the Custom DNS (IPv4) fields on the right, check the box and input:
   • 127.0.0.1#5335
5. Click Save at the bottom of the page.

Nebula Sync

Set PiHole

sudo pihole-FTL --config webserver.api.app_sudo true

Install

Don't do a round robin setup. It doesn't go well. Ask me how I know this...
I also opted to do a non-full sync as I have split DHCP scopes running.

wget https://github.com/lovelaze/nebula-sync/releases/latest/download/nebula-sync_0.11.2_linux_amd64.tar.gz

tar -xzf nebula-sync_*_linux_amd64.tar.gz
sudo mv nebula-sync /usr/local/bin/
sudo chmod +x /usr/local/bin/nebula-sync

sudo nano /etc/nebula-sync.env

PRIMARY=http://192.168.1.9|PASSWORD
REPLICAS=http://192.168.1.10|PASSWORD
FULL_SYNC=false
SYNC_CONFIG_DHCP=false
SYNC_CONFIG_DNS=true
SYNC_CONFIG_NTP=true
SYNC_CONFIG_RESOLVER=true
SYNC_CONFIG_DATABASE=true
SYNC_CONFIG_MISC=true
SYNC_GRAVITY_AD_LIST=true
SYNC_GRAVITY_AD_LIST_BY_GROUP=true
SYNC_GRAVITY_DOMAIN_LIST=true
SYNC_GRAVITY_DOMAIN_LIST_BY_GROUP=true
SYNC_GRAVITY_CLIENT=true
SYNC_GRAVITY_CLIENT_BY_GROUP=true
SYNC_GRAVITY_GROUP=true
RUN_GRAVITY=true
CRON=0 * * * *
TZ=America/New_York

sudo chmod 600 /etc/nebula-sync.env

sudo nano /etc/systemd/system/nebula-sync.service


[Unit]
Description=Nebula Sync Service for Pi-hole v6
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
ExecStart=/usr/local/bin/nebula-sync run --env-file /etc/nebula-sync.env
Restart=always
RestartSec=10

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable --now nebula-sync

Test

sudo /usr/local/bin/nebula-sync run --env-file /etc/nebula-sync.env

Ctrl+X