Actions

Right In The Pi-hole

From Mike Beane's Blog

Revision as of 22:14, 23 July 2026 by Rabbi Bob (talk | contribs) (→‎Setup)

Ran into issues with ubuntu-26.04-standard container in ProxMox in regards to dig: there was no output. Tested 22.04 and it worked. Resorted 25.04.

Pi-hole

Setup

sudo rm -f /etc/resolv.conf
sudo bash -c 'cat <<EOF > /etc/resolv.conf
nameserver 1.1.1.1
nameserver 8.8.8.8
EOF'

sudo apt update && sudo apt upgrade -y
sudo apt install curl -y

sudo systemctl stop systemd-resolved
sudo systemctl disable systemd-resolved

curl -sSL https://install.pi-hole.net | sudo PIHOLE_SKIP_OS_CHECK=true bash

Selections

Do the setup questions...

Password

pihole setpassword

URL

Go to http://IP:80/admin and login

Unbound

jnTracks pointed me this way...

Setup

sudo apt update
sudo apt install unbound -y
sudo nano /etc/unbound/unbound.conf.d/pi-hole.conf

Pasta

server:
    verbosity: 0
    interface: 127.0.0.1
    port: 5335
    do-ip4: yes
    do-udp: yes
    do-tcp: yes

    # May be set to yes if you have native IPv6 connectivity from your ISP
    do-ip6: no

    # Use the root hints file downloaded earlier
    root-hints: "/var/lib/unbound/root.hints"

    # Trust glue only if it is within the server's authority
    harden-glue: yes

    # Require DNSSEC data for trust-anchored zones, if such data is absent, the zone becomes BOGUS
    harden-dnssec-stripped: yes

    # Don't use Capitalization randomization (can cause issues with some upstream servers)
    use-caps-for-id: no

    # Reduce EDNS reassembly fragmentation issues (recommended value per RFC)
    edns-buffer-size: 1232

    # Perform prefetching of close-to-expired cache entries
    prefetch: yes

    # Match this to your VM's CPU cores
    num-threads: 1

    # Ensure kernel buffer is large enough to prevent losing messages during spikes
    so-rcvbuf: 4m

    # Ensure privacy of local infrastructure IP ranges
    private-address: 192.168.0.0/16
    private-address: 169.254.0.0/16
    private-address: 172.16.0.0/12
    private-address: 10.0.0.0/8
    private-address: fd00::/8
    private-address: fe80::/10

Get Root Hints

curl -o /var/lib/unbound/root.hints https://www.internic.net/domain/named.root

PreFlight Check

sudo systemctl restart unbound
sudo systemctl enable unbound

Test both a pass and a servfail 

dig pi-hole.net @127.0.0.1 -p 5335

dig sigfail.attrib.org @127.0.0.1 -p 5335

Point Pi-Hole to Unbound

  1. Open your Pi-hole Admin Web Interface in a browser.
  2. Navigate to Settings > DNS.
  3. Uncheck any public Upstream DNS Servers you had enabled (e.g., Google, Cloudflare).
  4. Under the Custom DNS (IPv4) fields on the right, check the box and input:
    • 127.0.0.1#5335
  5. Click Save at the bottom of the page.
Retrieved from "https://www.mikebeane.com/index.php?title=Right_In_The_Pi-hole&oldid=1964"